1 // Copyright 2019 Google LLC
2 //
3 // Licensed under the Apache License, Version 2.0 (the "License");
4 // you may not use this file except in compliance with the License.
5 // You may obtain a copy of the License at
6 //
7 // https://www.apache.org/licenses/LICENSE-2.0
8 //
9 // Unless required by applicable law or agreed to in writing, software
10 // distributed under the License is distributed on an "AS IS" BASIS,
11 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 // See the License for the specific language governing permissions and
13 // limitations under the License.
14
15 // The sandbox2::Notify class handless exceptional situations in the sandbox
16
17 #ifndef SANDBOXED_API_SANDBOX2_NOTIFY_H_
18 #define SANDBOXED_API_SANDBOX2_NOTIFY_H_
19
20 #include <sys/types.h>
21
22 #include <cstdint>
23
24 #include "absl/base/attributes.h"
25 #include "absl/log/log.h"
26 #include "absl/strings/str_format.h"
27 #include "sandboxed_api/sandbox2/comms.h"
28 #include "sandboxed_api/sandbox2/result.h"
29 #include "sandboxed_api/sandbox2/syscall.h"
30 #include "sandboxed_api/sandbox2/util.h"
31
32 namespace sandbox2 {
33
34 enum class ViolationType : int {
35 // A syscall disallowed by the policy was invoked.
36 kSyscall,
37 // A syscall with cpu architecture not covered by the policy was invoked.
38 kArchitectureSwitch,
39 };
40
41 template <typename Sink>
AbslStringify(Sink & sink,ViolationType e)42 void AbslStringify(Sink& sink, ViolationType e) {
43 absl::Format(
44 &sink, "%s",
45 e == ViolationType::kSyscall ? "kSyscall" : "kArchitectureSwitch");
46 }
47
48 class Notify {
49 public:
50 virtual ~Notify() = default;
51
52 // Called when a process has been created and executed, but not yet sandboxed.
53 // Using comms only makes sense if the client is sandboxed in the
54 // Executor::set_enable_sandbox_before_exec(false) mode.
55 // Returns a success indicator: false will cause the Sandbox Monitor to return
56 // sandbox2::Result::SETUP_ERROR for Run()/RunAsync().
EventStarted(pid_t pid,Comms * comms)57 virtual bool EventStarted(pid_t pid, Comms* comms) { return true; }
58
59 // Called when all sandboxed processes finished.
EventFinished(const Result & result)60 virtual void EventFinished(const Result& result) {}
61
62 // Called when a process exited with a syscall violation.
EventSyscallViolation(const Syscall & syscall,ViolationType type)63 virtual void EventSyscallViolation(const Syscall& syscall,
64 ViolationType type) {}
65
66 // Called when a policy called TRACE. The syscall is allowed and logged if
67 // this method returns true. This allows for implementing 'log, but allow'
68 // policies.
69 ABSL_DEPRECATED("Override EventSyscallTrace() instead")
EventSyscallTrap(const Syscall & syscall)70 virtual bool EventSyscallTrap(const Syscall& syscall) { return false; }
71
72 // Actions to perform after calling EventSyscallTrace.
73 enum class TraceAction {
74 // Deny the syscall.
75 kDeny,
76 // Allow the syscall.
77 kAllow,
78 // Allow the syscall so its return value can be inspected through a
79 // subsequent call to EventSyscallReturn.
80 // Requires Linux kernel 4.8 or later.
81 kInspectAfterReturn
82 };
83
84 // Called when a policy called TRACE. The syscall is allowed or denied
85 // depending on the return value of this function.
EventSyscallTrace(const Syscall & syscall)86 virtual TraceAction EventSyscallTrace(const Syscall& syscall) {
87 if (EventSyscallTrap(syscall)) {
88 LOG(WARNING) << "[PERMITTED]: SYSCALL ::: PID: " << syscall.pid()
89 << ", PROG: '" << util::GetProgName(syscall.pid())
90 << "' : " << syscall.GetDescription();
91 return TraceAction::kAllow;
92 }
93 return TraceAction::kDeny;
94 }
95
96 // Called when a policy called TRACE and EventSyscallTrace returned
97 // kInspectAfterReturn.
EventSyscallReturn(const Syscall & syscall,int64_t return_value)98 virtual void EventSyscallReturn(const Syscall& syscall,
99 int64_t return_value) {}
100
101 // Called when a process received a signal.
EventSignal(pid_t pid,int sig_no)102 virtual void EventSignal(pid_t pid, int sig_no) {}
103 };
104
105 } // namespace sandbox2
106
107 #endif // SANDBOXED_API_SANDBOX2_NOTIFY_H_
108