lib/StaticAnalyzer/Checkers/ChrootChecker.cpp

   1 //===- Chrootchecker.cpp -------- Basic security checks ----------*- C++ -*-==//
   2 //
   3 //                     The LLVM Compiler Infrastructure
   4 //
   5 // This file is distributed under the University of Illinois Open Source
   6 // License. See LICENSE.TXT for details.
   7 //
   8 //===----------------------------------------------------------------------===//
   9 //
  10 //  This file defines chroot checker, which checks improper use of chroot.
  11 //
  12 //===----------------------------------------------------------------------===//
  13
  14 #include "ClangSACheckers.h"
  15 #include "clang/StaticAnalyzer/Core/CheckerManager.h"
  16 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
  17 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerVisitor.h"
  18 #include "clang/StaticAnalyzer/Core/PathSensitive/GRState.h"
  19 #include "clang/StaticAnalyzer/Core/PathSensitive/GRStateTrait.h"
  20 #include "clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h"
  21 #include "llvm/ADT/ImmutableMap.h"
  22 using namespace clang;
  23 using namespace ento;
  24
  25 namespace {
  26
  27 // enum value that represent the jail state
  28 enum Kind { NO_CHROOT, ROOT_CHANGED, JAIL_ENTERED };
  29
  30 bool isRootChanged(intptr_t k) { return k == ROOT_CHANGED; }
  31 //bool isJailEntered(intptr_t k) { return k == JAIL_ENTERED; }
  32
  33 // This checker checks improper use of chroot.
  34 // The state transition:
  35 // NO_CHROOT ---chroot(path)--> ROOT_CHANGED ---chdir(/) --> JAIL_ENTERED
  36 //                                  |                               |
  37 //         ROOT_CHANGED<--chdir(..)--      JAIL_ENTERED<--chdir(..)--
  38 //                                  |                               |
  39 //                      bug<--foo()--          JAIL_ENTERED<--foo()--
  40 class ChrootChecker : public CheckerVisitor<ChrootChecker> {
  41   IdentifierInfo *II_chroot, *II_chdir;
  42   // This bug refers to possibly break out of a chroot() jail.
  43   BuiltinBug *BT_BreakJail;
  44
  45 public:
  46   ChrootChecker() : II_chroot(0), II_chdir(0), BT_BreakJail(0) {}
  47
  48   static void *getTag() {
  49     static int x;
  50     return &x;
  51   }
  52
  53   virtual bool evalCallExpr(CheckerContext &C, const CallExpr *CE);
  54   virtual void PreVisitCallExpr(CheckerContext &C, const CallExpr *CE);
  55
  56 private:
  57   void Chroot(CheckerContext &C, const CallExpr *CE);
  58   void Chdir(CheckerContext &C, const CallExpr *CE);
  59 };
  60
  61 } // end anonymous namespace
  62
  63 static void RegisterChrootChecker(ExprEngine &Eng) {
  64   Eng.registerCheck(new ChrootChecker());
  65 }
  66
  67 void ento::registerChrootChecker(CheckerManager &mgr) {
  68   mgr.addCheckerRegisterFunction(RegisterChrootChecker);
  69 }
  70
  71 bool ChrootChecker::evalCallExpr(CheckerContext &C, const CallExpr *CE) {
  72   const GRState *state = C.getState();
  73   const Expr *Callee = CE->getCallee();
  74   SVal L = state->getSVal(Callee);
  75   const FunctionDecl *FD = L.getAsFunctionDecl();
  76   if (!FD)
  77     return false;
  78
  79   ASTContext &Ctx = C.getASTContext();
  80   if (!II_chroot)
  81     II_chroot = &Ctx.Idents.get("chroot");
  82   if (!II_chdir)
  83     II_chdir = &Ctx.Idents.get("chdir");
  84
  85   if (FD->getIdentifier() == II_chroot) {
  86     Chroot(C, CE);
  87     return true;
  88   }
  89   if (FD->getIdentifier() == II_chdir) {
  90     Chdir(C, CE);
  91     return true;
  92   }
  93
  94   return false;
  95 }
  96
  97 void ChrootChecker::Chroot(CheckerContext &C, const CallExpr *CE) {
  98   const GRState *state = C.getState();
  99   GRStateManager &Mgr = state->getStateManager();
 100
 101   // Once encouter a chroot(), set the enum value ROOT_CHANGED directly in
 102   // the GDM.
 103   state = Mgr.addGDM(state, ChrootChecker::getTag(), (void*) ROOT_CHANGED);
 104   C.addTransition(state);
 105 }
 106
 107 void ChrootChecker::Chdir(CheckerContext &C, const CallExpr *CE) {
 108   const GRState *state = C.getState();
 109   GRStateManager &Mgr = state->getStateManager();
 110
 111   // If there are no jail state in the GDM, just return.
 112   const void* k = state->FindGDM(ChrootChecker::getTag());
 113   if (!k)
 114     return;
 115
 116   // After chdir("/"), enter the jail, set the enum value JAIL_ENTERED.
 117   const Expr *ArgExpr = CE->getArg(0);
 118   SVal ArgVal = state->getSVal(ArgExpr);
 119
 120   if (const MemRegion *R = ArgVal.getAsRegion()) {
 121     R = R->StripCasts();
 122     if (const StringRegion* StrRegion= dyn_cast<StringRegion>(R)) {
 123       const StringLiteral* Str = StrRegion->getStringLiteral();
 124       if (Str->getString() == "/")
 125         state = Mgr.addGDM(state, ChrootChecker::getTag(),
 126                            (void*) JAIL_ENTERED);
 127     }
 128   }
 129
 130   C.addTransition(state);
 131 }
 132
 133 // Check the jail state before any function call except chroot and chdir().
 134 void ChrootChecker::PreVisitCallExpr(CheckerContext &C, const CallExpr *CE) {
 135   const GRState *state = C.getState();
 136   const Expr *Callee = CE->getCallee();
 137   SVal L = state->getSVal(Callee);
 138   const FunctionDecl *FD = L.getAsFunctionDecl();
 139   if (!FD)
 140     return;
 141
 142   ASTContext &Ctx = C.getASTContext();
 143   if (!II_chroot)
 144     II_chroot = &Ctx.Idents.get("chroot");
 145   if (!II_chdir)
 146     II_chdir = &Ctx.Idents.get("chdir");
 147
 148   // Ingnore chroot and chdir.
 149   if (FD->getIdentifier() == II_chroot || FD->getIdentifier() == II_chdir)
 150     return;
 151
 152   // If jail state is ROOT_CHANGED, generate BugReport.
 153   void* const* k = state->FindGDM(ChrootChecker::getTag());
 154   if (k)
 155     if (isRootChanged((intptr_t) *k))
 156       if (ExplodedNode *N = C.generateNode()) {
 157         if (!BT_BreakJail)
 158           BT_BreakJail = new BuiltinBug("Break out of jail",
 159                                         "No call of chdir(\"/\") immediately "
 160                                         "after chroot");
 161         BugReport *R = new BugReport(*BT_BreakJail,
 162                                      BT_BreakJail->getDescription(), N);
 163         C.EmitReport(R);
 164       }
 165
 166   return;
 167 }