1 // Copyright 2019 Google LLC
2 //
3 // Licensed under the Apache License, Version 2.0 (the "License");
4 // you may not use this file except in compliance with the License.
5 // You may obtain a copy of the License at
6 //
7 // https://www.apache.org/licenses/LICENSE-2.0
8 //
9 // Unless required by applicable law or agreed to in writing, software
10 // distributed under the License is distributed on an "AS IS" BASIS,
11 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 // See the License for the specific language governing permissions and
13 // limitations under the License.
14
15 #include "sandboxed_api/embed_file.h"
16
17 #include <fcntl.h>
18 #include <sys/stat.h>
19 #include <unistd.h>
20
21 #include <string>
22
23 #include "sandboxed_api/file_toc.h"
24 #include "absl/strings/str_cat.h"
25 #include "absl/synchronization/mutex.h"
26 #include "sandboxed_api/sandbox2/util.h"
27 #include "sandboxed_api/util/fileops.h"
28 #include "sandboxed_api/util/raw_logging.h"
29
30 namespace sapi {
31
32 namespace {
33
34 using ::sapi::file_util::fileops::FDCloser;
35
36 #ifndef F_ADD_SEALS
37 #define F_ADD_SEALS 1033
38 #define F_SEAL_SEAL 0x0001
39 #define F_SEAL_SHRINK 0x0002
40 #define F_SEAL_GROW 0x0004
41 #define F_SEAL_WRITE 0x0008
42 #endif
43
SealFile(int fd)44 bool SealFile(int fd) {
45 constexpr int kMaxRetries = 10;
46 for (int i = 0; i < kMaxRetries; ++i) {
47 if (fcntl(fd, F_ADD_SEALS,
48 F_SEAL_SEAL | F_SEAL_SHRINK | F_SEAL_GROW | F_SEAL_WRITE) == 0) {
49 return true;
50 }
51 }
52 return false;
53 }
54
55 } // namespace
56
instance()57 EmbedFile* EmbedFile::instance() {
58 static auto* embed_file_instance = new EmbedFile();
59 return embed_file_instance;
60 }
61
CreateFdForFileToc(const FileToc * toc)62 int EmbedFile::CreateFdForFileToc(const FileToc* toc) {
63 // Create a memfd/temp file and write contents of the SAPI library to it.
64 int fd = -1;
65 if (!sandbox2::util::CreateMemFd(&fd, toc->name)) {
66 SAPI_RAW_LOG(ERROR, "Couldn't create a temporary file for TOC name '%s'",
67 toc->name);
68 return -1;
69 }
70 file_util::fileops::FDCloser embed_fd(fd);
71
72 if (!file_util::fileops::WriteToFD(embed_fd.get(), toc->data, toc->size)) {
73 SAPI_RAW_PLOG(ERROR, "Couldn't write SAPI embed file '%s' to memfd file",
74 toc->name);
75 return -1;
76 }
77
78 // Make the underlying file non-writeable.
79 if (fchmod(embed_fd.get(),
80 S_IRUSR | S_IXUSR | S_IRGRP | S_IXGRP | S_IROTH | S_IXOTH) == -1) {
81 SAPI_RAW_PLOG(ERROR, "Could't make FD=%d RX-only", embed_fd.get());
82 return -1;
83 }
84
85 // Seal the file
86 if (!SealFile(embed_fd.get())) {
87 SAPI_RAW_PLOG(ERROR, "Couldn't apply file seals to FD=%d", embed_fd.get());
88 return -1;
89 }
90
91 // Instead of working around problems with CRIU we reopen the file as
92 // read-only.
93 fd = open(absl::StrCat("/proc/", getpid(), "/fd/", embed_fd.get()).c_str(),
94 O_RDONLY | O_CLOEXEC);
95 if (fd == -1) {
96 SAPI_RAW_PLOG(ERROR, "Couldn't reopen '%d' read-only through /proc",
97 embed_fd.get());
98 return -1;
99 }
100 return fd;
101 }
102
GetFdForFileToc(const FileToc * toc)103 int EmbedFile::GetFdForFileToc(const FileToc* toc) {
104 // Access to file_tocs_ must be guarded.
105 absl::MutexLock lock{&file_tocs_mutex_};
106
107 // If a file-descriptor for this toc already exists, just return it.
108 auto entry = file_tocs_.find(toc);
109 if (entry != file_tocs_.end()) {
110 SAPI_RAW_VLOG(3,
111 "Returning pre-existing embed file entry for '%s', fd: %d "
112 "(orig name: '%s')",
113 toc->name, entry->second.get(), entry->first->name);
114 return entry->second.get();
115 }
116
117 int embed_fd = CreateFdForFileToc(toc);
118 if (embed_fd == -1) {
119 SAPI_RAW_LOG(ERROR, "Cannot create a file for FileTOC: '%s'", toc->name);
120 return -1;
121 }
122
123 SAPI_RAW_VLOG(1, "Created new embed file entry for '%s' with fd: %d",
124 toc->name, embed_fd);
125
126 file_tocs_[toc] = FDCloser(embed_fd);
127 return embed_fd;
128 }
129
GetDupFdForFileToc(const FileToc * toc)130 int EmbedFile::GetDupFdForFileToc(const FileToc* toc) {
131 int fd = GetFdForFileToc(toc);
132 if (fd == -1) {
133 return -1;
134 }
135 fd = dup(fd);
136 if (fd == -1) {
137 SAPI_RAW_PLOG(ERROR, "dup failed");
138 }
139 return fd;
140 }
141
142 } // namespace sapi
143