lib/GR/Checkers/ChrootChecker.cpp

   1 //===- Chrootchecker.cpp -------- Basic security checks ----------*- C++ -*-==//
   2 //
   3 //                     The LLVM Compiler Infrastructure
   4 //
   5 // This file is distributed under the University of Illinois Open Source
   6 // License. See LICENSE.TXT for details.
   7 //
   8 //===----------------------------------------------------------------------===//
   9 //
  10 //  This file defines chroot checker, which checks improper use of chroot.
  11 //
  12 //===----------------------------------------------------------------------===//
  13
  14 #include "GRExprEngineExperimentalChecks.h"
  15 #include "clang/GR/BugReporter/BugType.h"
  16 #include "clang/GR/PathSensitive/CheckerVisitor.h"
  17 #include "clang/GR/PathSensitive/GRState.h"
  18 #include "clang/GR/PathSensitive/GRStateTrait.h"
  19 #include "clang/GR/PathSensitive/SymbolManager.h"
  20 #include "llvm/ADT/ImmutableMap.h"
  21 using namespace clang;
  22 using namespace GR;
  23
  24 namespace {
  25
  26 // enum value that represent the jail state
  27 enum Kind { NO_CHROOT, ROOT_CHANGED, JAIL_ENTERED };
  28
  29 bool isRootChanged(intptr_t k) { return k == ROOT_CHANGED; }
  30 //bool isJailEntered(intptr_t k) { return k == JAIL_ENTERED; }
  31
  32 // This checker checks improper use of chroot.
  33 // The state transition:
  34 // NO_CHROOT ---chroot(path)--> ROOT_CHANGED ---chdir(/) --> JAIL_ENTERED
  35 //                                  |                               |
  36 //         ROOT_CHANGED<--chdir(..)--      JAIL_ENTERED<--chdir(..)--
  37 //                                  |                               |
  38 //                      bug<--foo()--          JAIL_ENTERED<--foo()--
  39 class ChrootChecker : public CheckerVisitor<ChrootChecker> {
  40   IdentifierInfo *II_chroot, *II_chdir;
  41   // This bug refers to possibly break out of a chroot() jail.
  42   BuiltinBug *BT_BreakJail;
  43
  44 public:
  45   ChrootChecker() : II_chroot(0), II_chdir(0), BT_BreakJail(0) {}
  46
  47   static void *getTag() {
  48     static int x;
  49     return &x;
  50   }
  51
  52   virtual bool evalCallExpr(CheckerContext &C, const CallExpr *CE);
  53   virtual void PreVisitCallExpr(CheckerContext &C, const CallExpr *CE);
  54
  55 private:
  56   void Chroot(CheckerContext &C, const CallExpr *CE);
  57   void Chdir(CheckerContext &C, const CallExpr *CE);
  58 };
  59
  60 } // end anonymous namespace
  61
  62 void GR::RegisterChrootChecker(GRExprEngine &Eng) {
  63   Eng.registerCheck(new ChrootChecker());
  64 }
  65
  66 bool ChrootChecker::evalCallExpr(CheckerContext &C, const CallExpr *CE) {
  67   const GRState *state = C.getState();
  68   const Expr *Callee = CE->getCallee();
  69   SVal L = state->getSVal(Callee);
  70   const FunctionDecl *FD = L.getAsFunctionDecl();
  71   if (!FD)
  72     return false;
  73
  74   ASTContext &Ctx = C.getASTContext();
  75   if (!II_chroot)
  76     II_chroot = &Ctx.Idents.get("chroot");
  77   if (!II_chdir)
  78     II_chdir = &Ctx.Idents.get("chdir");
  79
  80   if (FD->getIdentifier() == II_chroot) {
  81     Chroot(C, CE);
  82     return true;
  83   }
  84   if (FD->getIdentifier() == II_chdir) {
  85     Chdir(C, CE);
  86     return true;
  87   }
  88
  89   return false;
  90 }
  91
  92 void ChrootChecker::Chroot(CheckerContext &C, const CallExpr *CE) {
  93   const GRState *state = C.getState();
  94   GRStateManager &Mgr = state->getStateManager();
  95
  96   // Once encouter a chroot(), set the enum value ROOT_CHANGED directly in
  97   // the GDM.
  98   state = Mgr.addGDM(state, ChrootChecker::getTag(), (void*) ROOT_CHANGED);
  99   C.addTransition(state);
 100 }
 101
 102 void ChrootChecker::Chdir(CheckerContext &C, const CallExpr *CE) {
 103   const GRState *state = C.getState();
 104   GRStateManager &Mgr = state->getStateManager();
 105
 106   // If there are no jail state in the GDM, just return.
 107   const void* k = state->FindGDM(ChrootChecker::getTag());
 108   if (!k)
 109     return;
 110
 111   // After chdir("/"), enter the jail, set the enum value JAIL_ENTERED.
 112   const Expr *ArgExpr = CE->getArg(0);
 113   SVal ArgVal = state->getSVal(ArgExpr);
 114
 115   if (const MemRegion *R = ArgVal.getAsRegion()) {
 116     R = R->StripCasts();
 117     if (const StringRegion* StrRegion= dyn_cast<StringRegion>(R)) {
 118       const StringLiteral* Str = StrRegion->getStringLiteral();
 119       if (Str->getString() == "/")
 120         state = Mgr.addGDM(state, ChrootChecker::getTag(),
 121                            (void*) JAIL_ENTERED);
 122     }
 123   }
 124
 125   C.addTransition(state);
 126 }
 127
 128 // Check the jail state before any function call except chroot and chdir().
 129 void ChrootChecker::PreVisitCallExpr(CheckerContext &C, const CallExpr *CE) {
 130   const GRState *state = C.getState();
 131   const Expr *Callee = CE->getCallee();
 132   SVal L = state->getSVal(Callee);
 133   const FunctionDecl *FD = L.getAsFunctionDecl();
 134   if (!FD)
 135     return;
 136
 137   ASTContext &Ctx = C.getASTContext();
 138   if (!II_chroot)
 139     II_chroot = &Ctx.Idents.get("chroot");
 140   if (!II_chdir)
 141     II_chdir = &Ctx.Idents.get("chdir");
 142
 143   // Ingnore chroot and chdir.
 144   if (FD->getIdentifier() == II_chroot || FD->getIdentifier() == II_chdir)
 145     return;
 146
 147   // If jail state is ROOT_CHANGED, generate BugReport.
 148   void* const* k = state->FindGDM(ChrootChecker::getTag());
 149   if (k)
 150     if (isRootChanged((intptr_t) *k))
 151       if (ExplodedNode *N = C.generateNode()) {
 152         if (!BT_BreakJail)
 153           BT_BreakJail = new BuiltinBug("Break out of jail",
 154                                         "No call of chdir(\"/\") immediately "
 155                                         "after chroot");
 156         BugReport *R = new BugReport(*BT_BreakJail,
 157                                      BT_BreakJail->getDescription(), N);
 158         C.EmitReport(R);
 159       }
 160
 161   return;
 162 }