mirror of
https://github.com/jart/cosmopolitan.git
synced 2025-02-07 06:53:33 +00:00
Fix pledge.com interop with Go DNS
Based on a pure analysis of the Go source code, it wants: - SOL_SOCKET + SO_BROADCAST - IPPROTO_IPV6 + IPV6_V6ONLY Fixes #627
This commit is contained in:
Justine Tunney
parent
e14ae1642e
commit
be29b709b7
3 changed files with 68 additions and 58 deletions
|
|
@ -660,15 +660,16 @@ static const uint16_t kPledgeUnix[] = {
|
|||
};
|
||||
|
||||
static const uint16_t kPledgeDns[] = {
|
||||
__NR_linux_socket | INET, //
|
||||
__NR_linux_bind, //
|
||||
__NR_linux_sendto, //
|
||||
__NR_linux_connect, //
|
||||
__NR_linux_recvfrom, //
|
||||
__NR_linux_fstatat, //
|
||||
__NR_linux_openat | READONLY, //
|
||||
__NR_linux_read, //
|
||||
__NR_linux_close, //
|
||||
__NR_linux_socket | INET, //
|
||||
__NR_linux_bind, //
|
||||
__NR_linux_sendto, //
|
||||
__NR_linux_connect, //
|
||||
__NR_linux_recvfrom, //
|
||||
__NR_linux_setsockopt | RESTRICT, //
|
||||
__NR_linux_fstatat, //
|
||||
__NR_linux_openat | READONLY, //
|
||||
__NR_linux_read, //
|
||||
__NR_linux_close, //
|
||||
};
|
||||
|
||||
static const uint16_t kPledgeTty[] = {
|
||||
|
|
@ -1160,7 +1161,7 @@ static privileged void AllowCloneThread(struct Filter *f) {
|
|||
//
|
||||
static privileged void AllowIoctlStdio(struct Filter *f) {
|
||||
static const struct sock_filter fragment[] = {
|
||||
/*L0*/ BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_linux_ioctl, 0, 8 - 1),
|
||||
/*L0*/ BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_linux_ioctl, 0, 7),
|
||||
/*L1*/ BPF_STMT(BPF_LD | BPF_W | BPF_ABS, OFF(args[1])),
|
||||
/*L2*/ BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0x541b, 3, 0),
|
||||
/*L3*/ BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0x5421, 2, 0),
|
||||
|
|
@ -1206,7 +1207,7 @@ static privileged void AllowIoctlInet(struct Filter *f) {
|
|||
//
|
||||
static privileged void AllowIoctlTty(struct Filter *f) {
|
||||
static const struct sock_filter fragment[] = {
|
||||
/* L0*/ BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_linux_ioctl, 0, 16 - 1),
|
||||
/* L0*/ BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_linux_ioctl, 0, 15),
|
||||
/* L1*/ BPF_STMT(BPF_LD | BPF_W | BPF_ABS, OFF(args[1])),
|
||||
/* L2*/ BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0x5401, 11, 0),
|
||||
/* L3*/ BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0x5402, 10, 0),
|
||||
|
|
@ -1232,6 +1233,7 @@ static privileged void AllowIoctlTty(struct Filter *f) {
|
|||
// - SOL_IP (0)
|
||||
// - SOL_SOCKET (1)
|
||||
// - SOL_TCP (6)
|
||||
// - SOL_IPV6 (41)
|
||||
//
|
||||
// The optname argument of setsockopt() must be one of:
|
||||
//
|
||||
|
|
@ -1242,6 +1244,7 @@ static privileged void AllowIoctlTty(struct Filter *f) {
|
|||
// - SO_TYPE (0x03)
|
||||
// - SO_ERROR (0x04)
|
||||
// - SO_DONTROUTE (0x05)
|
||||
// - SO_BROADCAST (0x06)
|
||||
// - SO_REUSEPORT (0x0f)
|
||||
// - SO_REUSEADDR (0x02)
|
||||
// - SO_KEEPALIVE (0x09)
|
||||
|
|
@ -1251,33 +1254,36 @@ static privileged void AllowIoctlTty(struct Filter *f) {
|
|||
// - IP_RECVERR (0x0b)
|
||||
// - TCP_FASTOPEN (0x17)
|
||||
// - TCP_FASTOPEN_CONNECT (0x1e)
|
||||
// - IPV6_V6ONLY (0x1a)
|
||||
//
|
||||
static privileged void AllowSetsockoptRestrict(struct Filter *f) {
|
||||
static const int nr = __NR_linux_setsockopt;
|
||||
static const struct sock_filter fragment[] = {
|
||||
/* L0*/ BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, nr, 0, 21 - 1),
|
||||
/* L1*/ BPF_STMT(BPF_LD | BPF_W | BPF_ABS, OFF(args[1])),
|
||||
/* L2*/ BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0, 2, 0),
|
||||
/* L3*/ BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 1, 1, 0),
|
||||
/* L4*/ BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 6, 0, 20 - 5),
|
||||
/* L5*/ BPF_STMT(BPF_LD | BPF_W | BPF_ABS, OFF(args[2])),
|
||||
/* L6*/ BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0x0f, 13, 0),
|
||||
/* L6*/ BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0x03, 12, 0),
|
||||
/* L7*/ BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0x0c, 11, 0),
|
||||
/* L8*/ BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0x13, 10, 0),
|
||||
/* L9*/ BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0x02, 9, 0),
|
||||
/*L10*/ BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0x09, 8, 0),
|
||||
/*L11*/ BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0x14, 7, 0),
|
||||
/*L12*/ BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0x01, 6, 0),
|
||||
/*L13*/ BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0x0b, 5, 0),
|
||||
/*L14*/ BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0x04, 4, 0),
|
||||
/*L15*/ BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0x05, 3, 0),
|
||||
/*L16*/ BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0x17, 2, 0),
|
||||
/*L17*/ BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0x1e, 1, 0),
|
||||
/*L18*/ BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0x15, 0, 1),
|
||||
/*L19*/ BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_ALLOW),
|
||||
/*L20*/ BPF_STMT(BPF_LD | BPF_W | BPF_ABS, OFF(nr)),
|
||||
/*L21*/ /* next filter */
|
||||
BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_linux_setsockopt, 0, 24),
|
||||
BPF_STMT(BPF_LD | BPF_W | BPF_ABS, OFF(args[1])),
|
||||
BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 41, 3, 0),
|
||||
BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0, 2, 0),
|
||||
BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 1, 1, 0),
|
||||
BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 6, 0, 18),
|
||||
BPF_STMT(BPF_LD | BPF_W | BPF_ABS, OFF(args[2])),
|
||||
BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0x1a, 15, 0),
|
||||
BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0x06, 14, 0),
|
||||
BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0x0f, 13, 0),
|
||||
BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0x03, 12, 0),
|
||||
BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0x0c, 11, 0),
|
||||
BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0x13, 10, 0),
|
||||
BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0x02, 9, 0),
|
||||
BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0x09, 8, 0),
|
||||
BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0x14, 7, 0),
|
||||
BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0x01, 6, 0),
|
||||
BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0x0b, 5, 0),
|
||||
BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0x04, 4, 0),
|
||||
BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0x05, 3, 0),
|
||||
BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0x17, 2, 0),
|
||||
BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0x1e, 1, 0),
|
||||
BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0x15, 0, 1),
|
||||
BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_ALLOW),
|
||||
BPF_STMT(BPF_LD | BPF_W | BPF_ABS, OFF(nr)),
|
||||
/* next filter */
|
||||
};
|
||||
AppendFilter(f, PLEDGE(fragment));
|
||||
}
|
||||
|
|
@ -1300,10 +1306,10 @@ static privileged void AllowSetsockoptRestrict(struct Filter *f) {
|
|||
static privileged void AllowGetsockoptRestrict(struct Filter *f) {
|
||||
static const int nr = __NR_linux_getsockopt;
|
||||
static const struct sock_filter fragment[] = {
|
||||
/* L0*/ BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, nr, 0, 14 - 1),
|
||||
/* L0*/ BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, nr, 0, 13),
|
||||
/* L1*/ BPF_STMT(BPF_LD | BPF_W | BPF_ABS, OFF(args[1])),
|
||||
/* L2*/ BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 1, 1, 0),
|
||||
/* L3*/ BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 6, 0, 13 - 4),
|
||||
/* L3*/ BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 6, 0, 9),
|
||||
/* L4*/ BPF_STMT(BPF_LD | BPF_W | BPF_ABS, OFF(args[2])),
|
||||
/* L5*/ BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0x03, 6, 0),
|
||||
/* L6*/ BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0x04, 5, 0),
|
||||
|
|
|
|||
|
|
@ -49,7 +49,9 @@
|
|||
#include "libc/sysv/consts/pr.h"
|
||||
#include "libc/sysv/consts/prot.h"
|
||||
#include "libc/sysv/consts/sig.h"
|
||||
#include "libc/sysv/consts/so.h"
|
||||
#include "libc/sysv/consts/sock.h"
|
||||
#include "libc/sysv/consts/sol.h"
|
||||
#include "libc/testlib/ezbench.h"
|
||||
#include "libc/testlib/testlib.h"
|
||||
#include "libc/thread/spawn.h"
|
||||
|
|
@ -310,7 +312,7 @@ TEST(pledge, wpath_doesNotImplyRpath) {
|
|||
|
||||
TEST(pledge, inet_forbidsOtherSockets) {
|
||||
if (IsOpenbsd()) return; // b/c testing linux bpf
|
||||
int ws, pid;
|
||||
int ws, pid, yes = 1;
|
||||
ASSERT_NE(-1, (pid = fork()));
|
||||
if (!pid) {
|
||||
ASSERT_SYS(0, 0, pledge("stdio inet", 0));
|
||||
|
|
@ -319,10 +321,12 @@ TEST(pledge, inet_forbidsOtherSockets) {
|
|||
ASSERT_SYS(0, 5, socket(AF_INET, SOCK_STREAM, IPPROTO_TCP));
|
||||
ASSERT_SYS(0, 6, socket(AF_INET6, SOCK_DGRAM, IPPROTO_UDP));
|
||||
ASSERT_SYS(0, 7, socket(AF_INET6, SOCK_DGRAM | SOCK_NONBLOCK, IPPROTO_UDP));
|
||||
ASSERT_SYS(0, 0, setsockopt(3, SOL_SOCKET, SO_BROADCAST, &yes, 4));
|
||||
ASSERT_SYS(EPERM, -1, socket(AF_UNIX, SOCK_STREAM, 0));
|
||||
ASSERT_SYS(EPERM, -1, socket(AF_BLUETOOTH, SOCK_DGRAM, IPPROTO_UDP));
|
||||
ASSERT_SYS(EPERM, -1, socket(AF_INET, SOCK_RAW, IPPROTO_UDP));
|
||||
ASSERT_SYS(EPERM, -1, socket(AF_INET, SOCK_DGRAM, IPPROTO_RAW));
|
||||
ASSERT_SYS(EPERM, -1, setsockopt(3, SOL_SOCKET, SO_TIMESTAMP, &yes, 4));
|
||||
struct sockaddr_in sin = {AF_INET, 0, {htonl(0x7f000001)}};
|
||||
ASSERT_SYS(0, 0, bind(4, &sin, sizeof(sin)));
|
||||
uint32_t az = sizeof(sin);
|
||||
|
|
|
|||
|
|
@ -4,14 +4,14 @@ t=/tmp/pledge-test
|
|||
|
||||
if [ $# = 0 ]; then
|
||||
if ! [ $(id -u) = 0 ]; then
|
||||
make -j16 MODE= \
|
||||
o//examples/ls.com \
|
||||
o//examples/curl.com \
|
||||
o//examples/life.com \
|
||||
o//examples/hello.com \
|
||||
o//examples/printargs.com \
|
||||
o//tool/build/assimilate.com \
|
||||
o//tool/build/pledge.com || exit
|
||||
make -j16 MODE=fastbuild \
|
||||
o/fastbuild/examples/ls.com \
|
||||
o/fastbuild/examples/curl.com \
|
||||
o/fastbuild/examples/life.com \
|
||||
o/fastbuild/examples/hello.com \
|
||||
o/fastbuild/examples/printargs.com \
|
||||
o/fastbuild/tool/build/assimilate.com \
|
||||
o/fastbuild/tool/build/pledge.com || exit
|
||||
make -j16 MODE=$m \
|
||||
o/$m/examples/ls.com \
|
||||
o/$m/examples/curl.com \
|
||||
|
|
@ -67,16 +67,16 @@ elif [ "$1" = ape_binfmt_test_suite ]; then
|
|||
ape/apeinstall.sh >/dev/null 2>&1
|
||||
|
||||
startit ape binfmt life.com
|
||||
o//tool/build/pledge.com -p 'stdio rpath prot_exec' o//examples/life.com
|
||||
o/fastbuild/tool/build/pledge.com -p 'stdio rpath prot_exec' o/fastbuild/examples/life.com
|
||||
[ $? = 42 ]
|
||||
checkem
|
||||
|
||||
startit ape binfmt hello.com
|
||||
[ "$(o//tool/build/pledge.com -p 'stdio rpath prot_exec' o//examples/hello.com)" = "hello world" ]
|
||||
[ "$(o/fastbuild/tool/build/pledge.com -p 'stdio rpath prot_exec' o/fastbuild/examples/hello.com)" = "hello world" ]
|
||||
checkem
|
||||
|
||||
startit ape binfmt curl.com
|
||||
[ "$(o//tool/build/pledge.com -p 'stdio inet dns rpath prot_exec' o//examples/curl.com https://justine.lol/hello.txt)" = "hello world" ]
|
||||
[ "$(o/fastbuild/tool/build/pledge.com -p 'stdio inet dns rpath prot_exec' o/fastbuild/examples/curl.com https://justine.lol/hello.txt)" = "hello world" ]
|
||||
checkem
|
||||
|
||||
elif [ "$1" = ape_loader_test_suite ]; then
|
||||
|
|
@ -84,16 +84,16 @@ elif [ "$1" = ape_loader_test_suite ]; then
|
|||
ape/apeuninstall.sh >/dev/null 2>&1
|
||||
|
||||
startit ape loader life.com
|
||||
o//tool/build/pledge.com -p 'stdio rpath prot_exec' o//examples/life.com
|
||||
o/fastbuild/tool/build/pledge.com -p 'stdio rpath prot_exec' o/fastbuild/examples/life.com
|
||||
[ $? = 42 ]
|
||||
checkem
|
||||
|
||||
startit ape loader hello.com
|
||||
[ "$(o//tool/build/pledge.com -p 'stdio rpath prot_exec' o//examples/hello.com)" = "hello world" ]
|
||||
[ "$(o/fastbuild/tool/build/pledge.com -p 'stdio rpath prot_exec' o/fastbuild/examples/hello.com)" = "hello world" ]
|
||||
checkem
|
||||
|
||||
startit ape loader curl.com
|
||||
[ "$(o//tool/build/pledge.com -p 'stdio inet dns rpath prot_exec' o//examples/curl.com https://justine.lol/hello.txt)" = "hello world" ]
|
||||
[ "$(o/fastbuild/tool/build/pledge.com -p 'stdio inet dns rpath prot_exec' o/fastbuild/examples/curl.com https://justine.lol/hello.txt)" = "hello world" ]
|
||||
checkem
|
||||
|
||||
ape/apeinstall.sh >/dev/null 2>&1
|
||||
|
|
@ -103,21 +103,21 @@ elif [ "$1" = ape_assimilated_test_suite ]; then
|
|||
mkdir -p $t/assimilated
|
||||
|
||||
startit ape assimilated life.com
|
||||
cp o//examples/life.com $t/assimilated
|
||||
o//tool/build/assimilate.com $t/assimilated/life.com
|
||||
cp o/fastbuild/examples/life.com $t/assimilated
|
||||
o/fastbuild/tool/build/assimilate.com $t/assimilated/life.com
|
||||
o/$m/tool/build/pledge.com -p 'stdio' $t/assimilated/life.com
|
||||
[ $? = 42 ]
|
||||
checkem
|
||||
|
||||
startit ape assimilated hello.com
|
||||
cp o//examples/hello.com $t/assimilated
|
||||
o//tool/build/assimilate.com $t/assimilated/hello.com
|
||||
cp o/fastbuild/examples/hello.com $t/assimilated
|
||||
o/fastbuild/tool/build/assimilate.com $t/assimilated/hello.com
|
||||
[ "$(o/$m/tool/build/pledge.com -p 'stdio' $t/assimilated/hello.com)" = "hello world" ]
|
||||
checkem
|
||||
|
||||
startit ape assimilated curl.com
|
||||
cp o//examples/curl.com $t/assimilated
|
||||
o//tool/build/assimilate.com $t/assimilated/curl.com
|
||||
cp o/fastbuild/examples/curl.com $t/assimilated
|
||||
o/fastbuild/tool/build/assimilate.com $t/assimilated/curl.com
|
||||
[ "$(o/$m/tool/build/pledge.com -p 'stdio rpath inet dns' $t/assimilated/curl.com https://justine.lol/hello.txt)" = "hello world" ]
|
||||
checkem
|
||||
|
||||
|
|
|
|||
Loading…
Reference in a new issue