1 // Copyright 2019 Google LLC 2 // 3 // Licensed under the Apache License, Version 2.0 (the "License"); 4 // you may not use this file except in compliance with the License. 5 // You may obtain a copy of the License at 6 // 7 // https://www.apache.org/licenses/LICENSE-2.0 8 // 9 // Unless required by applicable law or agreed to in writing, software 10 // distributed under the License is distributed on an "AS IS" BASIS, 11 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 12 // See the License for the specific language governing permissions and 13 // limitations under the License. 14 15 // This class should be used in the client code, in a place where sandboxing 16 // should be engaged. 17 18 #ifndef SANDBOXED_API_SANDBOX2_CLIENT_H_ 19 #define SANDBOXED_API_SANDBOX2_CLIENT_H_ 20 21 #include <cstdint> 22 #include <memory> 23 #include <string> 24 #include <vector> 25 26 #include "absl/container/flat_hash_map.h" 27 #include "absl/status/status.h" 28 #include "sandboxed_api/sandbox2/comms.h" 29 #include "sandboxed_api/sandbox2/logsink.h" 30 #include "sandboxed_api/sandbox2/network_proxy/client.h" 31 32 namespace sandbox2 { 33 34 class Client { 35 public: 36 // Client is ready to be sandboxed. 37 static constexpr uint32_t kClient2SandboxReady = 0x0A0B0C01; 38 39 // Sandbox is ready to monitor the sandboxee. 40 static constexpr uint32_t kSandbox2ClientDone = 0x0A0B0C02; 41 42 // Sandboxee should setup seccomp_unotify and send back the FD. 43 static constexpr uint32_t kSandbox2ClientUnotify = 0x0A0B0C03; 44 45 explicit Client(Comms* comms); 46 virtual ~Client() = default; 47 48 Client(const Client&) = delete; 49 Client& operator=(const Client&) = delete; 50 51 // Receives a sandbox policy over the comms channel and enables sandboxing. 52 // Using this method allows to have a sandbox-aware sandboxee perform complex 53 // initialization first and then enable sandboxing for actual processing. 54 void SandboxMeHere(); 55 56 // Returns the file descriptor that was mapped to the sandboxee using 57 // IPC::ReceiveFd(name). 58 int GetMappedFD(const std::string& name); 59 bool HasMappedFD(const std::string& name); 60 61 // Registers a LogSink that forwards all logs to the supervisor. 62 void SendLogsToSupervisor(); 63 64 // Returns the network proxy client and starts it if this function is called 65 // for the first time. 66 NetworkProxyClient* GetNetworkProxyClient(); 67 68 // Redirects the connect() syscall to the ConnectHandler() method in 69 // the NetworkProxyClient class. 70 absl::Status InstallNetworkProxyHandler(); 71 72 protected: 73 // Comms used for synchronization with the monitor, not owned by the object. 74 Comms* comms_; 75 76 private: 77 static constexpr const char* kFDMapEnvVar = "SB2_FD_MAPPINGS"; 78 79 friend class ForkServer; 80 81 // Seccomp-bpf policy received from the monitor. 82 std::vector<uint8_t> policy_; 83 84 // LogSink that forwards all log messages to the supervisor. 85 std::unique_ptr<LogSink> logsink_; 86 87 // NetworkProxyClient that forwards network connection requests to the 88 // supervisor. 89 std::unique_ptr<NetworkProxyClient> proxy_client_; 90 91 // In the pre-execve case, the sandboxee has to pass the information about 92 // file descriptors to the new process. We set an environment variable for 93 // this case that is parsed in the Client constructor if present. 94 absl::flat_hash_map<std::string, int> fd_map_; 95 96 std::string GetFdMapEnvVar() const; 97 98 // Sets up communication channels with the sandbox. 99 // preserved_fd contains file descriptor that should be kept open and alive. 100 // The FD number might be changed if needed. 101 // preserved_fd can be a nullptr. 102 void SetUpIPC(int* preserved_fd); 103 104 // Sets up the current working directory. 105 void SetUpCwd(); 106 107 // Receives seccomp-bpf policy from the monitor. 108 void ReceivePolicy(); 109 110 // Applies sandbox-bpf policy, have limits applied on us, and become ptrace'd. 111 void ApplyPolicyAndBecomeTracee(); 112 113 void PrepareEnvironment(int* preserved_fd = nullptr); 114 void EnableSandbox(); 115 116 bool allow_speculation_ = false; 117 }; 118 119 } // namespace sandbox2 120 121 #endif // SANDBOXED_API_SANDBOX2_CLIENT_H_ 122