1 // Copyright 2019 Google LLC 2 // 3 // Licensed under the Apache License, Version 2.0 (the "License"); 4 // you may not use this file except in compliance with the License. 5 // You may obtain a copy of the License at 6 // 7 // https://www.apache.org/licenses/LICENSE-2.0 8 // 9 // Unless required by applicable law or agreed to in writing, software 10 // distributed under the License is distributed on an "AS IS" BASIS, 11 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 12 // See the License for the specific language governing permissions and 13 // limitations under the License. 14 15 #ifndef SANDBOXED_API_SANDBOX2_EXECUTOR_H_ 16 #define SANDBOXED_API_SANDBOX2_EXECUTOR_H_ 17 18 #include <unistd.h> 19 20 #include <memory> 21 #include <string> 22 #include <utility> 23 #include <vector> 24 25 #include "absl/base/macros.h" 26 #include "absl/log/check.h" 27 #include "absl/log/log.h" 28 #include "absl/status/statusor.h" 29 #include "absl/strings/string_view.h" 30 #include "absl/types/span.h" 31 #include "sandboxed_api/sandbox2/fork_client.h" 32 #include "sandboxed_api/sandbox2/forkserver.pb.h" 33 #include "sandboxed_api/sandbox2/ipc.h" 34 #include "sandboxed_api/sandbox2/limits.h" 35 #include "sandboxed_api/sandbox2/namespace.h" 36 #include "sandboxed_api/util/fileops.h" 37 38 namespace sandbox2 { 39 40 // The sandbox2::Executor class is responsible for both creating and executing 41 // new processes which will be sandboxed. 42 class Executor final { 43 44 public: 45 Executor(const Executor&) = delete; 46 Executor& operator=(const Executor&) = delete; 47 48 // Initialized with a path to the process that the Executor class will 49 // execute 50 Executor( 51 absl::string_view path, absl::Span<const std::string> argv, 52 absl::Span<const std::string> envp = absl::MakeConstSpan(CopyEnviron())) path_(std::string (path))53 : path_(std::string(path)), 54 argv_(argv.begin(), argv.end()), 55 envp_(envp.begin(), envp.end()) { 56 CHECK(!path_.empty()); 57 SetUpServerSideCommsFd(); 58 } 59 60 // Executor will own this file-descriptor, so if intend to use it, pass here 61 // dup(fd) instead 62 Executor( 63 int exec_fd, absl::Span<const std::string> argv, 64 absl::Span<const std::string> envp = absl::MakeConstSpan(CopyEnviron())) exec_fd_(exec_fd)65 : exec_fd_(exec_fd), 66 argv_(argv.begin(), argv.end()), 67 envp_(envp.begin(), envp.end()) { 68 CHECK_GE(exec_fd, 0); 69 SetUpServerSideCommsFd(); 70 } 71 72 // Uses a custom ForkServer (which the supplied ForkClient can communicate 73 // with), which knows how to fork (or even execute) new sandboxed processes 74 // (hence, no need to supply path/argv/envp here) Executor(ForkClient * fork_client)75 explicit Executor(ForkClient* fork_client) 76 : enable_sandboxing_pre_execve_(false), fork_client_(fork_client) { 77 CHECK(fork_client != nullptr); 78 SetUpServerSideCommsFd(); 79 } 80 81 // Creates a new process which will act as a custom ForkServer. Should be used 82 // with custom fork servers only. 83 // This function returns immediately and returns a nullptr on failure. 84 std::unique_ptr<ForkClient> StartForkServer(); 85 86 // Accessors ipc()87 IPC* ipc() { return &ipc_; } 88 limits()89 Limits* limits() { return &limits_; } 90 set_enable_sandbox_before_exec(bool value)91 Executor& set_enable_sandbox_before_exec(bool value) { 92 enable_sandboxing_pre_execve_ = value; 93 return *this; 94 } 95 set_cwd(std::string value)96 Executor& set_cwd(std::string value) { 97 cwd_ = std::move(value); 98 return *this; 99 } 100 libunwind_recursion_depth()101 int libunwind_recursion_depth() { return libunwind_recursion_depth_; } 102 103 private: 104 friend class MonitorBase; 105 friend class PtraceMonitor; 106 friend class StackTracePeer; 107 108 // Internal constructor for executing libunwind on the given pid 109 // enable_sandboxing_pre_execve=false as we are not going to execve. Executor(pid_t libunwind_sbox_for_pid,int libunwind_recursion_depth)110 explicit Executor(pid_t libunwind_sbox_for_pid, int libunwind_recursion_depth) 111 : libunwind_sbox_for_pid_(libunwind_sbox_for_pid), 112 libunwind_recursion_depth_(libunwind_recursion_depth), 113 enable_sandboxing_pre_execve_(false) { 114 CHECK_GE(libunwind_sbox_for_pid_, 0); 115 SetUpServerSideCommsFd(); 116 } 117 118 // Creates a copy of the environment 119 static std::vector<std::string> CopyEnviron(); 120 121 // Creates a server-side Comms end-point using a pre-connected file 122 // descriptor. 123 void SetUpServerSideCommsFd(); 124 125 // Starts a new process which is connected with this Executor instance via a 126 // Comms channel. 127 // For clone_flags refer to Linux' 'man 2 clone'. 128 absl::StatusOr<SandboxeeProcess> StartSubProcess( 129 int clone_flags, const Namespace* ns = nullptr, 130 bool allow_speculation = false, 131 MonitorType type = FORKSERVER_MONITOR_PTRACE); 132 133 // Whether the Executor has been started yet 134 bool started_ = false; 135 136 // If this executor is running the libunwind sandbox for a process, 137 // this variable will hold the PID of the process. Otherwise it is zero. 138 pid_t libunwind_sbox_for_pid_ = 0; 139 int libunwind_recursion_depth_ = 0; 140 141 // Should the sandboxing be enabled before execve() occurs, or the binary will 142 // do it by itself, using the Client object's methods 143 bool enable_sandboxing_pre_execve_ = true; 144 145 // Alternate (path/fd)/argv/envp to be used the in the __NR_execve call. 146 sapi::file_util::fileops::FDCloser exec_fd_; 147 std::string path_; 148 std::vector<std::string> argv_; 149 std::vector<std::string> envp_; 150 151 // chdir to cwd_, if set. Defaults to current working directory. 152 std::string cwd_ = []() { 153 std::string cwd = sapi::file_util::fileops::GetCWD(); 154 if (cwd.empty()) { 155 PLOG(WARNING) << "Getting current working directory"; 156 } 157 return cwd; 158 }(); 159 160 // Client (sandboxee) end-point of a socket-pair used to create Comms channel 161 sapi::file_util::fileops::FDCloser client_comms_fd_; 162 163 // ForkClient connecting to the ForkServer - not owned by the object 164 ForkClient* fork_client_ = nullptr; 165 166 IPC ipc_; // Used for communication with the sandboxee 167 Limits limits_; // Defines server- and client-side limits 168 }; 169 170 } // namespace sandbox2 171 172 #endif // SANDBOXED_API_SANDBOX2_EXECUTOR_H_ 173