Add seccomp bpf sandboxing to redbean

It's now possible to pass the `-S` or `-SS` flags to sandbox redbean
worker proecsses after they've been forked. The first `-S` flag is
intended to be a permissive builtin policy that limits system calls to
only that which the various parts of redbean serving need. The second
`-SS` flag is intended to be more restrictive, preventing things like
the Lua extensions you download off the web from using the HTTP client
or sockets APIs. In upcoming changes you'll be able to implement your
own Berkeley Packet Filter sandbox programs and load them via Lua.

libc/sock/asanmsghdr.c

@@ -0,0 +1,31 @@
+/*-*- mode:c;indent-tabs-mode:nil;c-basic-offset:2;tab-width:8;coding:utf-8 -*-│
+│vi: set net ft=c ts=2 sts=2 sw=2 fenc=utf-8                                :vi│
+╞══════════════════════════════════════════════════════════════════════════════╡
+│ Copyright 2022 Justine Alexandra Roberts Tunney                              │
+│                                                                              │
+│ Permission to use, copy, modify, and/or distribute this software for         │
+│ any purpose with or without fee is hereby granted, provided that the         │
+│ above copyright notice and this permission notice appear in all copies.      │
+│                                                                              │
+│ THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL                │
+│ WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED                │
+│ WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE             │
+│ AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL         │
+│ DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR        │
+│ PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER               │
+│ TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR             │
+│ PERFORMANCE OF THIS SOFTWARE.                                                │
+╚─────────────────────────────────────────────────────────────────────────────*/
+#include "libc/intrin/asan.internal.h"
+#include "libc/sock/sock.h"
+
+bool __asan_is_valid_msghdr(const struct msghdr *msg) {
+  if (!__asan_is_valid(msg, sizeof(struct msghdr))) return false;
+  if (msg->msg_name) {
+    if (!__asan_is_valid(msg->msg_name, msg->msg_namelen)) return false;
+  }
+  if (msg->msg_control) {
+    if (!__asan_is_valid(msg->msg_control, msg->msg_controllen)) return false;
+  }
+  return __asan_is_valid_iov(msg->msg_iov, msg->msg_iovlen);
+}

libc/sock/internal.h

@@ -132,6 +132,7 @@ int sys_select_nt(int, fd_set *, fd_set *, fd_set *, struct timeval *) hidden;
 int sys_shutdown_nt(struct Fd *, int) hidden;
 int sys_setsockopt_nt(struct Fd *, int, int, const void *, uint32_t) hidden;
 
+bool __asan_is_valid_msghdr(const struct msghdr *);
 ssize_t sys_send_nt(int, const struct iovec *, size_t, uint32_t) hidden;
 ssize_t sys_recv_nt(struct Fd *, const struct iovec *, size_t, uint32_t) hidden;
 size_t __iovec2nt(struct NtIovec[hasatleast 16], const struct iovec *,

libc/sock/recvmsg.c

@@ -39,34 +39,58 @@
  * @restartable (unless SO_RCVTIMEO)
  */
 ssize_t recvmsg(int fd, struct msghdr *msg, int flags) {
-  ssize_t got;
-  if (!IsWindows()) {
+  ssize_t rc, got;
+  if (IsAsan() && !__asan_is_valid_msghdr(msg)) {
+    rc = efault();
+  } else if (!IsWindows()) {
     got = sys_recvmsg(fd, msg, flags);
-    /* An address was provided, convert from BSD form */
+    // An address was provided, convert from BSD form
     if (msg->msg_name && IsBsd() && got != -1) {
       sockaddr2linux(msg->msg_name);
     }
-    return got;
-  } else {
-    if (__isfdopen(fd)) {
-      if (msg->msg_control) return einval(); /* control msg not supported */
+    rc = got;
+  } else if (__isfdopen(fd)) {
+    if (!msg->msg_control) {
       if (__isfdkind(fd, kFdSocket)) {
-        return sys_recvfrom_nt(&g_fds.p[fd], msg->msg_iov, msg->msg_iovlen,
-                               flags, msg->msg_name, &msg->msg_namelen);
+        rc = sys_recvfrom_nt(&g_fds.p[fd], msg->msg_iov, msg->msg_iovlen, flags,
+                             msg->msg_name, &msg->msg_namelen);
       } else if (__isfdkind(fd, kFdFile) && !msg->msg_name) { /* socketpair */
-        if (flags) return einval();
-        if ((got = sys_read_nt(&g_fds.p[fd], msg->msg_iov, msg->msg_iovlen,
-                               -1)) != -1) {
-          msg->msg_flags = 0;
-          return got;
+        if (!flags) {
+          if ((got = sys_read_nt(&g_fds.p[fd], msg->msg_iov, msg->msg_iovlen,
+                                 -1)) != -1) {
+            msg->msg_flags = 0;
+            rc = got;
+          } else {
+            rc = -1;
+          }
         } else {
-          return -1;
+          rc = einval();  // flags not supported on nt
         }
       } else {
-        return enotsock();
+        rc = enotsock();
       }
     } else {
-      return ebadf();
+      rc = einval();  // control msg not supported on nt
+    }
+  } else {
+    rc = ebadf();
+  }
+#if defined(SYSDEBUG) && _DATATRACE
+  if (__strace > 0) {
+    if (!msg || (rc == -1 && errno == EFAULT)) {
+      DATATRACE("recvmsg(%d, %p, %#x) → %'ld% m", fd, msg, flags, rc);
+    } else {
+      kprintf(STRACE_PROLOGUE "recvmsg(%d, [{");
+      if (msg->msg_namelen)
+        kprintf(".name=%#.*hhs, ", msg->msg_namelen, msg->msg_name);
+      if (msg->msg_controllen)
+        kprintf(".control=%#.*hhs, ", msg->msg_controllen, msg->msg_control);
+      if (msg->msg_flags) kprintf(".flags=%#x, ", msg->msg_flags);
+      kprintf(".iov=", fd);
+      __strace_iov(msg->msg_iov, msg->msg_iovlen, rc != -1 ? rc : 0);
+      kprintf("}], %#x) → %'ld% m%n", flags, rc);
     }
   }
+#endif
+  return rc;
 }

libc/sock/sendmsg.c

@@ -18,8 +18,11 @@
 ╚─────────────────────────────────────────────────────────────────────────────*/
 #include "libc/assert.h"
 #include "libc/calls/internal.h"
+#include "libc/calls/strace.internal.h"
 #include "libc/calls/struct/iovec.h"
 #include "libc/dce.h"
+#include "libc/intrin/asan.internal.h"
+#include "libc/intrin/kprintf.h"
 #include "libc/sock/internal.h"
 #include "libc/sock/sock.h"
 #include "libc/str/str.h"
@@ -39,35 +42,57 @@
  * @restartable (unless SO_RCVTIMEO)
  */
 ssize_t sendmsg(int fd, const struct msghdr *msg, int flags) {
-  if (!IsWindows()) {
+  int64_t rc;
+  char addr2[128];
+  struct msghdr msg2;
+  if (IsAsan() && !__asan_is_valid_msghdr(msg)) {
+    rc = efault();
+  } else if (!IsWindows()) {
     if (IsBsd() && msg->msg_name) {
       /* An optional address is provided, convert it to the BSD form */
-      char addr2[128];
-      struct msghdr msg2;
-      if (msg->msg_namelen > sizeof(addr2)) return einval();
-      memcpy(&addr2[0], msg->msg_name, msg->msg_namelen);
-      sockaddr2bsd(&addr2[0]);
-
-      /* Copy all of msg (except for msg_name) into the new ephemeral local */
-      memcpy(&msg2, msg, sizeof(msg2));
-      msg2.msg_name = &addr2[0];
-      return sys_sendmsg(fd, &msg2, flags);
+      if (msg->msg_namelen <= sizeof(addr2)) {
+        memcpy(&addr2[0], msg->msg_name, msg->msg_namelen);
+        sockaddr2bsd(&addr2[0]);
+        /* Copy all of msg (except for msg_name) into the new ephemeral local */
+        memcpy(&msg2, msg, sizeof(msg2));
+        msg2.msg_name = &addr2[0];
+        rc = sys_sendmsg(fd, &msg2, flags);
+      } else {
+        rc = einval();
+      }
     }
     /* else do the syscall */
-    return sys_sendmsg(fd, msg, flags);
-  } else {
-    if (__isfdopen(fd)) {
-      if (msg->msg_control) return einval(); /* control msg not supported */
-      if (__isfdkind(fd, kFdSocket)) {
-        return sys_sendto_nt(fd, msg->msg_iov, msg->msg_iovlen, flags,
-                             msg->msg_name, msg->msg_namelen);
-      } else if (__isfdkind(fd, kFdFile)) {
-        return sys_write_nt(fd, msg->msg_iov, msg->msg_iovlen, -1);
-      } else {
-        return enotsock();
-      }
+    rc = sys_sendmsg(fd, msg, flags);
+  } else if (__isfdopen(fd)) {
+    if (msg->msg_control) {
+      rc = einval(); /* control msg not supported */
+    } else if (__isfdkind(fd, kFdSocket)) {
+      rc = sys_sendto_nt(fd, msg->msg_iov, msg->msg_iovlen, flags,
+                         msg->msg_name, msg->msg_namelen);
+    } else if (__isfdkind(fd, kFdFile)) {
+      rc = sys_write_nt(fd, msg->msg_iov, msg->msg_iovlen, -1);
     } else {
-      return ebadf();
+      rc = enotsock();
+    }
+  } else {
+    rc = ebadf();
+  }
+#if defined(SYSDEBUG) && _DATATRACE
+  if (__strace > 0) {
+    if (!msg || (rc == -1 && errno == EFAULT)) {
+      DATATRACE("sendmsg(%d, %p, %#x) → %'ld% m", fd, msg, flags, rc);
+    } else {
+      kprintf(STRACE_PROLOGUE "sendmsg(%d, {");
+      if (msg->msg_namelen)
+        kprintf(".name=%#.*hhs, ", msg->msg_namelen, msg->msg_name);
+      if (msg->msg_controllen)
+        kprintf(".control=%#.*hhs, ", msg->msg_controllen, msg->msg_control);
+      if (msg->msg_flags) kprintf(".flags=%#x, ", msg->msg_flags);
+      kprintf(".iov=", fd);
+      __strace_iov(msg->msg_iov, msg->msg_iovlen, rc != -1 ? rc : 0);
+      kprintf("}, %#x) → %'ld% m%n", flags, rc);
     }
   }
+#endif
+  return rc;
 }

libc/sock/syslog.c

@@ -50,7 +50,12 @@ static int log_mask;
 static uint16_t log_id; /* Used for Windows EvtID */
 static int64_t log_fd = -1;
 
-static const struct sockaddr_un log_addr = {AF_UNIX, "/dev/log"};
+static const char *const kLogPaths[] = {
+    "/dev/log",
+    // "/var/run/log", // TODO: Help with XNU and FreeBSD.
+};
+
+static struct sockaddr_un log_addr = {AF_UNIX, "/dev/log"};
 
 static int64_t Time(int64_t *tp) {
   struct timespec ts;
@@ -73,16 +78,20 @@ forceinline int is_lost_conn(int e) {
 }
 
 static void __openlog() {
+  int i;
   if (IsWindows()) {
     log_fd = RegisterEventSource(NULL, log_ident);
   } else {
     log_fd = socket(AF_UNIX, SOCK_DGRAM | SOCK_CLOEXEC, 0);
     if (log_fd >= 0) {
-      int rc = connect(log_fd, (void *)&log_addr, sizeof(log_addr));
-      if (rc < 0) {
-        printf("ERR: connect(openlog) failed: %s (errno=%d)\n", strerror(errno),
-               errno);
+      for (i = 0; i < ARRAYLEN(kLogPaths); ++i) {
+        strcpy(log_addr.sun_path, kLogPaths[i]);
+        if (!connect(log_fd, (void *)&log_addr, sizeof(log_addr))) {
+          return;
+        }
       }
+      printf("ERR: connect(openlog) failed: %s (errno=%d)\n", strerror(errno),
+             errno);
     }
   }
 }

libc/sock/syslog.h

@@ -1,11 +1,9 @@
 #ifndef COSMOPOLITAN_LIBC_SOCK_SYSLOG_H_
 #define COSMOPOLITAN_LIBC_SOCK_SYSLOG_H_
-
-
 #if !(__ASSEMBLER__ + __LINKER__ + 0)
 COSMOPOLITAN_C_START_
 
-#define	LOG_PRI(p)	((p) & LOG_PRIMASK)
+#define LOG_PRI(p) (LOG_PRIMASK & (p))
 
 int setlogmask(int);
 void openlog(const char *, int, int);