2020-01-17 21:05:03 +08:00
|
|
|
// Copyright 2019 Google LLC
|
2019-03-19 00:21:48 +08:00
|
|
|
//
|
|
|
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
|
|
|
// you may not use this file except in compliance with the License.
|
|
|
|
// You may obtain a copy of the License at
|
|
|
|
//
|
2022-01-28 17:38:27 +08:00
|
|
|
// https://www.apache.org/licenses/LICENSE-2.0
|
2019-03-19 00:21:48 +08:00
|
|
|
//
|
|
|
|
// Unless required by applicable law or agreed to in writing, software
|
|
|
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
|
|
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
|
|
// See the License for the specific language governing permissions and
|
|
|
|
// limitations under the License.
|
|
|
|
|
|
|
|
// A demo sandbox for the static_bin binary.
|
|
|
|
// Use: static_sandbox --logtostderr
|
|
|
|
|
|
|
|
#include <fcntl.h>
|
2021-10-04 22:17:36 +08:00
|
|
|
#include <sys/mman.h>
|
2019-03-19 00:21:48 +08:00
|
|
|
#include <sys/resource.h>
|
|
|
|
#include <syscall.h>
|
|
|
|
#include <unistd.h>
|
|
|
|
|
|
|
|
#include <csignal>
|
|
|
|
#include <cstdlib>
|
|
|
|
#include <memory>
|
|
|
|
#include <string>
|
|
|
|
#include <utility>
|
|
|
|
#include <vector>
|
|
|
|
|
2022-10-20 21:48:06 +08:00
|
|
|
#include "absl/flags/flag.h"
|
|
|
|
#include "absl/flags/parse.h"
|
|
|
|
#include "absl/log/globals.h"
|
|
|
|
#include "absl/log/initialize.h"
|
|
|
|
#include "absl/log/log.h"
|
2021-02-01 23:10:43 +08:00
|
|
|
#include "sandboxed_api/config.h"
|
2019-03-19 00:21:48 +08:00
|
|
|
#include "sandboxed_api/sandbox2/executor.h"
|
|
|
|
#include "sandboxed_api/sandbox2/limits.h"
|
|
|
|
#include "sandboxed_api/sandbox2/policy.h"
|
|
|
|
#include "sandboxed_api/sandbox2/policybuilder.h"
|
|
|
|
#include "sandboxed_api/sandbox2/result.h"
|
|
|
|
#include "sandboxed_api/sandbox2/sandbox2.h"
|
|
|
|
#include "sandboxed_api/sandbox2/util/bpf_helper.h"
|
2021-01-14 01:25:25 +08:00
|
|
|
#include "sandboxed_api/util/runfiles.h"
|
2019-03-19 00:21:48 +08:00
|
|
|
|
|
|
|
std::unique_ptr<sandbox2::Policy> GetPolicy() {
|
|
|
|
return sandbox2::PolicyBuilder()
|
|
|
|
// The most frequent syscall should go first in this sequence (to make it
|
|
|
|
// fast).
|
|
|
|
// Allow read() with all arguments.
|
|
|
|
.AllowRead()
|
|
|
|
// Allow a preset of syscalls that are known to be used during startup
|
|
|
|
// of static binaries.
|
|
|
|
.AllowStaticStartup()
|
|
|
|
// Allow the getpid() syscall.
|
|
|
|
.AllowSyscall(__NR_getpid)
|
|
|
|
|
|
|
|
// Examples for AddPolicyOnSyscall:
|
|
|
|
.AddPolicyOnSyscall(__NR_write,
|
|
|
|
{
|
|
|
|
// Load the first argument of write() (= fd)
|
|
|
|
ARG_32(0),
|
|
|
|
// Allow write(fd=STDOUT)
|
|
|
|
JEQ32(1, ALLOW),
|
|
|
|
// Allow write(fd=STDERR)
|
|
|
|
JEQ32(2, ALLOW),
|
|
|
|
// Fall-through for every other case.
|
|
|
|
// The default action will be KILL if it is not
|
|
|
|
// explicitly ALLOWed by a following rule.
|
|
|
|
})
|
|
|
|
// write() calls with fd not in (1, 2) will continue evaluating the
|
|
|
|
// policy. This means that other rules might still allow them.
|
|
|
|
|
2022-03-23 21:59:08 +08:00
|
|
|
// Allow the Sandboxee to set the name for better recognition in the
|
|
|
|
// process listing.
|
|
|
|
.AllowPrctlSetName()
|
|
|
|
|
2021-10-04 22:17:36 +08:00
|
|
|
// Allow the dynamic loader to mark pages to never allow read-write-exec.
|
|
|
|
.AddPolicyOnSyscall(__NR_mprotect,
|
|
|
|
{
|
|
|
|
ARG_32(2),
|
|
|
|
JEQ32(PROT_READ, ALLOW),
|
|
|
|
JEQ32(PROT_NONE, ALLOW),
|
|
|
|
JEQ32(PROT_READ | PROT_WRITE, ALLOW),
|
|
|
|
JEQ32(PROT_READ | PROT_EXEC, ALLOW),
|
|
|
|
})
|
|
|
|
|
2019-03-19 00:21:48 +08:00
|
|
|
// Allow exit() only with an exit_code of 0.
|
|
|
|
// Explicitly jumping to KILL, thus the following rules can not
|
|
|
|
// override this rule.
|
|
|
|
.AddPolicyOnSyscall(
|
|
|
|
__NR_exit_group,
|
2021-12-08 22:40:48 +08:00
|
|
|
{
|
|
|
|
// Load first argument (exit_code).
|
|
|
|
ARG_32(0),
|
|
|
|
// Deny every argument except 0.
|
|
|
|
JNE32(0, KILL),
|
|
|
|
// Allow all exit() calls that were not previously forbidden
|
|
|
|
// = exit_code == 0.
|
|
|
|
ALLOW,
|
|
|
|
})
|
2019-03-19 00:21:48 +08:00
|
|
|
|
|
|
|
// = This won't have any effect as we handled every case of this syscall
|
|
|
|
// in the previous rule.
|
|
|
|
.AllowSyscall(__NR_exit_group)
|
|
|
|
|
2021-12-08 22:40:48 +08:00
|
|
|
.BlockSyscallsWithErrno(
|
|
|
|
{
|
|
|
|
#ifdef __NR_access
|
|
|
|
// On Debian, even static binaries check existence of
|
|
|
|
// /etc/ld.so.nohwcap.
|
|
|
|
__NR_access,
|
|
|
|
#endif
|
2023-01-04 17:43:41 +08:00
|
|
|
__NR_faccessat,
|
2021-12-08 22:40:48 +08:00
|
|
|
|
2019-03-19 00:21:48 +08:00
|
|
|
#ifdef __NR_open
|
2021-12-08 22:40:48 +08:00
|
|
|
__NR_open,
|
2019-03-19 00:21:48 +08:00
|
|
|
#endif
|
2021-12-08 22:40:48 +08:00
|
|
|
__NR_openat,
|
|
|
|
},
|
|
|
|
ENOENT)
|
2019-03-19 00:21:48 +08:00
|
|
|
.BuildOrDie();
|
|
|
|
}
|
|
|
|
|
2022-04-27 15:43:17 +08:00
|
|
|
int main(int argc, char* argv[]) {
|
2019-09-13 16:22:14 +08:00
|
|
|
// This test is incompatible with sanitizers.
|
|
|
|
// The `SKIP_SANITIZERS_AND_COVERAGE` macro won't work for us here since we
|
|
|
|
// need to return something.
|
2021-02-01 23:10:43 +08:00
|
|
|
if constexpr (sapi::sanitizers::IsAny()) {
|
|
|
|
return EXIT_SUCCESS;
|
|
|
|
}
|
2022-10-20 21:48:06 +08:00
|
|
|
absl::SetStderrThreshold(absl::LogSeverityAtLeast::kInfo);
|
|
|
|
absl::ParseCommandLine(argc, argv);
|
|
|
|
absl::InitializeLog();
|
2019-03-19 00:21:48 +08:00
|
|
|
|
2021-01-14 21:10:54 +08:00
|
|
|
// Note: In your own code, use sapi::GetDataDependencyFilePath() instead.
|
|
|
|
const std::string path = sapi::internal::GetSapiDataDependencyFilePath(
|
2019-03-19 00:21:48 +08:00
|
|
|
"sandbox2/examples/static/static_bin");
|
|
|
|
std::vector<std::string> args = {path};
|
2022-10-12 20:22:51 +08:00
|
|
|
auto executor = std::make_unique<sandbox2::Executor>(path, args);
|
2019-03-19 00:21:48 +08:00
|
|
|
|
|
|
|
executor
|
|
|
|
// Sandboxing is enabled by the sandbox itself. The sandboxed binary is
|
|
|
|
// not aware that it'll be sandboxed.
|
|
|
|
// Note: 'true' is the default setting for this class.
|
|
|
|
->set_enable_sandbox_before_exec(true)
|
|
|
|
.limits()
|
|
|
|
// Kill sandboxed processes with a signal (SIGXFSZ) if it writes more than
|
|
|
|
// these many bytes to the file-system.
|
2023-03-03 17:13:44 +08:00
|
|
|
->set_rlimit_fsize(1024 * 1024)
|
2019-03-19 00:21:48 +08:00
|
|
|
// The CPU time limit.
|
|
|
|
.set_rlimit_cpu(60)
|
|
|
|
.set_walltime_limit(absl::Seconds(30));
|
|
|
|
|
|
|
|
int proc_version_fd = open("/proc/version", O_RDONLY);
|
|
|
|
PCHECK(proc_version_fd != -1);
|
|
|
|
|
|
|
|
// Map this fils to sandboxee's stdin.
|
|
|
|
executor->ipc()->MapFd(proc_version_fd, STDIN_FILENO);
|
|
|
|
|
|
|
|
auto policy = GetPolicy();
|
|
|
|
sandbox2::Sandbox2 s2(std::move(executor), std::move(policy));
|
|
|
|
|
|
|
|
// Let the sandboxee run (synchronously).
|
2021-09-28 20:50:19 +08:00
|
|
|
sandbox2::Result result = s2.Run();
|
2019-03-19 00:21:48 +08:00
|
|
|
|
|
|
|
LOG(INFO) << "Final execution status: " << result.ToString();
|
|
|
|
|
2019-09-13 16:22:14 +08:00
|
|
|
return result.final_status() == sandbox2::Result::OK ? EXIT_SUCCESS
|
|
|
|
: EXIT_FAILURE;
|
2019-03-19 00:21:48 +08:00
|
|
|
}
|