diff --git a/source/plugins/sandbox_plugin/source/sandbox_plugin.cpp b/source/plugins/sandbox_plugin/source/sandbox_plugin.cpp index 792114c7d..4dd5cb609 100644 --- a/source/plugins/sandbox_plugin/source/sandbox_plugin.cpp +++ b/source/plugins/sandbox_plugin/source/sandbox_plugin.cpp @@ -30,20 +30,22 @@ metacall_value_to_bool(value) == 0L ? SCMP_ACT_KILL : SCMP_ACT_ALLOW /* Error messages */ -#define SANDBOX_INITIALIZE_ERROR "Sandbox plugin failed to initialize a context" -#define SANDBOX_UNAME_ERROR "Sandbox plugin failed to set uname syscall permissions" -#define SANDBOX_IO_ERROR "Sandbox plugin failed to set io syscalls permissions" -#define SANDBOX_SOCKETS_ERROR "Sandbox plugin failed to set sockets syscalls permissions" -#define SANDBOX_IPC_ERROR "Sandbox plugin failed to set IPC syscalls permissions" -#define SANDBOX_PROCESS_ERROR "Sandbox plugin failed to set process syscalls permissions" -#define SANDBOX_FILESYSTEMS_ERROR "Sandbox plugin failed to set filesystems syscalls permissions" -#define SANDBOX_TIME_ERROR "Sandbox plugin failed to set time syscalls permissions" -#define SANDBOX_MEMORY_ERROR "Sandbox plugin failed to set memory syscalls permissions" -#define SANDBOX_SIGNALS_ERROR "Sandbox plugin failed to set signals syscalls permissions" -#define SANDBOX_DESTROY_ERROR "Sandbox plugin failed to destroy a context" - -void add_syscalls_to_seccomp(scmp_filter_ctx ctx, const int* syscalls, const int action, size_t num_syscalls) { - for (long unsigned int i = 0; i < num_syscalls; i++) { +#define SANDBOX_INITIALIZE_ERROR "Sandbox plugin failed to initialize a context" +#define SANDBOX_UNAME_ERROR "Sandbox plugin failed to set uname syscall permissions" +#define SANDBOX_IO_ERROR "Sandbox plugin failed to set io syscalls permissions" +#define SANDBOX_SOCKETS_ERROR "Sandbox plugin failed to set sockets syscalls permissions" +#define SANDBOX_IPC_ERROR "Sandbox plugin failed to set IPC syscalls permissions" +#define SANDBOX_PROCESS_ERROR "Sandbox plugin failed to set process syscalls permissions" +#define SANDBOX_FILESYSTEMS_ERROR "Sandbox plugin failed to set filesystems syscalls permissions" +#define SANDBOX_TIME_ERROR "Sandbox plugin failed to set time syscalls permissions" +#define SANDBOX_MEMORY_ERROR "Sandbox plugin failed to set memory syscalls permissions" +#define SANDBOX_SIGNALS_ERROR "Sandbox plugin failed to set signals syscalls permissions" +#define SANDBOX_DESTROY_ERROR "Sandbox plugin failed to destroy a context" + +void add_syscalls_to_seccomp(scmp_filter_ctx ctx, const int *syscalls, const int action, size_t num_syscalls) +{ + for (long unsigned int i = 0; i < num_syscalls; i++) + { seccomp_rule_add(ctx, action, syscalls[i], 0); } } @@ -128,7 +130,6 @@ void *sandbox_io(size_t argc, void *args[], void *data) void *sandbox_sockets(size_t argc, void *args[], void *data) { - scmp_filter_ctx ctx; /* Validate function parameters */ @@ -137,23 +138,23 @@ void *sandbox_sockets(size_t argc, void *args[], void *data) ctx = metacall_value_to_ptr(args[0]); const int syscalls[] = { - SCMP_SYS(socket), // It is primarily associated to networking - SCMP_SYS(bind), // TODO: Check if this is needed, because it is also used for unix sockets (IPC) - SCMP_SYS(listen), // TODO: Check if this is needed, because it is also used for unix sockets (IPC) - SCMP_SYS(accept), // TODO: Check if this is needed, because it is also used for unix sockets (IPC) - SCMP_SYS(connect), // TODO: Check if this is needed, because it is also used for unix sockets (IPC) - SCMP_SYS(send), // TODO: Check if this is needed, because it is also used for unix sockets (IPC) - SCMP_SYS(recv), // TODO: Check if this is needed, because it is also used for unix sockets (IPC) - SCMP_SYS(sendto), // TODO: Check if this is needed, because it is also used for unix sockets (IPC) - SCMP_SYS(recvfrom), // TODO: Check if this is needed, because it is also used for unix sockets (IPC) - SCMP_SYS(shutdown), // It is primarily associated to networking - SCMP_SYS(getpeername), // It is primarily associated to networking - SCMP_SYS(socketpair), // It is primarily associated to networking - SCMP_SYS(setsockopt) // It is primarily associated to networking - // SCMP_SYS(select), // Shouldn't be needed because it is used for file descriptors too - // SCMP_SYS(poll), // Shouldn't be needed because it is used for file descriptors too - // SCMP_SYS(fcntl), // Shouldn't be needed because it is used for file descriptors too - // SCMP_SYS(ioctl) // Shouldn't be needed because it is used for file descriptors too + SCMP_SYS(socket), // It is primarily associated to networking + SCMP_SYS(bind), // TODO: Check if this is needed, because it is also used for unix sockets (IPC) + SCMP_SYS(listen), // TODO: Check if this is needed, because it is also used for unix sockets (IPC) + SCMP_SYS(accept), // TODO: Check if this is needed, because it is also used for unix sockets (IPC) + SCMP_SYS(connect), // TODO: Check if this is needed, because it is also used for unix sockets (IPC) + SCMP_SYS(send), // TODO: Check if this is needed, because it is also used for unix sockets (IPC) + SCMP_SYS(recv), // TODO: Check if this is needed, because it is also used for unix sockets (IPC) + SCMP_SYS(sendto), // TODO: Check if this is needed, because it is also used for unix sockets (IPC) + SCMP_SYS(recvfrom), // TODO: Check if this is needed, because it is also used for unix sockets (IPC) + SCMP_SYS(shutdown), // It is primarily associated to networking + SCMP_SYS(getpeername), // It is primarily associated to networking + SCMP_SYS(socketpair), // It is primarily associated to networking + SCMP_SYS(setsockopt) // It is primarily associated to networking + // SCMP_SYS(select), // Shouldn't be needed because it is used for file descriptors too + // SCMP_SYS(poll), // Shouldn't be needed because it is used for file descriptors too + // SCMP_SYS(fcntl), // Shouldn't be needed because it is used for file descriptors too + // SCMP_SYS(ioctl) // Shouldn't be needed because it is used for file descriptors too }; add_syscalls_to_seccomp(ctx, syscalls, SANDBOX_ACTION(args[1]), sizeof(syscalls) / sizeof(syscalls[0])); @@ -165,7 +166,6 @@ void *sandbox_sockets(size_t argc, void *args[], void *data) void *sandbox_ipc(size_t argc, void *args[], void *data) { - scmp_filter_ctx ctx; /* Validate function parameters */ @@ -196,7 +196,6 @@ void *sandbox_ipc(size_t argc, void *args[], void *data) void *sandbox_process(size_t argc, void *args[], void *data) { - scmp_filter_ctx ctx; /* Validate function parameters */ @@ -205,26 +204,26 @@ void *sandbox_process(size_t argc, void *args[], void *data) ctx = metacall_value_to_ptr(args[0]); const int syscalls[] = { - SCMP_SYS(fork), - SCMP_SYS(vfork), - SCMP_SYS(clone), - SCMP_SYS(execve), - SCMP_SYS(wait4), - SCMP_SYS(waitpid), - SCMP_SYS(waitid), - SCMP_SYS(exit), - SCMP_SYS(exit_group), - SCMP_SYS(kill), - SCMP_SYS(getpid), - SCMP_SYS(getppid), - SCMP_SYS(setsid), - SCMP_SYS(setpgid), - SCMP_SYS(nice), - SCMP_SYS(sched_yield), - SCMP_SYS(setpriority), - SCMP_SYS(getpriority), - SCMP_SYS(getpgid), - SCMP_SYS(setsid) + SCMP_SYS(fork), + SCMP_SYS(vfork), + SCMP_SYS(clone), + SCMP_SYS(execve), + SCMP_SYS(wait4), + SCMP_SYS(waitpid), + SCMP_SYS(waitid), + SCMP_SYS(exit), + SCMP_SYS(exit_group), + SCMP_SYS(kill), + SCMP_SYS(getpid), + SCMP_SYS(getppid), + SCMP_SYS(setsid), + SCMP_SYS(setpgid), + SCMP_SYS(nice), + SCMP_SYS(sched_yield), + SCMP_SYS(setpriority), + SCMP_SYS(getpriority), + SCMP_SYS(getpgid), + SCMP_SYS(setsid) }; add_syscalls_to_seccomp(ctx, syscalls, SANDBOX_ACTION(args[1]), sizeof(syscalls) / sizeof(syscalls[0])); @@ -236,7 +235,6 @@ void *sandbox_process(size_t argc, void *args[], void *data) void *sandbox_filesystems(size_t argc, void *args[], void *data) { - scmp_filter_ctx ctx; /* Validate function parameters */ @@ -245,7 +243,7 @@ void *sandbox_filesystems(size_t argc, void *args[], void *data) ctx = metacall_value_to_ptr(args[0]); const int syscalls[] = { - SCMP_SYS(access), + SCMP_SYS(access), SCMP_SYS(faccessat), SCMP_SYS(chdir), SCMP_SYS(fchdir), @@ -296,7 +294,6 @@ void *sandbox_filesystems(size_t argc, void *args[], void *data) void *sandbox_time(size_t argc, void *args[], void *data) { - scmp_filter_ctx ctx; /* Validate function parameters */ @@ -305,15 +302,15 @@ void *sandbox_time(size_t argc, void *args[], void *data) ctx = metacall_value_to_ptr(args[0]); const int syscalls[] = { - SCMP_SYS(time), - SCMP_SYS(gettimeofday), - SCMP_SYS(settimeofday), - SCMP_SYS(clock_gettime), - SCMP_SYS(clock_settime), - SCMP_SYS(clock_getres), - SCMP_SYS(clock_nanosleep), - SCMP_SYS(nanosleep), - SCMP_SYS(stime), + SCMP_SYS(time), + SCMP_SYS(gettimeofday), + SCMP_SYS(settimeofday), + SCMP_SYS(clock_gettime), + SCMP_SYS(clock_settime), + SCMP_SYS(clock_getres), + SCMP_SYS(clock_nanosleep), + SCMP_SYS(nanosleep), + SCMP_SYS(stime), SCMP_SYS(adjtimex), SCMP_SYS(timer_create), SCMP_SYS(timer_settime), @@ -334,7 +331,6 @@ void *sandbox_time(size_t argc, void *args[], void *data) void *sandbox_memory(size_t argc, void *args[], void *data) { - scmp_filter_ctx ctx; /* Validate function parameters */ @@ -367,7 +363,6 @@ void *sandbox_memory(size_t argc, void *args[], void *data) void *sandbox_signals(size_t argc, void *args[], void *data) { - scmp_filter_ctx ctx; /* Validate function parameters */ @@ -376,22 +371,22 @@ void *sandbox_signals(size_t argc, void *args[], void *data) ctx = metacall_value_to_ptr(args[0]); const int syscalls[] = { - SCMP_SYS(kill), - SCMP_SYS(tgkill), - SCMP_SYS(tkill), - SCMP_SYS(sigaction), - SCMP_SYS(sigprocmask), - SCMP_SYS(sigpending), - SCMP_SYS(sigsuspend), - SCMP_SYS(sigreturn), - SCMP_SYS(rt_sigaction), - SCMP_SYS(rt_sigprocmask), - SCMP_SYS(rt_sigpending), - SCMP_SYS(rt_sigsuspend), - SCMP_SYS(rt_sigreturn), - SCMP_SYS(rt_tgsigqueueinfo), - SCMP_SYS(rt_sigtimedwait), - SCMP_SYS(rt_sigqueueinfo) + SCMP_SYS(kill), + SCMP_SYS(tgkill), + SCMP_SYS(tkill), + SCMP_SYS(sigaction), + SCMP_SYS(sigprocmask), + SCMP_SYS(sigpending), + SCMP_SYS(sigsuspend), + SCMP_SYS(sigreturn), + SCMP_SYS(rt_sigaction), + SCMP_SYS(rt_sigprocmask), + SCMP_SYS(rt_sigpending), + SCMP_SYS(rt_sigsuspend), + SCMP_SYS(rt_sigreturn), + SCMP_SYS(rt_tgsigqueueinfo), + SCMP_SYS(rt_sigtimedwait), + SCMP_SYS(rt_sigqueueinfo) }; add_syscalls_to_seccomp(ctx, syscalls, SANDBOX_ACTION(args[1]), sizeof(syscalls) / sizeof(syscalls[0])); diff --git a/source/tests/metacall_sandbox_plugin_test/source/metacall_sandbox_plugin_test.cpp b/source/tests/metacall_sandbox_plugin_test/source/metacall_sandbox_plugin_test.cpp index 897072d97..517103cd5 100644 --- a/source/tests/metacall_sandbox_plugin_test/source/metacall_sandbox_plugin_test.cpp +++ b/source/tests/metacall_sandbox_plugin_test/source/metacall_sandbox_plugin_test.cpp @@ -33,7 +33,8 @@ void invalid_syscall(void) printf("%s\n", data.sysname); } -void invalid_io_syscall(void *sandbox_ctx, void *handle) { +void invalid_io_syscall(void *sandbox_ctx, void *handle) +{ /* Disable io syscall */ { void *args[2] = { sandbox_ctx, metacall_value_create_bool(0L) /* Kill */ }; @@ -52,43 +53,49 @@ void invalid_io_syscall(void *sandbox_ctx, void *handle) { #include -void invalid_sockets_syscall() { - int fd = socket(AF_INET, SOCK_STREAM, 0); - close(fd); +void invalid_sockets_syscall() +{ + int fd = socket(AF_INET, SOCK_STREAM, 0); + close(fd); } #include #include -void invalid_ipc_syscall() { +void invalid_ipc_syscall() +{ // Create a shared memory segment int shm_id = shmget(1234, 1024, IPC_CREAT | 0666); - if (shm_id == -1) { + if (shm_id == -1) + { perror("shmget"); exit(EXIT_FAILURE); } // Attach the shared memory segment to the process's address space - void* shm_addr = shmat(shm_id, NULL, 0); - if (shm_addr == (void*)-1) { + void *shm_addr = shmat(shm_id, NULL, 0); + if (shm_addr == (void *)-1) + { perror("shmat"); exit(EXIT_FAILURE); } // Write data to shared memory - const char* message = "Hello, Shared Memory!"; - strncpy((char*)shm_addr, message, 1024); + const char *message = "Hello, Shared Memory!"; + strncpy((char *)shm_addr, message, 1024); - printf("Data written to shared memory: %s\n", (char*)shm_addr); + printf("Data written to shared memory: %s\n", (char *)shm_addr); // Detach the shared memory segment - if (shmdt(shm_addr) == -1) { + if (shmdt(shm_addr) == -1) + { perror("shmdt"); exit(EXIT_FAILURE); } // Remove the shared memory segment - if (shmctl(shm_id, IPC_RMID, NULL) == -1) { + if (shmctl(shm_id, IPC_RMID, NULL) == -1) + { perror("shmctl"); exit(EXIT_FAILURE); } @@ -97,7 +104,8 @@ void invalid_ipc_syscall() { #include #include -void invalid_process_syscall(void *sandbox_ctx, void *handle) { +void invalid_process_syscall(void *sandbox_ctx, void *handle) +{ /* Disable process syscall */ { void *args[2] = { sandbox_ctx, metacall_value_create_bool(0L) /* Kill */ }; @@ -113,18 +121,23 @@ void invalid_process_syscall(void *sandbox_ctx, void *handle) { pid_t pid = fork(); - if (pid < 0) { + if (pid < 0) + { perror("fork"); exit(EXIT_FAILURE); } - if (pid == 0) { + if (pid == 0) + { // Child process exit(EXIT_SUCCESS); // Exit immediately - } else { + } + else + { // Parent process int status; - if (waitpid(pid, &status, 0) == -1) { + if (waitpid(pid, &status, 0) == -1) + { perror("waitpid"); exit(EXIT_FAILURE); } @@ -134,7 +147,8 @@ void invalid_process_syscall(void *sandbox_ctx, void *handle) { #include #include -void invalid_filesystems_syscall(void *sandbox_ctx, void *handle) { +void invalid_filesystems_syscall(void *sandbox_ctx, void *handle) +{ /* Disable filesystems syscall */ { void *args[2] = { sandbox_ctx, metacall_value_create_bool(0L) /* Kill */ }; @@ -149,7 +163,8 @@ void invalid_filesystems_syscall(void *sandbox_ctx, void *handle) { } int fd = open("/tmp/testfile", O_RDONLY); - if (fd == -1) { + if (fd == -1) + { perror("open"); exit(EXIT_FAILURE); } @@ -159,13 +174,15 @@ void invalid_filesystems_syscall(void *sandbox_ctx, void *handle) { #include -void invalid_time_syscall() { +void invalid_time_syscall() +{ sleep(1); } #include -void invalid_memory_syscall(void *sandbox_ctx, void *handle) { +void invalid_memory_syscall(void *sandbox_ctx, void *handle) +{ /* Disable memory syscall */ { void *args[2] = { sandbox_ctx, metacall_value_create_bool(0L) /* Kill */ }; @@ -179,8 +196,9 @@ void invalid_memory_syscall(void *sandbox_ctx, void *handle) { metacall_value_destroy(args[1]); } - void* addr = mmap(NULL, 4096, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0); - if (addr == MAP_FAILED) { + void *addr = mmap(NULL, 4096, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0); + if (addr == MAP_FAILED) + { perror("mmap"); exit(EXIT_FAILURE); } @@ -189,8 +207,10 @@ void invalid_memory_syscall(void *sandbox_ctx, void *handle) { #include -void invalid_signals_syscall() { - if (signal(SIGINT, SIG_IGN) == SIG_ERR) { +void invalid_signals_syscall() +{ + if (signal(SIGINT, SIG_IGN) == SIG_ERR) + { perror("signal"); exit(EXIT_FAILURE); }