// Copyright (c) 2010 The Chromium Authors. All rights reserved. // Use of this source code is governed by a BSD-style license that can be // found in the LICENSE file. #include "library.h" #include "sandbox_impl.h" #include "syscall_table.h" namespace playground { // Global variables int Sandbox::proc_self_maps_ = -1; enum Sandbox::SandboxStatus Sandbox::status_ = STATUS_UNKNOWN; int Sandbox::pid_; int Sandbox::processFdPub_; int Sandbox::cloneFdPub_; Sandbox::SysCalls::kernel_sigaction Sandbox::sa_segv_; Sandbox::ProtectedMap Sandbox::protectedMap_; std::vector Sandbox::secureMemPool_; bool Sandbox::sendFd(int transport, int fd0, int fd1, const void* buf, size_t len) { int fds[2], count = 0; if (fd0 >= 0) { fds[count++] = fd0; } if (fd1 >= 0) { fds[count++] = fd1; } if (!count) { return false; } char cmsg_buf[CMSG_SPACE(count*sizeof(int))]; memset(cmsg_buf, 0, sizeof(cmsg_buf)); struct SysCalls::kernel_iovec iov[2] = { { 0 } }; struct SysCalls::kernel_msghdr msg = { 0 }; int dummy = 0; iov[0].iov_base = &dummy; iov[0].iov_len = sizeof(dummy); if (buf && len > 0) { iov[1].iov_base = const_cast(buf); iov[1].iov_len = len; } msg.msg_iov = iov; msg.msg_iovlen = (buf && len > 0) ? 2 : 1; msg.msg_control = cmsg_buf; msg.msg_controllen = CMSG_LEN(count*sizeof(int)); struct cmsghdr *cmsg = CMSG_FIRSTHDR(&msg); cmsg->cmsg_level = SOL_SOCKET; cmsg->cmsg_type = SCM_RIGHTS; cmsg->cmsg_len = CMSG_LEN(count*sizeof(int)); memcpy(CMSG_DATA(cmsg), fds, count*sizeof(int)); SysCalls sys; return NOINTR_SYS(sys.sendmsg(transport, &msg, 0)) == (ssize_t)(sizeof(dummy) + ((buf && len > 0) ? len : 0)); } bool Sandbox::getFd(int transport, int* fd0, int* fd1, void* buf, size_t*len) { int count = 0; int *err = NULL; if (fd0) { count++; err = fd0; *fd0 = -1; } if (fd1) { if (!count++) { err = fd1; } *fd1 = -1; } if (!count) { return false; } char cmsg_buf[CMSG_SPACE(count*sizeof(int))]; memset(cmsg_buf, 0, sizeof(cmsg_buf)); struct SysCalls::kernel_iovec iov[2] = { { 0 } }; struct SysCalls::kernel_msghdr msg = { 0 }; iov[0].iov_base = err; iov[0].iov_len = sizeof(int); if (buf && len && *len > 0) { iov[1].iov_base = buf; iov[1].iov_len = *len; } msg.msg_iov = iov; msg.msg_iovlen = (buf && len && *len > 0) ? 2 : 1; msg.msg_control = cmsg_buf; msg.msg_controllen = CMSG_LEN(count*sizeof(int)); SysCalls sys; ssize_t bytes = NOINTR_SYS(sys.recvmsg(transport, &msg, 0)); if (len) { *len = bytes > (int)sizeof(int) ? bytes - sizeof(int) : 0; } if (bytes != (ssize_t)(sizeof(int) + ((buf && len && *len > 0) ? *len : 0))){ *err = bytes >= 0 ? 0 : -EBADF; return false; } if (*err) { // "err" is the first four bytes of the payload. If these are non-zero, // the sender on the other side of the socketpair sent us an errno value. // We don't expect to get any file handles in this case. return false; } struct cmsghdr *cmsg = CMSG_FIRSTHDR(&msg); if ((msg.msg_flags & (MSG_TRUNC|MSG_CTRUNC)) || !cmsg || cmsg->cmsg_level != SOL_SOCKET || cmsg->cmsg_type != SCM_RIGHTS || cmsg->cmsg_len != CMSG_LEN(count*sizeof(int))) { *err = -EBADF; return false; } if (fd1) { *fd1 = ((int *)CMSG_DATA(cmsg))[--count]; } if (fd0) { *fd0 = ((int *)CMSG_DATA(cmsg))[--count]; } return true; } void Sandbox::setupSignalHandlers() { // Set SIGCHLD to SIG_DFL so that waitpid() can work SysCalls sys; struct SysCalls::kernel_sigaction sa; memset(&sa, 0, sizeof(sa)); sa.sa_handler_ = SIG_DFL; sys.sigaction(SIGCHLD, &sa, NULL); // Set up SEGV handler for dealing with RDTSC instructions, system calls // that have been rewritten to use INT0, for sigprocmask() emulation, for // the creation of threads, and for user-provided SEGV handlers. sa.sa_sigaction_ = segv(); sa.sa_flags = SA_SIGINFO | SA_NODEFER; sys.sigaction(SIGSEGV, &sa, &sa_segv_); // Unblock SIGSEGV and SIGCHLD SysCalls::kernel_sigset_t mask; memset(&mask, 0x00, sizeof(mask)); mask.sig[0] |= (1 << (SIGSEGV - 1)) | (1 << (SIGCHLD - 1)); sys.sigprocmask(SIG_UNBLOCK, &mask, 0); } void (*Sandbox::segv())(int signo, SysCalls::siginfo *context, void *unused) { void (*fnc)(int signo, SysCalls::siginfo *context, void *unused); asm volatile( "call 999f\n" #if defined(__x86_64__) // Inspect instruction at the point where the segmentation fault // happened. If it is RDTSC, forward the request to the trusted // thread. "mov $-3, %%r14\n" // request for RDTSC "mov 0xB0(%%rsp), %%r15\n" // %rip at time of segmentation fault "cmpw $0x310F, (%%r15)\n" // RDTSC "jz 0f\n" "cmpw $0x010F, (%%r15)\n" // RDTSCP "jnz 8f\n" "cmpb $0xF9, 2(%%r15)\n" "jnz 8f\n" "mov $-4, %%r14\n" // request for RDTSCP "0:" #ifndef NDEBUG "lea 100f(%%rip), %%rdi\n" "call playground$debugMessage\n" #endif "sub $4, %%rsp\n" "push %%r14\n" "mov %%gs:16, %%edi\n" // fd = threadFdPub "mov %%rsp, %%rsi\n" // buf = %rsp "mov $4, %%edx\n" // len = sizeof(int) "1:mov $1, %%eax\n" // NR_write "syscall\n" "cmp %%rax, %%rdx\n" "jz 5f\n" "cmp $-4, %%eax\n" // EINTR "jz 1b\n" "2:add $12, %%rsp\n" "movq $0, 0x98(%%rsp)\n" // %rax at time of segmentation fault "movq $0, 0x90(%%rsp)\n" // %rdx at time of segmentation fault "cmpw $0x310F, (%%r15)\n" // RDTSC "jz 3f\n" "movq $0, 0xA0(%%rsp)\n" // %rcx at time of segmentation fault "3:addq $2, 0xB0(%%rsp)\n" // %rip at time of segmentation fault "cmpw $0x010F, (%%r15)\n" // RDTSC "jnz 4f\n" "addq $1, 0xB0(%%rsp)\n" // %rip at time of segmentation fault "4:ret\n" "5:mov $12, %%edx\n" // len = 3*sizeof(int) "6:mov $0, %%eax\n" // NR_read "syscall\n" "cmp $-4, %%eax\n" // EINTR "jz 6b\n" "cmp %%rax, %%rdx\n" "jnz 2b\n" "mov 0(%%rsp), %%eax\n" "mov 4(%%rsp), %%edx\n" "mov 8(%%rsp), %%ecx\n" "add $12, %%rsp\n" "mov %%rdx, 0x90(%%rsp)\n" // %rdx at time of segmentation fault "cmpw $0x310F, (%%r15)\n" // RDTSC "jz 7f\n" "mov %%rcx, 0xA0(%%rsp)\n" // %rcx at time of segmentation fault "7:mov %%rax, 0x98(%%rsp)\n" // %rax at time of segmentation fault "jmp 3b\n" // If the instruction is INT 0, then this was probably the result // of playground::Library being unable to find a way to safely // rewrite the system call instruction. Retrieve the CPU register // at the time of the segmentation fault and invoke syscallWrapper(). "8:cmpw $0x00CD, (%%r15)\n" // INT $0x0 "jnz 16f\n" #ifndef NDEBUG "lea 200f(%%rip), %%rdi\n" "call playground$debugMessage\n" #endif "mov 0x98(%%rsp), %%rax\n" // %rax at time of segmentation fault "mov 0x70(%%rsp), %%rdi\n" // %rdi at time of segmentation fault "mov 0x78(%%rsp), %%rsi\n" // %rsi at time of segmentation fault "mov 0x90(%%rsp), %%rdx\n" // %rdx at time of segmentation fault "mov 0x40(%%rsp), %%r10\n" // %r10 at time of segmentation fault "mov 0x30(%%rsp), %%r8\n" // %r8 at time of segmentation fault "mov 0x38(%%rsp), %%r9\n" // %r9 at time of segmentation fault // Handle rt_sigprocmask() "cmp $14, %%rax\n" // NR_rt_sigprocmask "jnz 12f\n" "mov $-22, %%rax\n" // -EINVAL "cmp $8, %%r10\n" // %r10 = sigsetsize (8 bytes = 64 signals) "jl 7b\n" "mov 0x130(%%rsp), %%r10\n" // signal mask at time of segmentation fault "test %%rsi, %%rsi\n" // only set mask, if set is non-NULL "jz 11f\n" "mov 0(%%rsi), %%rsi\n" "cmp $0, %%rdi\n" // %rdi = how (SIG_BLOCK) "jnz 9f\n" "or %%rsi, 0x130(%%rsp)\n" // signal mask at time of segmentation fault "jmp 11f\n" "9:cmp $1, %%rdi\n" // %rdi = how (SIG_UNBLOCK) "jnz 10f\n" "xor $-1, %%rsi\n" "and %%rsi, 0x130(%%rsp)\n" // signal mask at time of segmentation fault "jmp 11f\n" "10:cmp $2, %%rdi\n" // %rdi = how (SIG_SETMASK) "jnz 7b\n" "mov %%rsi, 0x130(%%rsp)\n" // signal mask at time of segmentation fault "11:xor %%rax, %%rax\n" "test %%rdx, %%rdx\n" // only return old mask, if set is non-NULL "jz 7b\n" "mov %%r10, 0(%%rdx)\n" // old_set "jmp 7b\n" // Handle rt_sigreturn() "12:cmp $15, %%rax\n" // NR_rt_sigreturn "jnz 14f\n" "mov 0xA8(%%rsp), %%rsp\n" // %rsp at time of segmentation fault "13:syscall\n" // rt_sigreturn() is unrestricted "mov $66, %%edi\n" // rt_sigreturn() should never return "mov $231, %%eax\n" // NR_exit_group "jmp 13b\n" // Copy signal frame onto new stack. See clone.cc for details "14:cmp $56+0xF000, %%rax\n" // NR_clone + 0xF000 "jnz 15f\n" "lea 8(%%rsp), %%rax\n" // retain stack frame upon returning "mov %%rax, 0xA8(%%rsp)\n" // %rsp at time of segmentation fault "jmp 7b\n" // Forward system call to syscallWrapper() "15:lea 7b(%%rip), %%rcx\n" "push %%rcx\n" "push 0xB8(%%rsp)\n" // %rip at time of segmentation fault "lea playground$syscallWrapper(%%rip), %%rcx\n" "jmp *%%rcx\n" // In order to implement SA_NODEFER, we have to keep track of recursive // calls to SIGSEGV handlers. This means we have to increment a counter // before calling the user's signal handler, and decrement it on // leaving the user's signal handler. // Some signal handlers look at the return address of the signal // stack, and more importantly "gdb" uses the call to rt_sigreturn() // as a magic signature when doing stacktraces. So, we have to use // a little more unusual code to regain control after the user's // signal handler is done. We adjust the return address to point to // non-executable memory. And when we trigger another SEGV we pop the // extraneous signal frame and then call rt_sigreturn(). // N.B. We currently do not correctly adjust the SEGV counter, if the // user's signal handler exits in way other than by returning (e.g. by // directly calling rt_sigreturn(), or by calling siglongjmp()). "16:lea 22f(%%rip), %%r14\n" "cmp %%r14, %%r15\n" "jnz 17f\n" // check if returning from user's handler "decl %%gs:0x105C-0xE0\n" // decrement SEGV recursion counter "mov 0xA8(%%rsp), %%rsp\n" // %rsp at time of segmentation fault "mov $0xF, %%eax\n" // NR_rt_sigreturn "syscall\n" // This was a genuine segmentation fault. Check Sandbox::sa_segv_ for // what we are supposed to do. "17:mov playground$sa_segv@GOTPCREL(%%rip), %%rax\n" "cmp $0, 0(%%rax)\n" // SIG_DFL "jz 18f\n" "cmp $1, 0(%%rax)\n" // SIG_IGN "jnz 19f\n" // can't really ignore synchronous signals // Trigger the kernel's default signal disposition. The only way we can // do this from seccomp mode is by blocking the signal and retriggering // it. "18:orb $4, 0x131(%%rsp)\n" // signal mask at time of segmentation fault "ret\n" // Check sa_flags: // - We can ignore SA_NOCLDSTOP, SA_NOCLDWAIT, and SA_RESTART as they // do not have any effect for SIGSEGV. // - On x86-64, we can also ignore SA_SIGINFO, as the calling // conventions for sa_handler() are a subset of the conventions for // sa_sigaction(). // - We have to always register our signal handler with SA_NODEFER so // that the user's signal handler can make system calls which might // require additional help from our SEGV handler. // - If the user's signal handler wasn't supposed to be SA_NODEFER, then // we emulate this behavior by keeping track of a recursion counter. // // TODO(markus): If/when we add support for sigaltstack(), we have to // handle SA_ONSTACK. "19:cmpl $0, %%gs:0x105C-0xE0\n"// check if we failed inside of SEGV handler "jnz 18b\n" // if so, then terminate program "mov 0(%%rax), %%rbx\n" // sa_segv_.sa_sigaction "mov 8(%%rax), %%rcx\n" // sa_segv_.sa_flags "btl $31, %%ecx\n" // SA_RESETHAND "jnc 20f\n" "movq $0, 0(%%rax)\n" // set handler to SIG_DFL "20:btl $30, %%ecx\n" // SA_NODEFER "jc 21f\n" "mov %%r14, 0(%%rsp)\n" // trigger a SEGV on return, so that we can "incl %%gs:0x105C-0xE0\n" // clean up state; incr. recursion counter "21:jmp *%%rbx\n" // call user's signal handler // Non-executable version of the restorer function. We use this to // trigger a SEGV upon returning from the user's signal handler, giving // us an ability to clean up prior to returning from the SEGV handler. ".pushsection .data\n" // move code into non-executable section "22:mov $0xF, %%rax\n" // gdb looks for this signature when doing "syscall\n" // backtraces ".popsection\n" #elif defined(__i386__) // Inspect instruction at the point where the segmentation fault // happened. If it is RDTSC, forward the request to the trusted // thread. "mov $-3, %%ebx\n" // request for RDTSC "mov 0xDC(%%esp), %%ebp\n" // %eip at time of segmentation fault "cmpw $0x310F, (%%ebp)\n" // RDTSC "jz 0f\n" "cmpw $0x010F, (%%ebp)\n" // RDTSCP "jnz 9f\n" "cmpb $0xF9, 2(%%ebp)\n" "jnz 9f\n" "mov $-4, %%ebx\n" // request for RDTSCP "0:" #ifndef NDEBUG "lea 100f, %%eax\n" "push %%eax\n" "call playground$debugMessage\n" "sub $4, %%esp\n" #else "sub $8, %%esp\n" // allocate buffer for receiving timestamp #endif "push %%ebx\n" "mov %%fs:16, %%ebx\n" // fd = threadFdPub "mov %%esp, %%ecx\n" // buf = %esp "mov $4, %%edx\n" // len = sizeof(int) "1:mov %%edx, %%eax\n" // NR_write "int $0x80\n" "cmp %%eax, %%edx\n" "jz 7f\n" "cmp $-4, %%eax\n" // EINTR "jz 1b\n" "2:add $12, %%esp\n" // remove temporary buffer from stack "xor %%eax, %%eax\n" "movl $0, 0xC8(%%esp)\n" // %edx at time of segmentation fault "cmpw $0x310F, (%%ebp)\n" // RDTSC "jz 3f\n" "movl $0, 0xCC(%%esp)\n" // %ecx at time of segmentation fault "3:mov %%eax, 0xD0(%%esp)\n" // %eax at time of segmentation fault "4:mov 0xDC(%%esp), %%ebp\n" // %eip at time of segmentation fault "addl $2, 0xDC(%%esp)\n" // %eip at time of segmentation fault "cmpw $0x010F, (%%ebp)\n" // RDTSCP "jnz 5f\n" "addl $1, 0xDC(%%esp)\n" // %eip at time of segmentation fault "5:sub $0x1C8, %%esp\n" // a legacy signal stack is much larger "mov 0x1CC(%%esp), %%eax\n" // push signal number "push %%eax\n" "lea 0x270(%%esp), %%esi\n" // copy siginfo register values "lea 0x4(%%esp), %%edi\n" // into new location "mov $22, %%ecx\n" "cld\n" "rep movsl\n" "mov 0x2C8(%%esp), %%ebx\n" // copy first half of signal mask "mov %%ebx, 0x54(%%esp)\n" "lea 6f, %%esi\n" // copy "magic" restorer function "push %%esi\n" // push restorer function "lea 0x2D4(%%esp), %%edi\n" // patch up retcode magic numbers "movb $2, %%cl\n" "rep movsl\n" "ret\n" // return to restorer function // The restorer function is sometimes used by gdb as a magic marker to // recognize signal stack frames. Don't change any of the next three // instructions. "6:pop %%eax\n" // remove dummy argument (signo) "mov $119, %%eax\n" // NR_sigreturn "int $0x80\n" "7:mov $12, %%edx\n" // len = 3*sizeof(int) "8:mov $3, %%eax\n" // NR_read "int $0x80\n" "cmp $-4, %%eax\n" // EINTR "jz 8b\n" "cmp %%eax, %%edx\n" "jnz 2b\n" "pop %%eax\n" "pop %%edx\n" "pop %%ecx\n" "mov %%edx, 0xC8(%%esp)\n" // %edx at time of segmentation fault "cmpw $0x310F, (%%ebp)\n" // RDTSC "jz 3b\n" "mov %%ecx, 0xCC(%%esp)\n" // %ecx at time of segmentation fault "jmp 3b\n" // If the instruction is INT 0, then this was probably the result // of playground::Library being unable to find a way to safely // rewrite the system call instruction. Retrieve the CPU register // at the time of the segmentation fault and invoke syscallWrapper(). "9:cmpw $0x00CD, (%%ebp)\n" // INT $0x0 "jnz 20f\n" #ifndef NDEBUG "lea 200f, %%eax\n" "push %%eax\n" "call playground$debugMessage\n" "add $0x4, %%esp\n" #endif "mov 0xD0(%%esp), %%eax\n" // %eax at time of segmentation fault "mov 0xC4(%%esp), %%ebx\n" // %ebx at time of segmentation fault "mov 0xCC(%%esp), %%ecx\n" // %ecx at time of segmentation fault "mov 0xC8(%%esp), %%edx\n" // %edx at time of segmentation fault "mov 0xB8(%%esp), %%esi\n" // %esi at time of segmentation fault "mov 0xB4(%%esp), %%edi\n" // %edi at time of segmentation fault "mov 0xB2(%%esp), %%ebp\n" // %ebp at time of segmentation fault // Handle sigprocmask() and rt_sigprocmask() "cmp $175, %%eax\n" // NR_rt_sigprocmask "jnz 10f\n" "mov $-22, %%eax\n" // -EINVAL "cmp $8, %%esi\n" // %esi = sigsetsize (8 bytes = 64 signals) "jl 3b\n" "jmp 11f\n" "10:cmp $126, %%eax\n" // NR_sigprocmask "jnz 15f\n" "mov $-22, %%eax\n" "11:mov 0xFC(%%esp), %%edi\n" // signal mask at time of segmentation fault "mov 0x100(%%esp), %%ebp\n" "test %%ecx, %%ecx\n" // only set mask, if set is non-NULL "jz 14f\n" "mov 0(%%ecx), %%esi\n" "mov 4(%%ecx), %%ecx\n" "cmp $0, %%ebx\n" // %ebx = how (SIG_BLOCK) "jnz 12f\n" "or %%esi, 0xFC(%%esp)\n" // signal mask at time of segmentation fault "or %%ecx, 0x100(%%esp)\n" "jmp 14f\n" "12:cmp $1, %%ebx\n" // %ebx = how (SIG_UNBLOCK) "jnz 13f\n" "xor $-1, %%esi\n" "xor $-1, %%ecx\n" "and %%esi, 0xFC(%%esp)\n" // signal mask at time of segmentation fault "and %%ecx, 0x100(%%esp)\n" "jmp 14f\n" "13:cmp $2, %%ebx\n" // %ebx = how (SIG_SETMASK) "jnz 3b\n" "mov %%esi, 0xFC(%%esp)\n" // signal mask at time of segmentation fault "mov %%ecx, 0x100(%%esp)\n" "14:xor %%eax, %%eax\n" "test %%edx, %%edx\n" // only return old mask, if set is non-NULL "jz 3b\n" "mov %%edi, 0(%%edx)\n" // old_set "mov %%ebp, 4(%%edx)\n" "jmp 3b\n" // Handle sigreturn() and rt_sigreturn() // See syscall.cc for a discussion on how we can emulate rt_sigreturn() // by calling sigreturn() with a suitably adjusted stack. "15:cmp $119, %%eax\n" // NR_sigreturn "jnz 17f\n" "mov 0xC0(%%esp), %%esp\n" // %esp at time of segmentation fault "16:int $0x80\n" // sigreturn() is unrestricted "17:cmp $173, %%eax\n" // NR_rt_sigreturn "jnz 18f\n" "mov 0xC0(%%esp), %%esp\n" // %esp at time of segmentation fault "sub $4, %%esp\n" // add fake return address "jmp 4b\n" // Copy signal frame onto new stack. In the process, we have to convert // it from an RT signal frame to a legacy signal frame. // See clone.cc for details "18:cmp $120+0xF000, %%eax\n" // NR_clone + 0xF000 "jnz 19f\n" "lea -0x1C8(%%esp), %%eax\n"// retain stack frame upon returning "mov %%eax, 0xC0(%%esp)\n" // %esp at time of segmentation fault "jmp 3b\n" // Forward system call to syscallWrapper() "19:call playground$syscallWrapper\n" "jmp 3b\n" // In order to implement SA_NODEFER, we have to keep track of recursive // calls to SIGSEGV handlers. This means we have to increment a counter // before calling the user's signal handler, and decrement it on // leaving the user's signal handler. // Some signal handlers look at the return address of the signal // stack, and more importantly "gdb" uses the call to {,rt_}sigreturn() // as a magic signature when doing stacktraces. So, we have to use // a little more unusual code to regain control after the user's // signal handler is done. We adjust the return address to point to // non-executable memory. And when we trigger another SEGV we pop the // extraneous signal frame and then call sigreturn(). // N.B. We currently do not correctly adjust the SEGV counter, if the // user's signal handler exits in way other than by returning (e.g. by // directly calling {,rt_}sigreturn(), or by calling siglongjmp()). "20:lea 30f, %%edi\n" // rt-style restorer function "lea 31f, %%esi\n" // legacy restorer function "cmp %%ebp, %%edi\n" // check if returning from user's handler "jnz 21f\n" "decl %%fs:0x1040-0x58\n" // decrement SEGV recursion counter "mov 0xC0(%%esp), %%esp\n" // %esp at time of segmentation fault "jmp 29f\n" "21:cmp %%ebp, %%esi\n" // check if returning from user's handler "jnz 22f\n" "decl %%fs:0x1040-0x58\n" // decrement SEGV recursion counter "mov 0xC0(%%esp), %%esp\n" // %esp at time of segmentation fault "jmp 6b\n" // This was a genuine segmentation fault. Check Sandbox::sa_segv_ for // what we are supposed to do. "22:lea playground$sa_segv, %%eax\n" "cmp $0, 0(%%eax)\n" // SIG_DFL "jz 23f\n" "cmp $1, 0(%%eax)\n" // SIG_IGN "jnz 24f\n" // can't really ignore synchronous signals // Trigger the kernel's default signal disposition. The only way we can // do this from seccomp mode is by blocking the signal and retriggering // it. "23:orb $4, 0xFD(%%esp)\n" // signal mask at time of segmentation fault "jmp 5b\n" // Check sa_flags: // - We can ignore SA_NOCLDSTOP, SA_NOCLDWAIT, and SA_RESTART as they // do not have any effect for SIGSEGV. // - We have to always register our signal handler with SA_NODEFER so // that the user's signal handler can make system calls which might // require additional help from our SEGV handler. // - If the user's signal handler wasn't supposed to be SA_NODEFER, then // we emulate this behavior by keeping track of a recursion counter. // // TODO(markus): If/when we add support for sigaltstack(), we have to // handle SA_ONSTACK. "24:cmpl $0, %%fs:0x1040-0x58\n"// check if we failed inside of SEGV handler "jnz 23b\n" // if so, then terminate program "mov 0(%%eax), %%ebx\n" // sa_segv_.sa_sigaction "mov 4(%%eax), %%ecx\n" // sa_segv_.sa_flags "btl $31, %%ecx\n" // SA_RESETHAND "jnc 25f\n" "movl $0, 0(%%eax)\n" // set handler to SIG_DFL "25:btl $30, %%ecx\n" // SA_NODEFER "jc 28f\n" "btl $2, %%ecx\n" // SA_SIGINFO "jnc 26f\n" "mov %%edi, 0(%%esp)\n" // trigger a SEGV on return "incl %%fs:0x1040-0x58\n" // increment recursion counter "jmp *%%ebx\n" // call user's signal handler "26:mov %%esi, 0(%%esp)\n" "incl %%fs:0x1040-0x58\n" // increment recursion counter // We always register the signal handler to give us rt-style signal // frames. But if the user asked for legacy signal frames, we must // convert the signal frame prior to calling the user's signal handler. "27:sub $0x1C8, %%esp\n" // a legacy signal stack is much larger "mov 0x1CC(%%esp), %%eax\n" // push signal number "push %%eax\n" "mov 0x1CC(%%esp), %%eax\n" // push restorer function "push %%eax\n" "lea 0x274(%%esp), %%esi\n" // copy siginfo register values "lea 0x8(%%esp), %%edi\n" // into new location "mov $22, %%ecx\n" "cld\n" "rep movsl\n" "mov 0x2CC(%%esp), %%eax\n" // copy first half of signal mask "mov %%eax, 0x58(%%esp)\n" "lea 31f, %%esi\n" "lea 0x2D4(%%esp), %%edi\n" // patch up retcode magic numbers "movb $2, %%cl\n" "rep movsl\n" "jmp *%%ebx\n" // call user's signal handler "28:lea 6b, %%eax\n" // set appropriate restorer function "mov %%eax, 0(%%esp)\n" "btl $2, %%ecx\n" // SA_SIGINFO "jnc 27b\n" "lea 29f, %%eax\n" "mov %%eax, 0(%%esp)\n" // set appropriate restorer function "jmp *%%ebx\n" // call user's signal handler "29:pushl $30f\n" // emulate rt_sigreturn() "jmp 5b\n" // Non-executable versions of the restorer function. We use these to // trigger a SEGV upon returning from the user's signal handler, giving // us an ability to clean up prior to returning from the SEGV handler. ".pushsection .data\n" // move code into non-executable section "30:mov $173, %%eax\n" // NR_rt_sigreturn "int $0x80\n" // gdb looks for this signature when doing ".byte 0\n" // backtraces "31:pop %%eax\n" "mov $119, %%eax\n" // NR_sigreturn "int $0x80\n" ".popsection\n" #else #error Unsupported target platform #endif ".pushsection \".rodata\"\n" #ifndef NDEBUG "100:.asciz \"RDTSC(P): Executing handler\\n\"\n" "200:.asciz \"INT $0x0: Executing handler\\n\"\n" #endif ".popsection\n" "999:pop %0\n" : "=g"(fnc) : : "memory" #if defined(__x86_64__) , "rsp" #elif defined(__i386__) , "esp" #endif ); return fnc; } SecureMem::Args* Sandbox::getSecureMem() { // Check trusted_thread.cc for the magic offset that gets us from the TLS // to the beginning of the secure memory area. SecureMem::Args* ret; #if defined(__x86_64__) asm volatile( "movq %%gs:-0xE0, %0\n" : "=q"(ret)); #elif defined(__i386__) asm volatile( "movl %%fs:-0x58, %0\n" : "=r"(ret)); #else #error Unsupported target platform #endif return ret; } void Sandbox::snapshotMemoryMappings(int processFd, int proc_self_maps) { SysCalls sys; if (sys.lseek(proc_self_maps, 0, SEEK_SET) || !sendFd(processFd, proc_self_maps, -1, NULL, 0)) { failure: die("Cannot access /proc/self/maps"); } int dummy; if (read(sys, processFd, &dummy, sizeof(dummy)) != sizeof(dummy)) { goto failure; } } int Sandbox::supportsSeccompSandbox(int proc_fd) { if (status_ != STATUS_UNKNOWN) { return status_ != STATUS_UNSUPPORTED; } int fds[2]; SysCalls sys; if (sys.pipe(fds)) { status_ = STATUS_UNSUPPORTED; return 0; } pid_t pid; switch ((pid = sys.fork())) { case -1: status_ = STATUS_UNSUPPORTED; return 0; case 0: { int devnull = sys.open("/dev/null", O_RDWR, 0); if (devnull >= 0) { sys.dup2(devnull, 0); sys.dup2(devnull, 1); sys.dup2(devnull, 2); sys.close(devnull); } if (proc_fd >= 0) { setProcSelfMaps(sys.openat(proc_fd, "self/maps", O_RDONLY, 0)); } startSandbox(); write(sys, fds[1], "", 1); // Try to tell the trusted thread to shut down the entire process in an // orderly fashion defaultSystemCallHandler(__NR_exit_group, 0, 0, 0, 0, 0, 0); // If that did not work (e.g. because the kernel does not know about the // exit_group() system call), make a direct _exit() system call instead. // This system call is unrestricted in seccomp mode, so it will always // succeed. Normally, we don't like it, because unlike exit_group() it // does not terminate any other thread. But since we know that // exit_group() exists in all kernels which support kernel-level threads, // this is OK we only get here for old kernels where _exit() is OK. sys._exit(0); } default: NOINTR_SYS(sys.close(fds[1])); char ch; if (read(sys, fds[0], &ch, 1) != 1) { status_ = STATUS_UNSUPPORTED; } else { status_ = STATUS_AVAILABLE; } int rc; NOINTR_SYS(sys.waitpid(pid, &rc, 0)); NOINTR_SYS(sys.close(fds[0])); return status_ != STATUS_UNSUPPORTED; } } void Sandbox::setProcSelfMaps(int proc_self_maps) { proc_self_maps_ = proc_self_maps; } void Sandbox::startSandbox() { if (status_ == STATUS_UNSUPPORTED) { die("The seccomp sandbox is not supported on this computer"); } else if (status_ == STATUS_ENABLED) { return; } SysCalls sys; if (proc_self_maps_ < 0) { proc_self_maps_ = sys.open("/proc/self/maps", O_RDONLY, 0); if (proc_self_maps_ < 0) { die("Cannot access \"/proc/self/maps\""); } } // The pid is unchanged for the entire program, so we can retrieve it once // and store it in a global variable. pid_ = sys.getpid(); // Block all signals, except for the RDTSC handler setupSignalHandlers(); // Get socketpairs for talking to the trusted process int pair[4]; if (sys.socketpair(AF_UNIX, SOCK_STREAM, 0, pair) || sys.socketpair(AF_UNIX, SOCK_STREAM, 0, pair+2)) { die("Failed to create trusted thread"); } processFdPub_ = pair[0]; cloneFdPub_ = pair[2]; SecureMemArgs* secureMem = createTrustedProcess(pair[0], pair[1], pair[2], pair[3]); // We find all libraries that have system calls and redirect the system // calls to the sandbox. If we miss any system calls, the application will be // terminated by the kernel's seccomp code. So, from a security point of // view, if this code fails to identify system calls, we are still behaving // correctly. { Maps maps(proc_self_maps_); const char *libs[] = { "ld", "libc", "librt", "libpthread", NULL }; // Intercept system calls in the VDSO segment (if any). This has to happen // before intercepting system calls in any of the other libraries, as // the main kernel entry point might be inside of the VDSO and we need to // determine its address before we can compare it to jumps from inside // other libraries. for (Maps::const_iterator iter = maps.begin(); iter != maps.end(); ++iter){ Library* library = *iter; if (library->isVDSO() && library->parseElf()) { library->makeWritable(true); library->patchSystemCalls(); library->makeWritable(false); break; } } // Intercept system calls in libraries that are known to have them. for (Maps::const_iterator iter = maps.begin(); iter != maps.end(); ++iter){ Library* library = *iter; const char* mapping = iter.name().c_str(); // Find the actual base name of the mapped library by skipping past any // SPC and forward-slashes. We don't want to accidentally find matches, // because the directory name included part of our well-known lib names. // // Typically, prior to pruning, entries would look something like this: // 08:01 2289011 /lib/libc-2.7.so for (const char *delim = " /"; *delim; ++delim) { const char* skip = strrchr(mapping, *delim); if (skip) { mapping = skip + 1; } } for (const char **ptr = libs; *ptr; ptr++) { const char *name = strstr(mapping, *ptr); if (name == mapping) { char ch = name[strlen(*ptr)]; if (ch < 'A' || (ch > 'Z' && ch < 'a') || ch > 'z') { if (library->parseElf()) { library->makeWritable(true); library->patchSystemCalls(); library->makeWritable(false); break; } } } } } } // Take a snapshot of the current memory mappings. These mappings will be // off-limits to all future mmap(), munmap(), mremap(), and mprotect() calls. snapshotMemoryMappings(processFdPub_, proc_self_maps_); NOINTR_SYS(sys.close(proc_self_maps_)); proc_self_maps_ = -1; // Creating the trusted thread enables sandboxing createTrustedThread(processFdPub_, cloneFdPub_, secureMem); // We can no longer check for sandboxing support at this point, but we also // know for a fact that it is available (as we just turned it on). So update // the status to reflect this information. status_ = STATUS_ENABLED; } } // namespace