1 // Copyright 2019 Google LLC
2 //
3 // Licensed under the Apache License, Version 2.0 (the "License");
4 // you may not use this file except in compliance with the License.
5 // You may obtain a copy of the License at
6 //
7 // https://www.apache.org/licenses/LICENSE-2.0
8 //
9 // Unless required by applicable law or agreed to in writing, software
10 // distributed under the License is distributed on an "AS IS" BASIS,
11 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 // See the License for the specific language governing permissions and
13 // limitations under the License.
14
15 // A demo sandbox for the custom_fork_bin binary.
16 // Use: custom_fork_sandbox --logtostderr
17
18 #include <syscall.h>
19
20 #include <cstdint>
21 #include <cstdlib>
22 #include <memory>
23 #include <string>
24 #include <utility>
25 #include <vector>
26
27 #include "absl/log/check.h"
28 #include "absl/flags/parse.h"
29 #include "absl/log/globals.h"
30 #include "absl/log/initialize.h"
31 #include "absl/log/log.h"
32 #include "absl/base/log_severity.h"
33 #include "absl/time/time.h"
34 #include "sandboxed_api/config.h"
35 #include "sandboxed_api/sandbox2/comms.h"
36 #include "sandboxed_api/sandbox2/executor.h"
37 #include "sandboxed_api/sandbox2/fork_client.h"
38 #include "sandboxed_api/sandbox2/limits.h"
39 #include "sandboxed_api/sandbox2/policy.h"
40 #include "sandboxed_api/sandbox2/policybuilder.h"
41 #include "sandboxed_api/sandbox2/result.h"
42 #include "sandboxed_api/sandbox2/sandbox2.h"
43 #include "sandboxed_api/util/runfiles.h"
44
GetPolicy()45 std::unique_ptr<sandbox2::Policy> GetPolicy() {
46 return sandbox2::PolicyBuilder()
47 .AllowRead()
48 .AllowWrite()
49 .AllowExit()
50 .AllowTime()
51 .AllowSyscalls({
52 __NR_close, __NR_getpid,
53 #if defined(__NR_arch_prctl)
54 // Not defined with every CPU architecture in prod.
55 __NR_arch_prctl,
56 #endif
57 })
58 .AllowLlvmSanitizers() // Will be a no-op when not using sanitizers.
59 .BuildOrDie();
60 }
61
SandboxIteration(sandbox2::ForkClient * fork_client,int32_t i)62 static int SandboxIteration(sandbox2::ForkClient* fork_client, int32_t i) {
63 // Now, start the sandboxee as usual, just use a different Executor
64 // constructor, which takes pointer to the ForkClient.
65 auto executor = std::make_unique<sandbox2::Executor>(fork_client);
66
67 // Set limits as usual.
68 executor
69 ->limits()
70 // Kill sandboxed processes with a signal (SIGXFSZ) if it writes more than
71 // these many bytes to the file-system (including logs in prod, which
72 // write to files STDOUT and STDERR).
73 ->set_rlimit_fsize(1024 /* bytes */)
74 // The CPU time limit.
75 .set_rlimit_cpu(10 /* CPU-seconds */)
76 .set_walltime_limit(absl::Seconds(5));
77
78 sandbox2::Sandbox2 s2(std::move(executor), GetPolicy());
79
80 // Let the sandboxee run (asynchronously).
81 CHECK(s2.RunAsync());
82 // Send integer, which will be returned as the sandboxee's exit code.
83 CHECK(s2.comms()->SendInt32(i));
84 sandbox2::Result result = s2.AwaitResult();
85
86 LOG(INFO) << "Final execution status of PID " << s2.pid() << ": "
87 << result.ToString();
88
89 if (result.final_status() != sandbox2::Result::OK) {
90 return -1;
91 }
92 return result.reason_code();
93 }
94
main(int argc,char * argv[])95 int main(int argc, char* argv[]) {
96 absl::SetStderrThreshold(absl::LogSeverityAtLeast::kInfo);
97 absl::ParseCommandLine(argc, argv);
98 absl::InitializeLog();
99
100 // This test is incompatible with sanitizers.
101 // The `SKIP_SANITIZERS_AND_COVERAGE` macro won't work for us here since we
102 // need to return something.
103 if constexpr (sapi::sanitizers::IsAny()) {
104 return EXIT_SUCCESS;
105 }
106
107 // Start a custom fork-server (via sandbox2::Executor).
108 // Note: In your own code, use sapi::GetDataDependencyFilePath() instead.
109 const std::string path = sapi::internal::GetSapiDataDependencyFilePath(
110 "sandbox2/examples/custom_fork/custom_fork_bin");
111 std::vector<std::string> args = {path};
112 std::vector<std::string> envs = {};
113 auto fork_executor = std::make_unique<sandbox2::Executor>(path, args, envs);
114 // Start the fork-server (which is here: the custom_fork_bin process calling
115 // sandbox2::Client::WaitAndFork() in a loop).
116 //
117 // This function returns immediately, returning std::unique_ptr<ForkClient>.
118 //
119 // If it's holding the nullptr, then this call had failed.
120 auto fork_client = fork_executor->StartForkServer();
121 if (!fork_client) {
122 LOG(ERROR) << "Starting custom ForkServer failed";
123 return EXIT_FAILURE;
124 }
125 LOG(INFO) << "Custom Fork-Server started";
126
127 // Test new sandboxees: send them integers over Comms, and expect they will
128 // exit with these specific exit codes.
129 for (int i = 0; i < 10; ++i) {
130 CHECK_EQ(SandboxIteration(fork_client.get(), i), i);
131 }
132
133 return EXIT_SUCCESS;
134 }
135