1 /*
2  * Copyright (C) 2017 The Android Open Source Project
3  *
4  * Licensed under the Apache License, Version 2.0 (the "License");
5  * you may not use this file except in compliance with the License.
6  * You may obtain a copy of the License at
7  *
8  *      http://www.apache.org/licenses/LICENSE-2.0
9  *
10  * Unless required by applicable law or agreed to in writing, software
11  * distributed under the License is distributed on an "AS IS" BASIS,
12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13  * See the License for the specific language governing permissions and
14  * limitations under the License.
15  */
16 
17 #include "seccomp_policy.h"
18 
19 #include <assert.h>
20 #include <linux/audit.h>
21 #include <linux/seccomp.h>
22 #include <sys/prctl.h>
23 #include <sys/syscall.h>
24 
25 #include <vector>
26 
27 #include <android-base/logging.h>
28 
29 #include "func_to_syscall_nrs.h"
30 #include "seccomp_bpfs.h"
31 
32 #if defined __arm__ || defined __aarch64__
33 
34 #define DUAL_ARCH
35 #define PRIMARY_ARCH AUDIT_ARCH_AARCH64
36 static const struct sock_filter* primary_app_filter = arm64_app_filter;
37 static const size_t primary_app_filter_size = arm64_app_filter_size;
38 static const struct sock_filter* primary_app_zygote_filter = arm64_app_zygote_filter;
39 static const size_t primary_app_zygote_filter_size = arm64_app_zygote_filter_size;
40 static const struct sock_filter* primary_system_filter = arm64_system_filter;
41 static const size_t primary_system_filter_size = arm64_system_filter_size;
42 
43 static const long primary_setresgid = __arm64_setresgid;
44 static const long primary_setresuid = __arm64_setresuid;
45 #define SECONDARY_ARCH AUDIT_ARCH_ARM
46 static const struct sock_filter* secondary_app_filter = arm_app_filter;
47 static const size_t secondary_app_filter_size = arm_app_filter_size;
48 static const struct sock_filter* secondary_app_zygote_filter = arm_app_zygote_filter;
49 static const size_t secondary_app_zygote_filter_size = arm_app_zygote_filter_size;
50 static const struct sock_filter* secondary_system_filter = arm_system_filter;
51 static const size_t secondary_system_filter_size = arm_system_filter_size;
52 
53 static const long secondary_setresgid = __arm_setresgid;
54 static const long secondary_setresuid = __arm_setresuid;
55 #elif defined __i386__ || defined __x86_64__
56 
57 #define DUAL_ARCH
58 #define PRIMARY_ARCH AUDIT_ARCH_X86_64
59 static const struct sock_filter* primary_app_filter = x86_64_app_filter;
60 static const size_t primary_app_filter_size = x86_64_app_filter_size;
61 static const struct sock_filter* primary_app_zygote_filter = x86_64_app_zygote_filter;
62 static const size_t primary_app_zygote_filter_size = x86_64_app_zygote_filter_size;
63 static const struct sock_filter* primary_system_filter = x86_64_system_filter;
64 static const size_t primary_system_filter_size = x86_64_system_filter_size;
65 
66 static const long primary_setresgid = __x86_64_setresgid;
67 static const long primary_setresuid = __x86_64_setresuid;
68 #define SECONDARY_ARCH AUDIT_ARCH_I386
69 static const struct sock_filter* secondary_app_filter = x86_app_filter;
70 static const size_t secondary_app_filter_size = x86_app_filter_size;
71 static const struct sock_filter* secondary_app_zygote_filter = x86_app_zygote_filter;
72 static const size_t secondary_app_zygote_filter_size = x86_app_zygote_filter_size;
73 static const struct sock_filter* secondary_system_filter = x86_system_filter;
74 static const size_t secondary_system_filter_size = x86_system_filter_size;
75 
76 static const long secondary_setresgid = __x86_setresgid;
77 static const long secondary_setresuid = __x86_setresuid;
78 #else
79 #error No architecture was defined!
80 #endif
81 
82 
83 #define syscall_nr (offsetof(struct seccomp_data, nr))
84 #define syscall_arg(_n) (offsetof(struct seccomp_data, args[_n]))
85 #define arch_nr (offsetof(struct seccomp_data, arch))
86 
87 typedef std::vector<sock_filter> filter;
88 
Allow(filter & f)89 inline void Allow(filter& f) {
90     f.push_back(BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW));
91 }
92 
Disallow(filter & f)93 inline void Disallow(filter& f) {
94     f.push_back(BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRAP));
95 }
96 
ExamineSyscall(filter & f)97 static void ExamineSyscall(filter& f) {
98     f.push_back(BPF_STMT(BPF_LD|BPF_W|BPF_ABS, syscall_nr));
99 }
100 
101 #ifdef DUAL_ARCH
SetValidateArchitectureJumpTarget(size_t offset,filter & f)102 static bool SetValidateArchitectureJumpTarget(size_t offset, filter& f) {
103     size_t jump_length = f.size() - offset - 1;
104     auto u8_jump_length = (__u8) jump_length;
105     if (u8_jump_length != jump_length) {
106         LOG(FATAL)
107             << "Can't set jump greater than 255 - actual jump is " <<  jump_length;
108         return false;
109     }
110     f[offset] = BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, SECONDARY_ARCH, u8_jump_length, 0);
111     return true;
112 }
113 
ValidateArchitectureAndJumpIfNeeded(filter & f)114 static size_t ValidateArchitectureAndJumpIfNeeded(filter& f) {
115     f.push_back(BPF_STMT(BPF_LD|BPF_W|BPF_ABS, arch_nr));
116     f.push_back(BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, PRIMARY_ARCH, 2, 0));
117     f.push_back(BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, SECONDARY_ARCH, 1, 0));
118     Disallow(f);
119     return f.size() - 2;
120 }
121 #else
ValidateArchitecture(filter & f)122 static void ValidateArchitecture(filter& f) {
123     f.push_back(BPF_STMT(BPF_LD|BPF_W|BPF_ABS, arch_nr));
124     f.push_back(BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, PRIMARY_ARCH, 1, 0));
125     Disallow(f);
126 }
127 #endif
128 
ValidateSyscallArgInRange(filter & f,__u32 arg_num,__u32 range_min,__u32 range_max)129 static void ValidateSyscallArgInRange(filter& f, __u32 arg_num, __u32 range_min, __u32 range_max) {
130     const __u32 syscall_arg = syscall_arg(arg_num);
131 
132     if (range_max == UINT32_MAX) {
133         LOG(FATAL) << "range_max exceeds maximum argument range.";
134         return;
135     }
136 
137     f.push_back(BPF_STMT(BPF_LD|BPF_W|BPF_ABS, syscall_arg));
138     f.push_back(BPF_JUMP(BPF_JMP|BPF_JGE|BPF_K, range_min, 0, 1));
139     f.push_back(BPF_JUMP(BPF_JMP|BPF_JGE|BPF_K, range_max + 1, 0, 1));
140     Disallow(f);
141 }
142 
143 // This filter is meant to be installed in addition to a regular allowlist filter.
144 // Therefore, it's default action has to be Allow, except when the evaluated
145 // system call matches setresuid/setresgid and the arguments don't fall within the
146 // passed in range.
147 //
148 // The regular allowlist only allows setresuid/setresgid for UID/GID changes, so
149 // that's the only system call we need to check here. A CTS test ensures the other
150 // calls will remain blocked.
ValidateSetUidGid(filter & f,uint32_t uid_gid_min,uint32_t uid_gid_max,bool primary)151 static void ValidateSetUidGid(filter& f, uint32_t uid_gid_min, uint32_t uid_gid_max, bool primary) {
152     // Check setresuid(ruid, euid, sguid) fall within range
153     ExamineSyscall(f);
154     __u32 setresuid_nr = primary ? primary_setresuid : secondary_setresuid;
155     f.push_back(BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, setresuid_nr, 0, 12));
156     for (int arg = 0; arg < 3; arg++) {
157         ValidateSyscallArgInRange(f, arg, uid_gid_min, uid_gid_max);
158     }
159 
160     // Check setresgid(rgid, egid, sgid) fall within range
161     ExamineSyscall(f);
162     __u32 setresgid_nr = primary ? primary_setresgid : secondary_setresgid;
163     f.push_back(BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, setresgid_nr, 0, 12));
164     for (int arg = 0; arg < 3; arg++) {
165         ValidateSyscallArgInRange(f, arg, uid_gid_min, uid_gid_max);
166     }
167 
168     // Default is to allow; other filters may still reject this call.
169     Allow(f);
170 }
171 
install_filter(filter const & f)172 static bool install_filter(filter const& f) {
173     struct sock_fprog prog = {
174         static_cast<unsigned short>(f.size()),
175         const_cast<struct sock_filter*>(&f[0]),
176     };
177     // This assumes either the current process has CAP_SYS_ADMIN, or PR_SET_NO_NEW_PRIVS bit is set.
178     if (prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog) < 0) {
179         PLOG(FATAL) << "Could not set seccomp filter of size " << f.size();
180         return false;
181     }
182     return true;
183 }
184 
_install_setuidgid_filter(uint32_t uid_gid_min,uint32_t uid_gid_max)185 bool _install_setuidgid_filter(uint32_t uid_gid_min, uint32_t uid_gid_max) {
186     filter f;
187 #ifdef DUAL_ARCH
188     // Note that for mixed 64/32 bit architectures, ValidateArchitecture inserts a
189     // jump that must be changed to point to the start of the 32-bit policy
190     // 32 bit syscalls will not hit the policy between here and the call to SetJump
191     auto offset_to_secondary_filter = ValidateArchitectureAndJumpIfNeeded(f);
192 #else
193     ValidateArchitecture(f);
194 #endif
195 
196     ValidateSetUidGid(f, uid_gid_min, uid_gid_max, true /* primary */);
197 
198 #ifdef DUAL_ARCH
199     if (!SetValidateArchitectureJumpTarget(offset_to_secondary_filter, f)) {
200         return false;
201     }
202 
203     ValidateSetUidGid(f, uid_gid_min, uid_gid_max, false /* primary */);
204 #endif
205 
206     return install_filter(f);
207 }
208 
209 enum FilterType {
210   APP,
211   APP_ZYGOTE,
212   SYSTEM,
213 };
214 
_set_seccomp_filter(FilterType type)215 bool _set_seccomp_filter(FilterType type) {
216     const sock_filter *p, *s;
217     size_t p_size, s_size;
218     filter f;
219 
220     switch (type) {
221       case APP:
222         p = primary_app_filter;
223         p_size = primary_app_filter_size;
224         s = secondary_app_filter;
225         s_size = secondary_app_filter_size;
226         break;
227       case APP_ZYGOTE:
228         p = primary_app_zygote_filter;
229         p_size = primary_app_zygote_filter_size;
230         s = secondary_app_zygote_filter;
231         s_size = secondary_app_zygote_filter_size;
232         break;
233       case SYSTEM:
234         p = primary_system_filter;
235         p_size = primary_system_filter_size;
236         s = secondary_system_filter;
237         s_size = secondary_system_filter_size;
238         break;
239     }
240 
241 #ifdef DUAL_ARCH
242     // Note that for mixed 64/32 bit architectures, ValidateArchitecture inserts a
243     // jump that must be changed to point to the start of the 32-bit policy
244     // 32 bit syscalls will not hit the policy between here and the call to SetJump
245     auto offset_to_secondary_filter = ValidateArchitectureAndJumpIfNeeded(f);
246 #else
247     ValidateArchitecture(f);
248 #endif
249 
250     ExamineSyscall(f);
251 
252     for (size_t i = 0; i < p_size; ++i) {
253         f.push_back(p[i]);
254     }
255     Disallow(f);
256 
257 #ifdef DUAL_ARCH
258     if (!SetValidateArchitectureJumpTarget(offset_to_secondary_filter, f)) {
259         return false;
260     }
261 
262     ExamineSyscall(f);
263 
264     for (size_t i = 0; i < s_size; ++i) {
265         f.push_back(s[i]);
266     }
267     Disallow(f);
268 #endif
269 
270     return install_filter(f);
271 }
272 
set_app_seccomp_filter()273 bool set_app_seccomp_filter() {
274     return _set_seccomp_filter(FilterType::APP);
275 }
276 
set_app_zygote_seccomp_filter()277 bool set_app_zygote_seccomp_filter() {
278     return _set_seccomp_filter(FilterType::APP_ZYGOTE);
279 }
280 
set_system_seccomp_filter()281 bool set_system_seccomp_filter() {
282     return _set_seccomp_filter(FilterType::SYSTEM);
283 }
284 
install_setuidgid_seccomp_filter(uint32_t uid_gid_min,uint32_t uid_gid_max)285 bool install_setuidgid_seccomp_filter(uint32_t uid_gid_min, uint32_t uid_gid_max) {
286     return _install_setuidgid_filter(uid_gid_min, uid_gid_max);
287 }
288