1 /*
2 * Copyright (C) 2017 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17 #include "seccomp_policy.h"
18
19 #include <assert.h>
20 #include <linux/audit.h>
21 #include <linux/seccomp.h>
22 #include <sys/prctl.h>
23 #include <sys/syscall.h>
24
25 #include <vector>
26
27 #include <android-base/logging.h>
28 #include <android-base/macros.h>
29
30 #include "func_to_syscall_nrs.h"
31 #include "seccomp_bpfs.h"
32
33 #if defined __arm__ || defined __aarch64__
34
35 #define PRIMARY_ARCH AUDIT_ARCH_AARCH64
36 static const struct sock_filter* primary_app_filter = arm64_app_filter;
37 static const size_t primary_app_filter_size = arm64_app_filter_size;
38 static const struct sock_filter* primary_app_zygote_filter = arm64_app_zygote_filter;
39 static const size_t primary_app_zygote_filter_size = arm64_app_zygote_filter_size;
40 static const struct sock_filter* primary_system_filter = arm64_system_filter;
41 static const size_t primary_system_filter_size = arm64_system_filter_size;
42
43 static const long primary_setresgid = __arm64_setresgid;
44 static const long primary_setresuid = __arm64_setresuid;
45 #define SECONDARY_ARCH AUDIT_ARCH_ARM
46 static const struct sock_filter* secondary_app_filter = arm_app_filter;
47 static const size_t secondary_app_filter_size = arm_app_filter_size;
48 static const struct sock_filter* secondary_app_zygote_filter = arm_app_zygote_filter;
49 static const size_t secondary_app_zygote_filter_size = arm_app_zygote_filter_size;
50 static const struct sock_filter* secondary_system_filter = arm_system_filter;
51 static const size_t secondary_system_filter_size = arm_system_filter_size;
52
53 static const long secondary_setresgid = __arm_setresgid;
54 static const long secondary_setresuid = __arm_setresuid;
55
56 #elif defined __i386__ || defined __x86_64__
57
58 #define PRIMARY_ARCH AUDIT_ARCH_X86_64
59 static const struct sock_filter* primary_app_filter = x86_64_app_filter;
60 static const size_t primary_app_filter_size = x86_64_app_filter_size;
61 static const struct sock_filter* primary_app_zygote_filter = x86_64_app_zygote_filter;
62 static const size_t primary_app_zygote_filter_size = x86_64_app_zygote_filter_size;
63 static const struct sock_filter* primary_system_filter = x86_64_system_filter;
64 static const size_t primary_system_filter_size = x86_64_system_filter_size;
65
66 static const long primary_setresgid = __x86_64_setresgid;
67 static const long primary_setresuid = __x86_64_setresuid;
68 #define SECONDARY_ARCH AUDIT_ARCH_I386
69 static const struct sock_filter* secondary_app_filter = x86_app_filter;
70 static const size_t secondary_app_filter_size = x86_app_filter_size;
71 static const struct sock_filter* secondary_app_zygote_filter = x86_app_zygote_filter;
72 static const size_t secondary_app_zygote_filter_size = x86_app_zygote_filter_size;
73 static const struct sock_filter* secondary_system_filter = x86_system_filter;
74 static const size_t secondary_system_filter_size = x86_system_filter_size;
75
76 static const long secondary_setresgid = __x86_setresgid;
77 static const long secondary_setresuid = __x86_setresuid;
78
79 #elif defined(__riscv)
80
81 #define PRIMARY_ARCH AUDIT_ARCH_RISCV64
82 static const struct sock_filter* primary_app_filter = riscv64_app_filter;
83 static const size_t primary_app_filter_size = riscv64_app_filter_size;
84 static const struct sock_filter* primary_app_zygote_filter = riscv64_app_zygote_filter;
85 static const size_t primary_app_zygote_filter_size = riscv64_app_zygote_filter_size;
86 static const struct sock_filter* primary_system_filter = riscv64_system_filter;
87 static const size_t primary_system_filter_size = riscv64_system_filter_size;
88
89 static const long primary_setresgid = __riscv64_setresgid;
90 static const long primary_setresuid = __riscv64_setresuid;
91
92 #else
93 #error No architecture was defined!
94 #endif
95
96
97 #define syscall_nr (offsetof(struct seccomp_data, nr))
98 #define syscall_arg(_n) (offsetof(struct seccomp_data, args[_n]))
99 #define arch_nr (offsetof(struct seccomp_data, arch))
100
101 typedef std::vector<sock_filter> filter;
102
Allow(filter & f)103 inline void Allow(filter& f) {
104 f.push_back(BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW));
105 }
106
Disallow(filter & f)107 inline void Disallow(filter& f) {
108 f.push_back(BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRAP));
109 }
110
ExamineSyscall(filter & f)111 static void ExamineSyscall(filter& f) {
112 f.push_back(BPF_STMT(BPF_LD|BPF_W|BPF_ABS, syscall_nr));
113 }
114
115 #if defined(SECONDARY_ARCH)
SetValidateArchitectureJumpTarget(size_t offset,filter & f)116 static bool SetValidateArchitectureJumpTarget(size_t offset, filter& f) {
117 size_t jump_length = f.size() - offset - 1;
118 auto u8_jump_length = (__u8) jump_length;
119 if (u8_jump_length != jump_length) {
120 LOG(FATAL)
121 << "Can't set jump greater than 255 - actual jump is " << jump_length;
122 return false;
123 }
124 f[offset] = BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, SECONDARY_ARCH, u8_jump_length, 0);
125 return true;
126 }
127
ValidateArchitectureAndJumpIfNeeded(filter & f)128 static size_t ValidateArchitectureAndJumpIfNeeded(filter& f) {
129 f.push_back(BPF_STMT(BPF_LD|BPF_W|BPF_ABS, arch_nr));
130 f.push_back(BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, PRIMARY_ARCH, 2, 0));
131 f.push_back(BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, SECONDARY_ARCH, 1, 0));
132 Disallow(f);
133 return f.size() - 2;
134 }
135 #else
ValidateArchitecture(filter & f)136 static void ValidateArchitecture(filter& f) {
137 f.push_back(BPF_STMT(BPF_LD|BPF_W|BPF_ABS, arch_nr));
138 f.push_back(BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, PRIMARY_ARCH, 1, 0));
139 Disallow(f);
140 }
141 #endif
142
ValidateSyscallArgInRange(filter & f,__u32 arg_num,__u32 range_min,__u32 range_max)143 static void ValidateSyscallArgInRange(filter& f, __u32 arg_num, __u32 range_min, __u32 range_max) {
144 const __u32 syscall_arg = syscall_arg(arg_num);
145
146 if (range_max == UINT32_MAX) {
147 LOG(FATAL) << "range_max exceeds maximum argument range.";
148 return;
149 }
150
151 f.push_back(BPF_STMT(BPF_LD|BPF_W|BPF_ABS, syscall_arg));
152 f.push_back(BPF_JUMP(BPF_JMP|BPF_JGE|BPF_K, range_min, 0, 1));
153 f.push_back(BPF_JUMP(BPF_JMP|BPF_JGE|BPF_K, range_max + 1, 0, 1));
154 Disallow(f);
155 }
156
157 // This filter is meant to be installed in addition to a regular allowlist filter.
158 // Therefore, it's default action has to be Allow, except when the evaluated
159 // system call matches setresuid/setresgid and the arguments don't fall within the
160 // passed in range.
161 //
162 // The regular allowlist only allows setresuid/setresgid for UID/GID changes, so
163 // that's the only system call we need to check here. A CTS test ensures the other
164 // calls will remain blocked.
ValidateSetUidGid(filter & f,uint32_t uid_gid_min,uint32_t uid_gid_max,bool primary)165 static void ValidateSetUidGid(filter& f, uint32_t uid_gid_min, uint32_t uid_gid_max, bool primary) {
166 #if defined(SECONDARY_ARCH)
167 __u32 setresuid_nr = primary ? primary_setresuid : secondary_setresuid;
168 __u32 setresgid_nr = primary ? primary_setresgid : secondary_setresgid;
169 #else
170 __u32 setresuid_nr = primary_setresuid;
171 __u32 setresgid_nr = primary_setresgid;
172 UNUSED(primary);
173 #endif
174
175 // Check setresuid(ruid, euid, sguid) fall within range
176 ExamineSyscall(f);
177 f.push_back(BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, setresuid_nr, 0, 12));
178 for (int arg = 0; arg < 3; arg++) {
179 ValidateSyscallArgInRange(f, arg, uid_gid_min, uid_gid_max);
180 }
181
182 // Check setresgid(rgid, egid, sgid) fall within range
183 ExamineSyscall(f);
184 f.push_back(BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, setresgid_nr, 0, 12));
185 for (int arg = 0; arg < 3; arg++) {
186 ValidateSyscallArgInRange(f, arg, uid_gid_min, uid_gid_max);
187 }
188
189 // Default is to allow; other filters may still reject this call.
190 Allow(f);
191 }
192
install_filter(filter const & f)193 static bool install_filter(filter const& f) {
194 struct sock_fprog prog = {
195 static_cast<unsigned short>(f.size()),
196 const_cast<struct sock_filter*>(&f[0]),
197 };
198 // This assumes either the current process has CAP_SYS_ADMIN, or PR_SET_NO_NEW_PRIVS bit is set.
199 if (prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog) < 0) {
200 PLOG(FATAL) << "Could not set seccomp filter of size " << f.size();
201 return false;
202 }
203 return true;
204 }
205
_install_setuidgid_filter(uint32_t uid_gid_min,uint32_t uid_gid_max)206 bool _install_setuidgid_filter(uint32_t uid_gid_min, uint32_t uid_gid_max) {
207 filter f;
208 #if defined(SECONDARY_ARCH)
209 // Note that for mixed 64/32 bit architectures, ValidateArchitecture inserts a
210 // jump that must be changed to point to the start of the 32-bit policy
211 // 32 bit syscalls will not hit the policy between here and the call to SetJump
212 auto offset_to_secondary_filter = ValidateArchitectureAndJumpIfNeeded(f);
213 #else
214 ValidateArchitecture(f);
215 #endif
216
217 ValidateSetUidGid(f, uid_gid_min, uid_gid_max, true /* primary */);
218
219 #if defined(SECONDARY_ARCH)
220 if (!SetValidateArchitectureJumpTarget(offset_to_secondary_filter, f)) {
221 return false;
222 }
223
224 ValidateSetUidGid(f, uid_gid_min, uid_gid_max, false /* primary */);
225 #endif
226
227 return install_filter(f);
228 }
229
230 enum FilterType {
231 APP,
232 APP_ZYGOTE,
233 SYSTEM,
234 };
235
_set_seccomp_filter(FilterType type)236 bool _set_seccomp_filter(FilterType type) {
237 filter f;
238
239 const sock_filter* p;
240 size_t p_size;
241 #if defined(SECONDARY_ARCH)
242 const sock_filter* s;
243 size_t s_size;
244 #endif
245
246 switch (type) {
247 case APP:
248 p = primary_app_filter;
249 p_size = primary_app_filter_size;
250 #if defined(SECONDARY_ARCH)
251 s = secondary_app_filter;
252 s_size = secondary_app_filter_size;
253 #endif
254 break;
255 case APP_ZYGOTE:
256 p = primary_app_zygote_filter;
257 p_size = primary_app_zygote_filter_size;
258 #if defined(SECONDARY_ARCH)
259 s = secondary_app_zygote_filter;
260 s_size = secondary_app_zygote_filter_size;
261 #endif
262 break;
263 case SYSTEM:
264 p = primary_system_filter;
265 p_size = primary_system_filter_size;
266 #if defined(SECONDARY_ARCH)
267 s = secondary_system_filter;
268 s_size = secondary_system_filter_size;
269 #endif
270 break;
271 }
272
273 #if defined(SECONDARY_ARCH)
274 // Note that for mixed 64/32 bit architectures, ValidateArchitecture inserts a
275 // jump that must be changed to point to the start of the 32-bit policy
276 // 32 bit syscalls will not hit the policy between here and the call to SetJump
277 auto offset_to_secondary_filter = ValidateArchitectureAndJumpIfNeeded(f);
278 #else
279 ValidateArchitecture(f);
280 #endif
281
282 ExamineSyscall(f);
283
284 for (size_t i = 0; i < p_size; ++i) {
285 f.push_back(p[i]);
286 }
287 Disallow(f);
288
289 #if defined(SECONDARY_ARCH)
290 if (!SetValidateArchitectureJumpTarget(offset_to_secondary_filter, f)) {
291 return false;
292 }
293
294 ExamineSyscall(f);
295
296 for (size_t i = 0; i < s_size; ++i) {
297 f.push_back(s[i]);
298 }
299 Disallow(f);
300 #endif
301
302 return install_filter(f);
303 }
304
set_app_seccomp_filter()305 bool set_app_seccomp_filter() {
306 return _set_seccomp_filter(FilterType::APP);
307 }
308
set_app_zygote_seccomp_filter()309 bool set_app_zygote_seccomp_filter() {
310 return _set_seccomp_filter(FilterType::APP_ZYGOTE);
311 }
312
set_system_seccomp_filter()313 bool set_system_seccomp_filter() {
314 return _set_seccomp_filter(FilterType::SYSTEM);
315 }
316
install_setuidgid_seccomp_filter(uint32_t uid_gid_min,uint32_t uid_gid_max)317 bool install_setuidgid_seccomp_filter(uint32_t uid_gid_min, uint32_t uid_gid_max) {
318 return _install_setuidgid_filter(uid_gid_min, uid_gid_max);
319 }
320