1 //===- Chrootchecker.cpp -------- Basic security checks ----------*- C++ -*-==//
2 //
3 // The LLVM Compiler Infrastructure
4 //
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
7 //
8 //===----------------------------------------------------------------------===//
9 //
10 // This file defines chroot checker, which checks improper use of chroot.
11 //
12 //===----------------------------------------------------------------------===//
13
14 #include "ClangSACheckers.h"
15 #include "clang/StaticAnalyzer/Core/Checker.h"
16 #include "clang/StaticAnalyzer/Core/CheckerManager.h"
17 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
18 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
19 #include "clang/StaticAnalyzer/Core/PathSensitive/GRState.h"
20 #include "clang/StaticAnalyzer/Core/PathSensitive/GRStateTrait.h"
21 #include "clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h"
22 #include "llvm/ADT/ImmutableMap.h"
23 using namespace clang;
24 using namespace ento;
25
26 namespace {
27
28 // enum value that represent the jail state
29 enum Kind { NO_CHROOT, ROOT_CHANGED, JAIL_ENTERED };
30
isRootChanged(intptr_t k)31 bool isRootChanged(intptr_t k) { return k == ROOT_CHANGED; }
32 //bool isJailEntered(intptr_t k) { return k == JAIL_ENTERED; }
33
34 // This checker checks improper use of chroot.
35 // The state transition:
36 // NO_CHROOT ---chroot(path)--> ROOT_CHANGED ---chdir(/) --> JAIL_ENTERED
37 // | |
38 // ROOT_CHANGED<--chdir(..)-- JAIL_ENTERED<--chdir(..)--
39 // | |
40 // bug<--foo()-- JAIL_ENTERED<--foo()--
41 class ChrootChecker : public Checker<eval::Call, check::PreStmt<CallExpr> > {
42 mutable IdentifierInfo *II_chroot, *II_chdir;
43 // This bug refers to possibly break out of a chroot() jail.
44 mutable llvm::OwningPtr<BuiltinBug> BT_BreakJail;
45
46 public:
ChrootChecker()47 ChrootChecker() : II_chroot(0), II_chdir(0) {}
48
getTag()49 static void *getTag() {
50 static int x;
51 return &x;
52 }
53
54 bool evalCall(const CallExpr *CE, CheckerContext &C) const;
55 void checkPreStmt(const CallExpr *CE, CheckerContext &C) const;
56
57 private:
58 void Chroot(CheckerContext &C, const CallExpr *CE) const;
59 void Chdir(CheckerContext &C, const CallExpr *CE) const;
60 };
61
62 } // end anonymous namespace
63
evalCall(const CallExpr * CE,CheckerContext & C) const64 bool ChrootChecker::evalCall(const CallExpr *CE, CheckerContext &C) const {
65 const GRState *state = C.getState();
66 const Expr *Callee = CE->getCallee();
67 SVal L = state->getSVal(Callee);
68 const FunctionDecl *FD = L.getAsFunctionDecl();
69 if (!FD)
70 return false;
71
72 ASTContext &Ctx = C.getASTContext();
73 if (!II_chroot)
74 II_chroot = &Ctx.Idents.get("chroot");
75 if (!II_chdir)
76 II_chdir = &Ctx.Idents.get("chdir");
77
78 if (FD->getIdentifier() == II_chroot) {
79 Chroot(C, CE);
80 return true;
81 }
82 if (FD->getIdentifier() == II_chdir) {
83 Chdir(C, CE);
84 return true;
85 }
86
87 return false;
88 }
89
Chroot(CheckerContext & C,const CallExpr * CE) const90 void ChrootChecker::Chroot(CheckerContext &C, const CallExpr *CE) const {
91 const GRState *state = C.getState();
92 GRStateManager &Mgr = state->getStateManager();
93
94 // Once encouter a chroot(), set the enum value ROOT_CHANGED directly in
95 // the GDM.
96 state = Mgr.addGDM(state, ChrootChecker::getTag(), (void*) ROOT_CHANGED);
97 C.addTransition(state);
98 }
99
Chdir(CheckerContext & C,const CallExpr * CE) const100 void ChrootChecker::Chdir(CheckerContext &C, const CallExpr *CE) const {
101 const GRState *state = C.getState();
102 GRStateManager &Mgr = state->getStateManager();
103
104 // If there are no jail state in the GDM, just return.
105 const void* k = state->FindGDM(ChrootChecker::getTag());
106 if (!k)
107 return;
108
109 // After chdir("/"), enter the jail, set the enum value JAIL_ENTERED.
110 const Expr *ArgExpr = CE->getArg(0);
111 SVal ArgVal = state->getSVal(ArgExpr);
112
113 if (const MemRegion *R = ArgVal.getAsRegion()) {
114 R = R->StripCasts();
115 if (const StringRegion* StrRegion= dyn_cast<StringRegion>(R)) {
116 const StringLiteral* Str = StrRegion->getStringLiteral();
117 if (Str->getString() == "/")
118 state = Mgr.addGDM(state, ChrootChecker::getTag(),
119 (void*) JAIL_ENTERED);
120 }
121 }
122
123 C.addTransition(state);
124 }
125
126 // Check the jail state before any function call except chroot and chdir().
checkPreStmt(const CallExpr * CE,CheckerContext & C) const127 void ChrootChecker::checkPreStmt(const CallExpr *CE, CheckerContext &C) const {
128 const GRState *state = C.getState();
129 const Expr *Callee = CE->getCallee();
130 SVal L = state->getSVal(Callee);
131 const FunctionDecl *FD = L.getAsFunctionDecl();
132 if (!FD)
133 return;
134
135 ASTContext &Ctx = C.getASTContext();
136 if (!II_chroot)
137 II_chroot = &Ctx.Idents.get("chroot");
138 if (!II_chdir)
139 II_chdir = &Ctx.Idents.get("chdir");
140
141 // Ingnore chroot and chdir.
142 if (FD->getIdentifier() == II_chroot || FD->getIdentifier() == II_chdir)
143 return;
144
145 // If jail state is ROOT_CHANGED, generate BugReport.
146 void* const* k = state->FindGDM(ChrootChecker::getTag());
147 if (k)
148 if (isRootChanged((intptr_t) *k))
149 if (ExplodedNode *N = C.generateNode()) {
150 if (!BT_BreakJail)
151 BT_BreakJail.reset(new BuiltinBug("Break out of jail",
152 "No call of chdir(\"/\") immediately "
153 "after chroot"));
154 BugReport *R = new BugReport(*BT_BreakJail,
155 BT_BreakJail->getDescription(), N);
156 C.EmitReport(R);
157 }
158
159 return;
160 }
161
registerChrootChecker(CheckerManager & mgr)162 void ento::registerChrootChecker(CheckerManager &mgr) {
163 mgr.registerChecker<ChrootChecker>();
164 }
165