forked from WHC/Hermit
WHC
8efd63bb31
- Child installs a seccomp filter with a listener; a supervisor thread resolves the path of write-type syscalls (cwd, dirfd, .., symlinks, /proc/self, /dev/stdout, both ends of rename/link) and answers CONTINUE or EACCES; IPv4/IPv6 sockets are refused - Probe order Landlock -> seccomp -> none, checked in a throwaway child; CST_SANDBOX=landlock|seccomp|off - curl connect failures count as sandbox refusals - test_sandbox runs the detected sandbox and forced seccomp, with escape, symlink, rename, link, chmod, stdout, ENOENT, background and network cases - Docs: platform matrix, limits (not a security boundary, Yama and background jobs)
344 lines
11 KiB
C
344 lines
11 KiB
C
#ifndef _GNU_SOURCE
|
|
#define _GNU_SOURCE
|
|
#endif
|
|
|
|
#include "cst_perms.h"
|
|
#include "cst_sandbox.h"
|
|
|
|
#include <stdio.h>
|
|
#include <stdlib.h>
|
|
#include <string.h>
|
|
|
|
#define CHECK(c) \
|
|
do { \
|
|
if (!(c)) { \
|
|
fprintf(stderr, "%s:%d: CHECK(%s) failed\n", __FILE__, __LINE__, #c); \
|
|
exit(1); \
|
|
} \
|
|
} while (0)
|
|
|
|
static void test_rules(void) {
|
|
static const char *const SAFE[] = {
|
|
"ls -la",
|
|
"cat README.md | head -n 20",
|
|
"git status && git diff --stat",
|
|
"grep -rn TODO src || true",
|
|
"find . -name '*.c' | wc -l",
|
|
"rg foo src 2>&1 | head",
|
|
"echo hi >/dev/null",
|
|
"pwd; which cc",
|
|
"git log --oneline -5",
|
|
"tree -L 2",
|
|
};
|
|
static const char *const UNSAFE[] = {
|
|
"rm -rf build",
|
|
"echo hi > out.txt",
|
|
"cat a >> b",
|
|
"ls $(pwd)",
|
|
"ls `pwd`",
|
|
"diff <(ls a) <(ls b)",
|
|
"sudo ls",
|
|
"find . -name x -delete",
|
|
"find . -exec rm {} ;",
|
|
"git push",
|
|
"git commit -m x",
|
|
"make",
|
|
"curl https://example.com",
|
|
"ls && rm x",
|
|
"echo ok | sh",
|
|
"",
|
|
"tee out.txt",
|
|
"git branch -D main",
|
|
};
|
|
for (size_t i = 0; i < sizeof(SAFE) / sizeof(SAFE[0]); i++) {
|
|
if (!cst_shell_is_safe(SAFE[i]))
|
|
fprintf(stderr, "expected safe: %s\n", SAFE[i]);
|
|
CHECK(cst_shell_is_safe(SAFE[i]));
|
|
}
|
|
for (size_t i = 0; i < sizeof(UNSAFE) / sizeof(UNSAFE[0]); i++) {
|
|
if (cst_shell_is_safe(UNSAFE[i]))
|
|
fprintf(stderr, "expected unsafe: %s\n", UNSAFE[i]);
|
|
CHECK(!cst_shell_is_safe(UNSAFE[i]));
|
|
}
|
|
}
|
|
|
|
static void test_blocked(void) {
|
|
const char *a = "sh: 1: cannot create /etc/x: Permission denied\n";
|
|
CHECK(cst_sandbox_blocked(a, strlen(a), 2));
|
|
CHECK(!cst_sandbox_blocked(a, strlen(a), 0));
|
|
const char *b = "error: no such file\n";
|
|
CHECK(!cst_sandbox_blocked(b, strlen(b), 1));
|
|
const char *c = "touch: cannot touch 'x': Read-only file system\n";
|
|
CHECK(cst_sandbox_blocked(c, strlen(c), 1));
|
|
const char *d = "curl: (7) Failed to connect to example.com port 443 after 9 "
|
|
"ms: Could not connect to server\n";
|
|
CHECK(cst_sandbox_blocked(d, strlen(d), 7));
|
|
}
|
|
|
|
#if !defined(_WIN32)
|
|
#include <arpa/inet.h>
|
|
#include <errno.h>
|
|
#include <netinet/in.h>
|
|
#include <sys/socket.h>
|
|
#include <sys/stat.h>
|
|
#include <sys/wait.h>
|
|
#include <unistd.h>
|
|
|
|
static int exists(const char *p) {
|
|
struct stat st;
|
|
return stat(p, &st) == 0;
|
|
}
|
|
|
|
static int run(const char *ws, const char *cmd, os_run_result_t *r) {
|
|
memset(r, 0, sizeof(*r));
|
|
CHECK(cst_sandbox_run_shell(ws, cmd, 0, r) == 0);
|
|
return r->exit_code;
|
|
}
|
|
|
|
/* Child: enter the sandbox, then try a TCP connect to a local listener. */
|
|
static void test_network(const char *ws) {
|
|
int ls = socket(AF_INET, SOCK_STREAM, 0);
|
|
CHECK(ls >= 0);
|
|
struct sockaddr_in a;
|
|
memset(&a, 0, sizeof(a));
|
|
a.sin_family = AF_INET;
|
|
a.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
|
|
CHECK(bind(ls, (struct sockaddr *)&a, sizeof(a)) == 0);
|
|
CHECK(listen(ls, 1) == 0);
|
|
socklen_t al = sizeof(a);
|
|
CHECK(getsockname(ls, (struct sockaddr *)&a, &al) == 0);
|
|
|
|
cst_sandbox_plan_t plan;
|
|
CHECK(cst_sandbox_prepare(ws, NULL, &plan) == 0);
|
|
pid_t pid = fork();
|
|
CHECK(pid >= 0);
|
|
if (pid == 0) {
|
|
if (cst_sandbox_enter(&plan) != 0)
|
|
_exit(3);
|
|
/* Landlock refuses the connect, seccomp already the socket */
|
|
int s = socket(AF_INET, SOCK_STREAM, 0);
|
|
if (s < 0)
|
|
_exit(errno == EACCES ? 0 : 2);
|
|
int rc = connect(s, (struct sockaddr *)&a, sizeof(a));
|
|
_exit(rc == 0 ? 1 : errno == EACCES ? 0 : 2);
|
|
}
|
|
int st = 0;
|
|
waitpid(pid, &st, 0);
|
|
cst_sandbox_release(&plan);
|
|
close(ls);
|
|
CHECK(WIFEXITED(st) && WEXITSTATUS(st) == 0);
|
|
}
|
|
|
|
static int blocked(const os_run_result_t *r) {
|
|
if (!cst_sandbox_blocked(r->out, r->out_len, r->exit_code)) {
|
|
fprintf(stderr, "expected a sandbox refusal (exit %d): %s\n", r->exit_code,
|
|
r->out ? r->out : "");
|
|
return 0;
|
|
}
|
|
return 1;
|
|
}
|
|
|
|
static char *slurp(const char *path) {
|
|
FILE *fp = fopen(path, "r");
|
|
if (!fp)
|
|
return NULL;
|
|
static char buf[256];
|
|
size_t n = fread(buf, 1, sizeof(buf) - 1, fp);
|
|
buf[n] = 0;
|
|
fclose(fp);
|
|
return buf;
|
|
}
|
|
|
|
/* Path tricks the seccomp supervisor has to resolve itself. */
|
|
static void test_seccomp_paths(const char *ws, const char *out) {
|
|
char cmd[3 * OS_PATH_MAX], p[OS_PATH_MAX + 64], q[OS_PATH_MAX + 64];
|
|
char readme[OS_PATH_MAX + 64];
|
|
os_run_result_t r;
|
|
snprintf(readme, sizeof(readme), "%s/readme.txt", out);
|
|
|
|
/* ../ out of the workspace */
|
|
const char *outname = strrchr(out, '/') + 1;
|
|
snprintf(cmd, sizeof(cmd), "echo x > '../%s/e1'", outname);
|
|
snprintf(p, sizeof(p), "%s/e1", out);
|
|
CHECK(run(ws, cmd, &r) != 0 && blocked(&r) && !exists(p));
|
|
os_run_result_free(&r);
|
|
|
|
/* a symlink inside may be created, but not written through */
|
|
snprintf(cmd, sizeof(cmd), "ln -s '%s' link && echo x > link/e2", out);
|
|
snprintf(p, sizeof(p), "%s/e2", out);
|
|
snprintf(q, sizeof(q), "%s/link", ws);
|
|
CHECK(run(ws, cmd, &r) != 0 && blocked(&r) && !exists(p));
|
|
struct stat st;
|
|
CHECK(lstat(q, &st) == 0 && S_ISLNK(st.st_mode));
|
|
os_run_result_free(&r);
|
|
snprintf(cmd, sizeof(cmd), "ln -s '%s' rl && echo x >> rl", readme);
|
|
CHECK(run(ws, cmd, &r) != 0 && blocked(&r));
|
|
CHECK(strcmp(slurp(readme), "outside-content\n") == 0);
|
|
os_run_result_free(&r);
|
|
|
|
/* moving, hard-linking or chmod-ing an outside file */
|
|
snprintf(cmd, sizeof(cmd), "mv '%s' ./moved", readme);
|
|
CHECK(run(ws, cmd, &r) != 0 && blocked(&r) && exists(readme));
|
|
os_run_result_free(&r);
|
|
snprintf(cmd, sizeof(cmd), "ln '%s' hard", readme);
|
|
snprintf(p, sizeof(p), "%s/hard", ws);
|
|
CHECK(run(ws, cmd, &r) != 0 && blocked(&r) && !exists(p));
|
|
os_run_result_free(&r);
|
|
snprintf(cmd, sizeof(cmd), "chmod 600 '%s'", readme);
|
|
CHECK(run(ws, cmd, &r) != 0 && blocked(&r));
|
|
os_run_result_free(&r);
|
|
|
|
/* the command's own stdout/stderr */
|
|
CHECK(run(ws, "echo hi > /dev/stdout && echo e > /dev/stderr && "
|
|
"echo fd > /proc/self/fd/1",
|
|
&r) == 0);
|
|
CHECK(strstr(r.out, "hi") && strstr(r.out, "fd"));
|
|
os_run_result_free(&r);
|
|
|
|
/* ordinary tree work inside */
|
|
CHECK(run(ws, "mkdir -p a/b/c && touch a/b/c/f && mv a/b/c/f a/g && "
|
|
"ln -s g a/s && chmod 600 a/g && rm -r a",
|
|
&r) == 0);
|
|
os_run_result_free(&r);
|
|
|
|
/* a missing parent stays ENOENT, not a sandbox refusal */
|
|
CHECK(run(ws, "touch nodir/x", &r) != 0);
|
|
CHECK(!cst_sandbox_blocked(r.out, r.out_len, r.exit_code));
|
|
os_run_result_free(&r);
|
|
|
|
/* many checked writes */
|
|
double t0 = os_now_ms();
|
|
CHECK(run(ws, "i=0; while [ $i -lt 300 ]; do echo $i > f$i; "
|
|
"i=$((i+1)); done; ls | grep -c '^f[0-9]'",
|
|
&r) == 0);
|
|
CHECK(strstr(r.out, "300") != NULL);
|
|
printf("test_sandbox: 300 checked writes in %.0f ms\n", os_now_ms() - t0);
|
|
os_run_result_free(&r);
|
|
|
|
/* background jobs: one still holding the pipe is served (unless Yama
|
|
* hides the orphaned job's memory from the supervisor), one detached
|
|
* does not hang the run */
|
|
snprintf(p, sizeof(p), "%s/bg.txt", ws);
|
|
CHECK(run(ws, "(sleep 0.2; echo late > bg.txt) & echo started", &r) == 0);
|
|
FILE *yf = fopen("/proc/sys/kernel/yama/ptrace_scope", "r");
|
|
int yama = 0;
|
|
if (yf) {
|
|
if (fscanf(yf, "%d", &yama) != 1)
|
|
yama = 0;
|
|
fclose(yf);
|
|
}
|
|
CHECK(yama > 0 || exists(p));
|
|
os_run_result_free(&r);
|
|
t0 = os_now_ms();
|
|
CHECK(run(ws, "(sleep 0.3; echo late > bg2.txt) >/dev/null 2>&1 &", &r) ==
|
|
0);
|
|
CHECK(os_now_ms() - t0 < 3000);
|
|
os_run_result_free(&r);
|
|
|
|
/* the workspace root itself cannot be removed */
|
|
char cwd[OS_PATH_MAX], ws2[OS_PATH_MAX + 32];
|
|
CHECK(getcwd(cwd, sizeof(cwd)) != NULL);
|
|
snprintf(ws2, sizeof(ws2), "%s/tests/sbx_ws2_XXXXXX", cwd);
|
|
CHECK(mkdtemp(ws2));
|
|
CHECK(run(ws2, "rmdir \"$PWD\"", &r) != 0 && blocked(&r) && exists(ws2));
|
|
os_run_result_free(&r);
|
|
CHECK(rmdir(ws2) == 0);
|
|
}
|
|
|
|
static void test_confined(int kind) {
|
|
char cwd[OS_PATH_MAX], ws[OS_PATH_MAX + 32], out[OS_PATH_MAX + 32];
|
|
char cmd[3 * OS_PATH_MAX];
|
|
CHECK(getcwd(cwd, sizeof(cwd)) != NULL);
|
|
/* Both live in the build tree, outside TMPDIR, so "outside" is denied. */
|
|
snprintf(ws, sizeof(ws), "%s/tests/sbx_ws_XXXXXX", cwd);
|
|
snprintf(out, sizeof(out), "%s/tests/sbx_out_XXXXXX", cwd);
|
|
CHECK(mkdtemp(ws) && mkdtemp(out));
|
|
char outfile[OS_PATH_MAX + 64], readme[OS_PATH_MAX + 64];
|
|
snprintf(outfile, sizeof(outfile), "%s/escape.txt", out);
|
|
snprintf(readme, sizeof(readme), "%s/readme.txt", out);
|
|
FILE *fp = fopen(readme, "w");
|
|
CHECK(fp);
|
|
fputs("outside-content\n", fp);
|
|
fclose(fp);
|
|
|
|
os_run_result_t r;
|
|
CHECK(run(ws, "echo hi > inside.txt && mkdir sub && echo x > sub/y && "
|
|
"rm sub/y && cat inside.txt",
|
|
&r) == 0);
|
|
CHECK(strstr(r.out, "hi") != NULL);
|
|
os_run_result_free(&r);
|
|
|
|
snprintf(cmd, sizeof(cmd), "echo nope > '%s'", outfile);
|
|
CHECK(run(ws, cmd, &r) != 0);
|
|
CHECK(!exists(outfile));
|
|
if (!cst_sandbox_blocked(r.out, r.out_len, r.exit_code))
|
|
fprintf(stderr, "unexpected output (exit %d): %s\n", r.exit_code,
|
|
r.out ? r.out : "");
|
|
CHECK(cst_sandbox_blocked(r.out, r.out_len, r.exit_code));
|
|
os_run_result_free(&r);
|
|
|
|
snprintf(cmd, sizeof(cmd), "cat '%s'", readme);
|
|
CHECK(run(ws, cmd, &r) == 0);
|
|
CHECK(strstr(r.out, "outside-content") != NULL);
|
|
os_run_result_free(&r);
|
|
|
|
CHECK(run(ws, "echo x >/dev/null && echo ok", &r) == 0);
|
|
os_run_result_free(&r);
|
|
|
|
char tmp[OS_PATH_MAX];
|
|
CHECK(os_temp_dir(tmp, sizeof(tmp)) == 0);
|
|
snprintf(cmd, sizeof(cmd), "f='%s/cst_sbx_%d'; echo t > \"$f\" && rm \"$f\"",
|
|
tmp, (int)getpid());
|
|
CHECK(run(ws, cmd, &r) == 0);
|
|
os_run_result_free(&r);
|
|
|
|
if (kind == CST_SANDBOX_SECCOMP)
|
|
test_seccomp_paths(ws, out);
|
|
|
|
/* the parent itself stays unconfined */
|
|
fp = fopen(outfile, "w");
|
|
CHECK(fp);
|
|
fclose(fp);
|
|
|
|
if (kind == CST_SANDBOX_SECCOMP || cst_sandbox_landlock_abi() >= 4)
|
|
test_network(ws);
|
|
else
|
|
printf("test_sandbox: landlock ABI %d < 4, network rule not tested\n",
|
|
cst_sandbox_landlock_abi());
|
|
|
|
snprintf(cmd, sizeof(cmd), "rm -rf '%s' '%s'", ws, out);
|
|
CHECK(system(cmd) == 0);
|
|
}
|
|
#endif
|
|
|
|
int main(void) {
|
|
test_rules();
|
|
test_blocked();
|
|
int kind = cst_sandbox_probe();
|
|
printf("test_sandbox: sandbox %s\n", cst_sandbox_name(kind));
|
|
#if !defined(_WIN32)
|
|
if (kind == CST_SANDBOX_LANDLOCK || kind == CST_SANDBOX_SECCOMP)
|
|
test_confined(kind);
|
|
if (kind != CST_SANDBOX_SECCOMP) {
|
|
const char *was = getenv("CST_SANDBOX");
|
|
char saved[32] = "";
|
|
if (was)
|
|
snprintf(saved, sizeof(saved), "%s", was);
|
|
setenv("CST_SANDBOX", "seccomp", 1);
|
|
if (cst_sandbox_reprobe() == CST_SANDBOX_SECCOMP) {
|
|
printf("test_sandbox: forced seccomp\n");
|
|
test_confined(CST_SANDBOX_SECCOMP);
|
|
} else {
|
|
printf("test_sandbox: seccomp not available here\n");
|
|
}
|
|
if (was)
|
|
setenv("CST_SANDBOX", saved, 1);
|
|
else
|
|
unsetenv("CST_SANDBOX");
|
|
CHECK(cst_sandbox_reprobe() == kind);
|
|
}
|
|
#endif
|
|
puts("test_sandbox: ok");
|
|
return 0;
|
|
}
|