1 /*
2 * Copyright (C) 2017 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17 #include "seccomp_policy.h"
18
19 #include <assert.h>
20 #include <linux/audit.h>
21 #include <linux/seccomp.h>
22 #include <sys/prctl.h>
23 #include <sys/syscall.h>
24
25 #include <vector>
26
27 #include <android-base/logging.h>
28
29 #include "func_to_syscall_nrs.h"
30 #include "seccomp_bpfs.h"
31
32 #if defined __arm__ || defined __aarch64__
33
34 #define DUAL_ARCH
35 #define PRIMARY_ARCH AUDIT_ARCH_AARCH64
36 static const struct sock_filter* primary_app_filter = arm64_app_filter;
37 static const size_t primary_app_filter_size = arm64_app_filter_size;
38 static const struct sock_filter* primary_app_zygote_filter = arm64_app_zygote_filter;
39 static const size_t primary_app_zygote_filter_size = arm64_app_zygote_filter_size;
40 static const struct sock_filter* primary_system_filter = arm64_system_filter;
41 static const size_t primary_system_filter_size = arm64_system_filter_size;
42 static const struct sock_filter* primary_global_filter = arm64_global_filter;
43 static const size_t primary_global_filter_size = arm64_global_filter_size;
44
45 static const long primary_setresgid = __arm64_setresgid;
46 static const long primary_setresuid = __arm64_setresuid;
47 #define SECONDARY_ARCH AUDIT_ARCH_ARM
48 static const struct sock_filter* secondary_app_filter = arm_app_filter;
49 static const size_t secondary_app_filter_size = arm_app_filter_size;
50 static const struct sock_filter* secondary_app_zygote_filter = arm_app_zygote_filter;
51 static const size_t secondary_app_zygote_filter_size = arm_app_zygote_filter_size;
52 static const struct sock_filter* secondary_system_filter = arm_system_filter;
53 static const size_t secondary_system_filter_size = arm_system_filter_size;
54 static const struct sock_filter* secondary_global_filter = arm_global_filter;
55 static const size_t secondary_global_filter_size = arm_global_filter_size;
56
57 static const long secondary_setresgid = __arm_setresgid;
58 static const long secondary_setresuid = __arm_setresuid;
59 #elif defined __i386__ || defined __x86_64__
60
61 #define DUAL_ARCH
62 #define PRIMARY_ARCH AUDIT_ARCH_X86_64
63 static const struct sock_filter* primary_app_filter = x86_64_app_filter;
64 static const size_t primary_app_filter_size = x86_64_app_filter_size;
65 static const struct sock_filter* primary_app_zygote_filter = x86_64_app_zygote_filter;
66 static const size_t primary_app_zygote_filter_size = x86_64_app_zygote_filter_size;
67 static const struct sock_filter* primary_system_filter = x86_64_system_filter;
68 static const size_t primary_system_filter_size = x86_64_system_filter_size;
69 static const struct sock_filter* primary_global_filter = x86_64_global_filter;
70 static const size_t primary_global_filter_size = x86_64_global_filter_size;
71
72 static const long primary_setresgid = __x86_64_setresgid;
73 static const long primary_setresuid = __x86_64_setresuid;
74 #define SECONDARY_ARCH AUDIT_ARCH_I386
75 static const struct sock_filter* secondary_app_filter = x86_app_filter;
76 static const size_t secondary_app_filter_size = x86_app_filter_size;
77 static const struct sock_filter* secondary_app_zygote_filter = x86_app_zygote_filter;
78 static const size_t secondary_app_zygote_filter_size = x86_app_zygote_filter_size;
79 static const struct sock_filter* secondary_system_filter = x86_system_filter;
80 static const size_t secondary_system_filter_size = x86_system_filter_size;
81 static const struct sock_filter* secondary_global_filter = x86_global_filter;
82 static const size_t secondary_global_filter_size = x86_global_filter_size;
83
84 static const long secondary_setresgid = __x86_setresgid;
85 static const long secondary_setresuid = __x86_setresuid;
86 #elif defined __mips__ || defined __mips64__
87
88 #define DUAL_ARCH
89 #define PRIMARY_ARCH AUDIT_ARCH_MIPSEL64
90 static const struct sock_filter* primary_app_filter = mips64_app_filter;
91 static const size_t primary_app_filter_size = mips64_app_filter_size;
92 static const struct sock_filter* primary_app_zygote_filter = mips64_app_zygote_filter;
93 static const size_t primary_app_zygote_filter_size = mips64_app_zygote_filter_size;
94 static const struct sock_filter* primary_system_filter = mips64_system_filter;
95 static const size_t primary_system_filter_size = mips64_system_filter_size;
96 static const struct sock_filter* primary_global_filter = mips64_global_filter;
97 static const size_t primary_global_filter_size = mips64_global_filter_size;
98
99 static const long primary_setresgid = __mips64_setresgid;
100 static const long primary_setresuid = __mips64_setresuid;
101 #define SECONDARY_ARCH AUDIT_ARCH_MIPSEL
102 static const struct sock_filter* secondary_app_filter = mips_app_filter;
103 static const size_t secondary_app_filter_size = mips_app_filter_size;
104 static const struct sock_filter* secondary_app_zygote_filter = mips_app_zygote_filter;
105 static const size_t secondary_app_zygote_filter_size = mips_app_zygote_filter_size;
106 static const struct sock_filter* secondary_system_filter = mips_system_filter;
107 static const size_t secondary_system_filter_size = mips_system_filter_size;
108 static const struct sock_filter* secondary_global_filter = mips_global_filter;
109 static const size_t secondary_global_filter_size = mips_global_filter_size;
110
111 static const long secondary_setresgid = __mips_setresgid;
112 static const long secondary_setresuid = __mips_setresuid;
113 #else
114 #error No architecture was defined!
115 #endif
116
117
118 #define syscall_nr (offsetof(struct seccomp_data, nr))
119 #define syscall_arg(_n) (offsetof(struct seccomp_data, args[_n]))
120 #define arch_nr (offsetof(struct seccomp_data, arch))
121
122 typedef std::vector<sock_filter> filter;
123
Allow(filter & f)124 inline void Allow(filter& f) {
125 f.push_back(BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW));
126 }
127
Disallow(filter & f)128 inline void Disallow(filter& f) {
129 f.push_back(BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRAP));
130 }
131
ExamineSyscall(filter & f)132 static void ExamineSyscall(filter& f) {
133 f.push_back(BPF_STMT(BPF_LD|BPF_W|BPF_ABS, syscall_nr));
134 }
135
136 #ifdef DUAL_ARCH
SetValidateArchitectureJumpTarget(size_t offset,filter & f)137 static bool SetValidateArchitectureJumpTarget(size_t offset, filter& f) {
138 size_t jump_length = f.size() - offset - 1;
139 auto u8_jump_length = (__u8) jump_length;
140 if (u8_jump_length != jump_length) {
141 LOG(FATAL)
142 << "Can't set jump greater than 255 - actual jump is " << jump_length;
143 return false;
144 }
145 f[offset] = BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, SECONDARY_ARCH, u8_jump_length, 0);
146 return true;
147 }
148
ValidateArchitectureAndJumpIfNeeded(filter & f)149 static size_t ValidateArchitectureAndJumpIfNeeded(filter& f) {
150 f.push_back(BPF_STMT(BPF_LD|BPF_W|BPF_ABS, arch_nr));
151 f.push_back(BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, PRIMARY_ARCH, 2, 0));
152 f.push_back(BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, SECONDARY_ARCH, 1, 0));
153 Disallow(f);
154 return f.size() - 2;
155 }
156 #else
ValidateArchitecture(filter & f)157 static void ValidateArchitecture(filter& f) {
158 f.push_back(BPF_STMT(BPF_LD|BPF_W|BPF_ABS, arch_nr));
159 f.push_back(BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, PRIMARY_ARCH, 1, 0));
160 Disallow(f);
161 }
162 #endif
163
ValidateSyscallArgInRange(filter & f,__u32 arg_num,__u32 range_min,__u32 range_max)164 static void ValidateSyscallArgInRange(filter& f, __u32 arg_num, __u32 range_min, __u32 range_max) {
165 const __u32 syscall_arg = syscall_arg(arg_num);
166
167 if (range_max == UINT32_MAX) {
168 LOG(FATAL) << "range_max exceeds maximum argument range.";
169 return;
170 }
171
172 f.push_back(BPF_STMT(BPF_LD|BPF_W|BPF_ABS, syscall_arg));
173 f.push_back(BPF_JUMP(BPF_JMP|BPF_JGE|BPF_K, range_min, 0, 1));
174 f.push_back(BPF_JUMP(BPF_JMP|BPF_JGE|BPF_K, range_max + 1, 0, 1));
175 Disallow(f);
176 }
177
178 // This filter is meant to be installed in addition to a regular whitelist filter.
179 // Therefore, it's default action has to be Allow, except when the evaluated
180 // system call matches setresuid/setresgid and the arguments don't fall within the
181 // passed in range.
182 //
183 // The regular whitelist only allows setresuid/setresgid for UID/GID changes, so
184 // that's the only system call we need to check here. A CTS test ensures the other
185 // calls will remain blocked.
ValidateSetUidGid(filter & f,uint32_t uid_gid_min,uint32_t uid_gid_max,bool primary)186 static void ValidateSetUidGid(filter& f, uint32_t uid_gid_min, uint32_t uid_gid_max, bool primary) {
187 // Check setresuid(ruid, euid, sguid) fall within range
188 ExamineSyscall(f);
189 __u32 setresuid_nr = primary ? primary_setresuid : secondary_setresuid;
190 f.push_back(BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, setresuid_nr, 0, 12));
191 for (int arg = 0; arg < 3; arg++) {
192 ValidateSyscallArgInRange(f, arg, uid_gid_min, uid_gid_max);
193 }
194
195 // Check setresgid(rgid, egid, sgid) fall within range
196 ExamineSyscall(f);
197 __u32 setresgid_nr = primary ? primary_setresgid : secondary_setresgid;
198 f.push_back(BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, setresgid_nr, 0, 12));
199 for (int arg = 0; arg < 3; arg++) {
200 ValidateSyscallArgInRange(f, arg, uid_gid_min, uid_gid_max);
201 }
202
203 // Default is to allow; other filters may still reject this call.
204 Allow(f);
205 }
206
install_filter(filter const & f)207 static bool install_filter(filter const& f) {
208 struct sock_fprog prog = {
209 static_cast<unsigned short>(f.size()),
210 const_cast<struct sock_filter*>(&f[0]),
211 };
212 // This assumes either the current process has CAP_SYS_ADMIN, or PR_SET_NO_NEW_PRIVS bit is set.
213 if (prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog) < 0) {
214 PLOG(FATAL) << "Could not set seccomp filter of size " << f.size();
215 return false;
216 }
217 return true;
218 }
219
_install_setuidgid_filter(uint32_t uid_gid_min,uint32_t uid_gid_max)220 bool _install_setuidgid_filter(uint32_t uid_gid_min, uint32_t uid_gid_max) {
221 filter f;
222 #ifdef DUAL_ARCH
223 // Note that for mixed 64/32 bit architectures, ValidateArchitecture inserts a
224 // jump that must be changed to point to the start of the 32-bit policy
225 // 32 bit syscalls will not hit the policy between here and the call to SetJump
226 auto offset_to_secondary_filter = ValidateArchitectureAndJumpIfNeeded(f);
227 #else
228 ValidateArchitecture(f);
229 #endif
230
231 ValidateSetUidGid(f, uid_gid_min, uid_gid_max, true /* primary */);
232
233 #ifdef DUAL_ARCH
234 if (!SetValidateArchitectureJumpTarget(offset_to_secondary_filter, f)) {
235 return false;
236 }
237
238 ValidateSetUidGid(f, uid_gid_min, uid_gid_max, false /* primary */);
239 #endif
240
241 return install_filter(f);
242 }
243
244 enum FilterType {
245 APP,
246 APP_ZYGOTE,
247 SYSTEM,
248 GLOBAL
249 };
250
_set_seccomp_filter(FilterType type)251 bool _set_seccomp_filter(FilterType type) {
252 const sock_filter *p, *s;
253 size_t p_size, s_size;
254 filter f;
255
256 switch (type) {
257 case APP:
258 p = primary_app_filter;
259 p_size = primary_app_filter_size;
260 s = secondary_app_filter;
261 s_size = secondary_app_filter_size;
262 break;
263 case APP_ZYGOTE:
264 p = primary_app_zygote_filter;
265 p_size = primary_app_zygote_filter_size;
266 s = secondary_app_zygote_filter;
267 s_size = secondary_app_zygote_filter_size;
268 break;
269 case SYSTEM:
270 p = primary_system_filter;
271 p_size = primary_system_filter_size;
272 s = secondary_system_filter;
273 s_size = secondary_system_filter_size;
274 break;
275 case GLOBAL:
276 p = primary_global_filter;
277 p_size = primary_global_filter_size;
278 s = secondary_global_filter;
279 s_size = secondary_global_filter_size;
280 break;
281
282 }
283
284 #ifdef DUAL_ARCH
285 // Note that for mixed 64/32 bit architectures, ValidateArchitecture inserts a
286 // jump that must be changed to point to the start of the 32-bit policy
287 // 32 bit syscalls will not hit the policy between here and the call to SetJump
288 auto offset_to_secondary_filter = ValidateArchitectureAndJumpIfNeeded(f);
289 #else
290 ValidateArchitecture(f);
291 #endif
292
293 ExamineSyscall(f);
294
295 for (size_t i = 0; i < p_size; ++i) {
296 f.push_back(p[i]);
297 }
298 Disallow(f);
299
300 #ifdef DUAL_ARCH
301 if (!SetValidateArchitectureJumpTarget(offset_to_secondary_filter, f)) {
302 return false;
303 }
304
305 ExamineSyscall(f);
306
307 for (size_t i = 0; i < s_size; ++i) {
308 f.push_back(s[i]);
309 }
310 Disallow(f);
311 #endif
312
313 return install_filter(f);
314 }
315
set_app_seccomp_filter()316 bool set_app_seccomp_filter() {
317 return _set_seccomp_filter(FilterType::APP);
318 }
319
set_app_zygote_seccomp_filter()320 bool set_app_zygote_seccomp_filter() {
321 return _set_seccomp_filter(FilterType::APP_ZYGOTE);
322 }
323
set_system_seccomp_filter()324 bool set_system_seccomp_filter() {
325 return _set_seccomp_filter(FilterType::SYSTEM);
326 }
327
set_global_seccomp_filter()328 bool set_global_seccomp_filter() {
329 return _set_seccomp_filter(FilterType::GLOBAL);
330 }
331
install_setuidgid_seccomp_filter(uint32_t uid_gid_min,uint32_t uid_gid_max)332 bool install_setuidgid_seccomp_filter(uint32_t uid_gid_min, uint32_t uid_gid_max) {
333 return _install_setuidgid_filter(uid_gid_min, uid_gid_max);
334 }
335