1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
|
/* Copyright (c) 2001 Matej Pfajfar.
* Copyright (c) 2001-2004, Roger Dingledine.
* Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson.
* Copyright (c) 2007-2013, The Tor Project, Inc. */
/* See LICENSE for licensing information */
/**
* \file sandbox.h
* \brief Header file for sandbox.c.
**/
#ifndef SANDBOX_H_
#define SANDBOX_H_
#include "orconfig.h"
#include "torint.h"
#ifndef SYS_SECCOMP
/**
* Used by SIGSYS signal handler to check if the signal was issued due to a
* seccomp2 filter violation.
*/
#define SYS_SECCOMP 1
#endif
#if defined(HAVE_SECCOMP_H) && defined(__linux__)
#define USE_LIBSECCOMP
#endif
struct sandbox_cfg_elem;
/** Typedef to structure used to manage a sandbox configuration. */
typedef struct sandbox_cfg_elem sandbox_cfg_t;
/**
* Linux definitions
*/
#ifdef USE_LIBSECCOMP
#ifndef __USE_GNU
#define __USE_GNU
#endif
#include <sys/ucontext.h>
#include <seccomp.h>
#include <netdb.h>
#define PARAM_PTR 0
#define PARAM_NUM 1
/**
* Enum used to manage the type of the implementation for general purpose.
*/
typedef enum {
/** Libseccomp implementation based on seccomp2*/
LIBSECCOMP2 = 0
} SB_IMPL;
/**
* Configuration parameter structure associated with the LIBSECCOMP2
* implementation.
*/
typedef struct smp_param {
/** syscall associated with parameter. */
int syscall;
/** parameter value. */
intptr_t value;
/** parameter value, second argument. */
intptr_t value2;
/** parameter flag (0 = not protected, 1 = protected). */
int prot;
} smp_param_t;
/**
* Structure used to manage a sandbox configuration.
*
* It is implemented as a linked list of parameters. Currently only controls
* parameters for open, openat, execve, stat64.
*/
struct sandbox_cfg_elem {
/** Sandbox implementation which dictates the parameter type. */
SB_IMPL implem;
/** Configuration parameter. */
smp_param_t *param;
/** Next element of the configuration*/
struct sandbox_cfg_elem *next;
};
/**
* Structure used for keeping a linked list of getaddrinfo pre-recorded
* results.
*/
struct sb_addr_info_el {
/** Name of the address info result. */
char *name;
/** Pre-recorded getaddrinfo result. */
struct addrinfo *info;
/** Next element in the list. */
struct sb_addr_info_el *next;
};
/** Typedef to structure used to manage an addrinfo list. */
typedef struct sb_addr_info_el sb_addr_info_t;
/** Function pointer defining the prototype of a filter function.*/
typedef int (*sandbox_filter_func_t)(scmp_filter_ctx ctx,
sandbox_cfg_t *filter);
/** Type that will be used in step 3 in order to manage multiple sandboxes.*/
typedef struct {
/** function pointers associated with the filter */
sandbox_filter_func_t *filter_func;
/** filter function pointer parameters */
sandbox_cfg_t *filter_dynamic;
} sandbox_t;
/**
* Linux 32 bit definitions
*/
#if defined(__i386__)
#define REG_SYSCALL REG_EAX
/**
* Linux 64 bit definitions
*/
#elif defined(__x86_64__)
#define REG_SYSCALL REG_RAX
#endif
#endif // USE_LIBSECCOMP
#ifdef USE_LIBSECCOMP
/** Pre-calls getaddrinfo in order to pre-record result. */
int sandbox_add_addrinfo(const char *addr);
struct addrinfo;
/** Replacement for getaddrinfo(), using pre-recorded results. */
int sandbox_getaddrinfo(const char *name, const char *servname,
const struct addrinfo *hints,
struct addrinfo **res);
#else
#define sandbox_getaddrinfo(name, servname, hints, res) \
getaddrinfo((name),(servname), (hints),(res))
#define sandbox_add_addrinfo(name) \
((void)(name))
#endif
#ifdef USE_LIBSECCOMP
/** Returns a registered protected string used with the sandbox, given that
* it matches the parameter.
*/
const char* sandbox_intern_string(const char *param);
#else
#define sandbox_intern_string(s) (s)
#endif
/** Creates an empty sandbox configuration file.*/
sandbox_cfg_t * sandbox_cfg_new(void);
/**
* Function used to add a open allowed filename to a supplied configuration.
* The (char*) specifies the path to the allowed file; we take ownership
* of the pointer.
*/
int sandbox_cfg_allow_open_filename(sandbox_cfg_t **cfg, char *file);
/**DOCDOC*/
int sandbox_cfg_allow_rename(sandbox_cfg_t **cfg, char *file1, char *file2);
/** Function used to add a series of open allowed filenames to a supplied
* configuration.
* @param cfg sandbox configuration.
* @param ... a list of stealable pointers to permitted files. The last
* one must be NULL.
*/
int sandbox_cfg_allow_open_filename_array(sandbox_cfg_t **cfg, ...);
/**
* Function used to add a openat allowed filename to a supplied configuration.
* The (char*) specifies the path to the allowed file; we steal the pointer to
* that file.
*/
int sandbox_cfg_allow_openat_filename(sandbox_cfg_t **cfg, char *file);
/** Function used to add a series of openat allowed filenames to a supplied
* configuration.
* @param cfg sandbox configuration.
* @param ... a list of stealable pointers to permitted files. The last
* one must be NULL.
*/
int sandbox_cfg_allow_openat_filename_array(sandbox_cfg_t **cfg, ...);
/**
* Function used to add a execve allowed filename to a supplied configuration.
* The (char*) specifies the path to the allowed file; that pointer is stolen.
*/
int sandbox_cfg_allow_execve(sandbox_cfg_t **cfg, const char *com);
/** Function used to add a series of execve allowed filenames to a supplied
* configuration.
* @param cfg sandbox configuration.
* @param ... an array of stealable pointers to permitted files. The last
* one must be NULL.
*/
int sandbox_cfg_allow_execve_array(sandbox_cfg_t **cfg, ...);
/**
* Function used to add a stat/stat64 allowed filename to a configuration.
* The (char*) specifies the path to the allowed file; that pointer is stolen.
*/
int sandbox_cfg_allow_stat_filename(sandbox_cfg_t **cfg, char *file);
/** Function used to add a series of stat64 allowed filenames to a supplied
* configuration.
* @param cfg sandbox configuration.
* @param ... an array of stealable pointers to permitted files. The last
* one must be NULL.
*/
int sandbox_cfg_allow_stat_filename_array(sandbox_cfg_t **cfg, ...);
/** Function used to initialise a sandbox configuration.*/
int sandbox_init(sandbox_cfg_t* cfg);
/** Return true iff the sandbox is turned on. */
int sandbox_is_active(void);
#endif /* SANDBOX_H_ */
|