src/lib/sandbox/sandbox.c

   1 /* Copyright (c) 2001 Matej Pfajfar.
   2  * Copyright (c) 2001-2004, Roger Dingledine.
   3  * Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson.
   4  * Copyright (c) 2007-2021, The Tor Project, Inc. */
   5 /* See LICENSE for licensing information */
   6
   7 /**
   8  * \file sandbox.c
   9  * \brief Code to enable sandboxing.
  10  **/
  11
  12 #include "orconfig.h"
  13
  14 #ifndef _LARGEFILE64_SOURCE
  15 /**
  16  * Temporarily required for O_LARGEFILE flag. Needs to be removed
  17  * with the libevent fix.
  18  */
  19 #define _LARGEFILE64_SOURCE
  20 #endif /* !defined(_LARGEFILE64_SOURCE) */
  21
  22 /** Malloc mprotect limit in bytes.
  23  *
  24  * 28/06/2017: This value was increased from 16 MB to 20 MB after we introduced
  25  * LZMA support in Tor (0.3.1.1-alpha). We limit our LZMA coder to 16 MB, but
  26  * liblzma have a small overhead that we need to compensate for to avoid being
  27  * killed by the sandbox.
  28  */
  29 #define MALLOC_MP_LIM (20*1024*1024)
  30
  31 #include <stdio.h>
  32 #include <string.h>
  33 #include <stdlib.h>
  34 #include <errno.h>
  35
  36 #include "lib/sandbox/sandbox.h"
  37 #include "lib/container/map.h"
  38 #include "lib/err/torerr.h"
  39 #include "lib/log/log.h"
  40 #include "lib/cc/torint.h"
  41 #include "lib/malloc/malloc.h"
  42 #include "lib/string/scanf.h"
  43
  44 #include "ext/tor_queue.h"
  45 #include "ext/ht.h"
  46 #include "ext/siphash.h"
  47
  48 #define DEBUGGING_CLOSE
  49
  50 #if defined(USE_LIBSECCOMP)
  51
  52 #include <sys/mman.h>
  53 #include <sys/syscall.h>
  54 #include <sys/types.h>
  55 #include <sys/stat.h>
  56 #include <sys/epoll.h>
  57 #include <sys/prctl.h>
  58 #include <linux/futex.h>
  59 #include <sys/file.h>
  60
  61 #ifdef ENABLE_FRAGILE_HARDENING
  62 #include <sys/ptrace.h>
  63 #endif
  64
  65 #include <stdarg.h>
  66 #include <seccomp.h>
  67 #include <signal.h>
  68 #include <unistd.h>
  69 #include <fcntl.h>
  70 #include <time.h>
  71 #include <poll.h>
  72
  73 #ifdef HAVE_GNU_LIBC_VERSION_H
  74 #include <gnu/libc-version.h>
  75 #endif
  76 #ifdef HAVE_LINUX_NETFILTER_IPV4_H
  77 #include <linux/netfilter_ipv4.h>
  78 #endif
  79 #ifdef HAVE_LINUX_IF_H
  80 #include <linux/if.h>
  81 #endif
  82 #ifdef HAVE_LINUX_NETFILTER_IPV6_IP6_TABLES_H
  83 #include <linux/netfilter_ipv6/ip6_tables.h>
  84 #endif
  85
  86 #if defined(HAVE_EXECINFO_H) && defined(HAVE_BACKTRACE) && \
  87   defined(HAVE_BACKTRACE_SYMBOLS_FD) && defined(HAVE_SIGACTION)
  88 #define USE_BACKTRACE
  89 #define BACKTRACE_PRIVATE
  90 #include "lib/err/backtrace.h"
  91 #endif /* defined(HAVE_EXECINFO_H) && defined(HAVE_BACKTRACE) && ... */
  92
  93 #ifdef USE_BACKTRACE
  94 #include <execinfo.h>
  95 #endif
  96
  97 /**
  98  * Linux 32 bit definitions
  99  */
 100 #if defined(__i386__)
 101
 102 #define REG_SYSCALL REG_EAX
 103 #define M_SYSCALL gregs[REG_SYSCALL]
 104
 105 /**
 106  * Linux 64 bit definitions
 107  */
 108 #elif defined(__x86_64__)
 109
 110 #define REG_SYSCALL REG_RAX
 111 #define M_SYSCALL gregs[REG_SYSCALL]
 112
 113 #elif defined(__arm__)
 114
 115 #define M_SYSCALL arm_r7
 116
 117 #elif defined(__aarch64__) && defined(__LP64__)
 118
 119 #define REG_SYSCALL 8
 120 #define M_SYSCALL regs[REG_SYSCALL]
 121
 122 #endif /* defined(__i386__) || ... */
 123
 124 #ifdef M_SYSCALL
 125 #define SYSCALL_NAME_DEBUGGING
 126 #endif
 127
 128 /**Determines if at least one sandbox is active.*/
 129 static int sandbox_active = 0;
 130 /** Holds the parameter list configuration for the sandbox.*/
 131 static sandbox_cfg_t *filter_dynamic = NULL;
 132
 133 #undef SCMP_CMP
 134 #define SCMP_CMP(a,b,c) ((struct scmp_arg_cmp){(a),(b),(c),0})
 135 #define SCMP_CMP_STR(a,b,c) \
 136   ((struct scmp_arg_cmp) {(a),(b),(intptr_t)(void*)(c),0})
 137 #define SCMP_CMP4(a,b,c,d) ((struct scmp_arg_cmp){(a),(b),(c),(d)})
 138 /* We use a wrapper here because these masked comparisons seem to be pretty
 139  * verbose. Also, it's important to cast to scmp_datum_t before negating the
 140  * mask, since otherwise the negation might get applied to a 32 bit value, and
 141  * the high bits of the value might get masked out improperly. */
 142 #define SCMP_CMP_MASKED(a,b,c) \
 143   SCMP_CMP4((a), SCMP_CMP_MASKED_EQ, ~(scmp_datum_t)(b), (c))
 144 /* Negative constants aren't consistently sign extended or zero extended.
 145  * Different compilers, libc, and architectures behave differently. For cases
 146  * where the kernel ABI uses a 32 bit integer, this macro can be used to
 147  * mask-compare only the lower 32 bits of the value. */
 148 #define SCMP_CMP_LOWER32_EQ(a,b) \
 149   SCMP_CMP4((a), SCMP_CMP_MASKED_EQ, 0xFFFFFFFF, (unsigned int)(b))
 150
 151 /** Variable used for storing all syscall numbers that will be allowed with the
 152  * stage 1 general Tor sandbox.
 153  */
 154 static int filter_nopar_gen[] = {
 155     SCMP_SYS(access),
 156     SCMP_SYS(brk),
 157 #ifdef __NR_clock_gettime64
 158     SCMP_SYS(clock_gettime64),
 159 #else
 160     SCMP_SYS(clock_gettime),
 161 #endif
 162     SCMP_SYS(close),
 163     SCMP_SYS(clone),
 164     SCMP_SYS(dup),
 165 #ifdef __NR_clone3
 166     SCMP_SYS(clone3),
 167 #endif
 168     SCMP_SYS(epoll_create),
 169     SCMP_SYS(epoll_wait),
 170 #ifdef __NR_epoll_pwait
 171     SCMP_SYS(epoll_pwait),
 172 #endif
 173 #ifdef HAVE_EVENTFD
 174     SCMP_SYS(eventfd2),
 175 #endif
 176 #ifdef HAVE_PIPE2
 177     SCMP_SYS(pipe2),
 178 #endif
 179 #ifdef HAVE_PIPE
 180     SCMP_SYS(pipe),
 181 #endif
 182 #ifdef __NR_fchmod
 183     SCMP_SYS(fchmod),
 184 #endif
 185     SCMP_SYS(fcntl),
 186     SCMP_SYS(fstat),
 187 #ifdef __NR_fstat64
 188     SCMP_SYS(fstat64),
 189 #endif
 190     SCMP_SYS(fsync),
 191     SCMP_SYS(futex),
 192     SCMP_SYS(getdents),
 193     SCMP_SYS(getdents64),
 194     SCMP_SYS(getegid),
 195 #ifdef __NR_getegid32
 196     SCMP_SYS(getegid32),
 197 #endif
 198     SCMP_SYS(geteuid),
 199 #ifdef __NR_geteuid32
 200     SCMP_SYS(geteuid32),
 201 #endif
 202     SCMP_SYS(getgid),
 203 #ifdef __NR_getgid32
 204     SCMP_SYS(getgid32),
 205 #endif
 206     SCMP_SYS(getpid),
 207 #ifdef ENABLE_FRAGILE_HARDENING
 208     SCMP_SYS(getppid),
 209 #endif
 210 #ifdef __NR_getrlimit
 211     SCMP_SYS(getrlimit),
 212 #endif
 213     SCMP_SYS(gettimeofday),
 214     SCMP_SYS(gettid),
 215     SCMP_SYS(getuid),
 216 #ifdef __NR_getuid32
 217     SCMP_SYS(getuid32),
 218 #endif
 219     SCMP_SYS(lseek),
 220 #ifdef __NR__llseek
 221     SCMP_SYS(_llseek),
 222 #endif
 223     // glob uses this..
 224     SCMP_SYS(lstat),
 225     SCMP_SYS(mkdir),
 226     SCMP_SYS(mlockall),
 227 #ifdef __NR_mmap
 228     /* XXXX restrict this in the same ways as mmap2 */
 229     SCMP_SYS(mmap),
 230 #endif
 231     SCMP_SYS(munmap),
 232 #ifdef __NR_nanosleep
 233     SCMP_SYS(nanosleep),
 234 #endif
 235 #ifdef __NR_prlimit
 236     SCMP_SYS(prlimit),
 237 #endif
 238 #ifdef __NR_prlimit64
 239     SCMP_SYS(prlimit64),
 240 #endif
 241     SCMP_SYS(read),
 242     SCMP_SYS(rt_sigreturn),
 243 #ifdef __NR_rseq
 244     SCMP_SYS(rseq),
 245 #endif
 246     SCMP_SYS(sched_getaffinity),
 247 #ifdef __NR_sched_yield
 248     SCMP_SYS(sched_yield),
 249 #endif
 250     SCMP_SYS(sendmsg),
 251     SCMP_SYS(set_robust_list),
 252 #ifdef __NR_setrlimit
 253     SCMP_SYS(setrlimit),
 254 #endif
 255     SCMP_SYS(shutdown),
 256 #ifdef __NR_sigaltstack
 257     SCMP_SYS(sigaltstack),
 258 #endif
 259 #ifdef __NR_sigreturn
 260     SCMP_SYS(sigreturn),
 261 #endif
 262     SCMP_SYS(stat),
 263 #if defined(__i386__) && defined(__NR_statx)
 264     SCMP_SYS(statx),
 265 #endif
 266     SCMP_SYS(uname),
 267     SCMP_SYS(wait4),
 268     SCMP_SYS(write),
 269     SCMP_SYS(writev),
 270     SCMP_SYS(exit_group),
 271     SCMP_SYS(exit),
 272
 273     SCMP_SYS(madvise),
 274 #ifdef __NR_stat64
 275     // getaddrinfo uses this..
 276     SCMP_SYS(stat64),
 277 #endif
 278
 279 #ifdef __NR_getrandom
 280     SCMP_SYS(getrandom),
 281 #endif
 282
 283 #ifdef __NR_sysinfo
 284     // qsort uses this..
 285     SCMP_SYS(sysinfo),
 286 #endif
 287     /*
 288      * These socket syscalls are not required on x86_64 and not supported with
 289      * some libseccomp versions (eg: 1.0.1)
 290      */
 291 #if defined(__i386)
 292     SCMP_SYS(recv),
 293     SCMP_SYS(send),
 294 #endif
 295
 296     // socket syscalls
 297     SCMP_SYS(bind),
 298     SCMP_SYS(listen),
 299     SCMP_SYS(connect),
 300     SCMP_SYS(getsockname),
 301 #ifdef ENABLE_NSS
 302 #ifdef __NR_getpeername
 303     SCMP_SYS(getpeername),
 304 #endif
 305 #endif
 306     SCMP_SYS(recvmsg),
 307     SCMP_SYS(recvfrom),
 308     SCMP_SYS(sendto),
 309     SCMP_SYS(unlink),
 310 #ifdef __NR_unlinkat
 311     SCMP_SYS(unlinkat),
 312 #endif
 313     SCMP_SYS(poll)
 314 };
 315
 316 /* opendir is not a syscall but it will use either open or openat. We do not
 317  * want the decision to allow open/openat to be the callers reponsability, so
 318  * we create a phony syscall number for opendir and sb_opendir will choose the
 319  * correct syscall. */
 320 #define PHONY_OPENDIR_SYSCALL -2
 321
 322 /* These macros help avoid the error where the number of filters we add on a
 323  * single rule don't match the arg_cnt param. */
 324 #define seccomp_rule_add_0(ctx,act,call) \
 325   seccomp_rule_add((ctx),(act),(call),0)
 326 #define seccomp_rule_add_1(ctx,act,call,f1) \
 327   seccomp_rule_add((ctx),(act),(call),1,(f1))
 328 #define seccomp_rule_add_2(ctx,act,call,f1,f2)  \
 329   seccomp_rule_add((ctx),(act),(call),2,(f1),(f2))
 330 #define seccomp_rule_add_3(ctx,act,call,f1,f2,f3)       \
 331   seccomp_rule_add((ctx),(act),(call),3,(f1),(f2),(f3))
 332 #define seccomp_rule_add_4(ctx,act,call,f1,f2,f3,f4)      \
 333   seccomp_rule_add((ctx),(act),(call),4,(f1),(f2),(f3),(f4))
 334
 335 static const char *sandbox_get_interned_string(const char *str);
 336
 337 /**
 338  * Function responsible for setting up the rt_sigaction syscall for
 339  * the seccomp filter sandbox.
 340  */
 341 static int
 342 sb_rt_sigaction(scmp_filter_ctx ctx, sandbox_cfg_t *filter)
 343 {
 344   unsigned i;
 345   int rc;
 346   int param[] = { SIGINT, SIGTERM, SIGPIPE, SIGUSR1, SIGUSR2, SIGHUP, SIGCHLD,
 347                   SIGSEGV, SIGILL, SIGFPE, SIGBUS, SIGSYS, SIGIO,
 348 #ifdef SIGXFSZ
 349       SIGXFSZ
 350 #endif
 351       };
 352   (void) filter;
 353
 354   for (i = 0; i < ARRAY_LENGTH(param); i++) {
 355     rc = seccomp_rule_add_1(ctx, SCMP_ACT_ALLOW, SCMP_SYS(rt_sigaction),
 356         SCMP_CMP(0, SCMP_CMP_EQ, param[i]));
 357     if (rc)
 358       break;
 359   }
 360
 361   return rc;
 362 }
 363
 364 #ifdef __NR_time
 365 /**
 366  * Function responsible for setting up the time syscall for
 367  * the seccomp filter sandbox.
 368  */
 369 static int
 370 sb_time(scmp_filter_ctx ctx, sandbox_cfg_t *filter)
 371 {
 372   (void) filter;
 373
 374   return seccomp_rule_add_1(ctx, SCMP_ACT_ALLOW, SCMP_SYS(time),
 375        SCMP_CMP(0, SCMP_CMP_EQ, 0));
 376 }
 377 #endif /* defined(__NR_time) */
 378
 379 /**
 380  * Function responsible for setting up the accept4 syscall for
 381  * the seccomp filter sandbox.
 382  */
 383 static int
 384 sb_accept4(scmp_filter_ctx ctx, sandbox_cfg_t *filter)
 385 {
 386   int rc = 0;
 387   (void)filter;
 388
 389 #ifdef __i386__
 390   rc = seccomp_rule_add_1(ctx, SCMP_ACT_ALLOW, SCMP_SYS(socketcall),
 391       SCMP_CMP(0, SCMP_CMP_EQ, 18));
 392   if (rc) {
 393     return rc;
 394   }
 395 #endif /* defined(__i386__) */
 396
 397   rc = seccomp_rule_add_1(ctx, SCMP_ACT_ALLOW, SCMP_SYS(accept4),
 398                    SCMP_CMP_MASKED(3, SOCK_CLOEXEC|SOCK_NONBLOCK, 0));
 399   if (rc) {
 400     return rc;
 401   }
 402
 403   return 0;
 404 }
 405
 406 #ifdef __NR_mmap2
 407 /**
 408  * Function responsible for setting up the mmap2 syscall for
 409  * the seccomp filter sandbox.
 410  */
 411 static int
 412 sb_mmap2(scmp_filter_ctx ctx, sandbox_cfg_t *filter)
 413 {
 414   int rc = 0;
 415   (void)filter;
 416
 417   rc = seccomp_rule_add_2(ctx, SCMP_ACT_ALLOW, SCMP_SYS(mmap2),
 418        SCMP_CMP(2, SCMP_CMP_EQ, PROT_READ),
 419        SCMP_CMP(3, SCMP_CMP_EQ, MAP_PRIVATE));
 420   if (rc) {
 421     return rc;
 422   }
 423
 424   rc = seccomp_rule_add_2(ctx, SCMP_ACT_ALLOW, SCMP_SYS(mmap2),
 425        SCMP_CMP(2, SCMP_CMP_EQ, PROT_NONE),
 426        SCMP_CMP(3, SCMP_CMP_EQ, MAP_PRIVATE|MAP_ANONYMOUS|MAP_NORESERVE));
 427   if (rc) {
 428     return rc;
 429   }
 430
 431   rc = seccomp_rule_add_2(ctx, SCMP_ACT_ALLOW, SCMP_SYS(mmap2),
 432        SCMP_CMP(2, SCMP_CMP_EQ, PROT_READ|PROT_WRITE),
 433        SCMP_CMP(3, SCMP_CMP_EQ, MAP_PRIVATE|MAP_ANONYMOUS));
 434   if (rc) {
 435     return rc;
 436   }
 437
 438   rc = seccomp_rule_add_2(ctx, SCMP_ACT_ALLOW, SCMP_SYS(mmap2),
 439        SCMP_CMP(2, SCMP_CMP_EQ, PROT_READ|PROT_WRITE),
 440        SCMP_CMP(3, SCMP_CMP_EQ,MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK));
 441   if (rc) {
 442     return rc;
 443   }
 444
 445   rc = seccomp_rule_add_2(ctx, SCMP_ACT_ALLOW, SCMP_SYS(mmap2),
 446       SCMP_CMP(2, SCMP_CMP_EQ, PROT_READ|PROT_WRITE),
 447       SCMP_CMP(3, SCMP_CMP_EQ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE));
 448   if (rc) {
 449     return rc;
 450   }
 451
 452   rc = seccomp_rule_add_2(ctx, SCMP_ACT_ALLOW, SCMP_SYS(mmap2),
 453       SCMP_CMP(2, SCMP_CMP_EQ, PROT_READ|PROT_WRITE),
 454       SCMP_CMP(3, SCMP_CMP_EQ, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS));
 455   if (rc) {
 456     return rc;
 457   }
 458
 459   rc = seccomp_rule_add_2(ctx, SCMP_ACT_ALLOW, SCMP_SYS(mmap2),
 460       SCMP_CMP(2, SCMP_CMP_EQ, PROT_READ|PROT_EXEC),
 461       SCMP_CMP(3, SCMP_CMP_EQ, MAP_PRIVATE|MAP_DENYWRITE));
 462   if (rc) {
 463     return rc;
 464   }
 465
 466   return 0;
 467 }
 468 #endif /* defined(__NR_mmap2) */
 469
 470 #ifdef HAVE_GNU_LIBC_VERSION_H
 471 #ifdef HAVE_GNU_GET_LIBC_VERSION
 472 #define CHECK_LIBC_VERSION
 473 #endif
 474 #endif
 475
 476 /* Return true the libc version is greater or equal than
 477  * <b>major</b>.<b>minor</b>. Returns false otherwise. */
 478 static int
 479 is_libc_at_least(int major, int minor)
 480 {
 481 #ifdef CHECK_LIBC_VERSION
 482   const char *version = gnu_get_libc_version();
 483   if (version == NULL)
 484     return 0;
 485
 486   int libc_major = -1;
 487   int libc_minor = -1;
 488
 489   tor_sscanf(version, "%d.%d", &libc_major, &libc_minor);
 490   if (libc_major > major)
 491     return 1;
 492   else if (libc_major == major && libc_minor >= minor)
 493     return 1;
 494   else
 495     return 0;
 496 #else /* !defined(CHECK_LIBC_VERSION) */
 497   (void)major;
 498   (void)minor;
 499   return 0;
 500 #endif /* defined(CHECK_LIBC_VERSION) */
 501 }
 502
 503 /* Return true if we think we're running with a libc that uses openat for the
 504  * open function on linux. */
 505 static int
 506 libc_uses_openat_for_open(void)
 507 {
 508   return is_libc_at_least(2, 26);
 509 }
 510
 511 /* Return true if we think we're running with a libc that uses openat for the
 512  * opendir function on linux. */
 513 static int
 514 libc_uses_openat_for_opendir(void)
 515 {
 516   // libc 2.27 and above or between 2.15 (inclusive) and 2.22 (exclusive)
 517   return is_libc_at_least(2, 27) ||
 518          (is_libc_at_least(2, 15) && !is_libc_at_least(2, 22));
 519 }
 520
 521 /** Allow a single file to be opened.  If <b>use_openat</b> is true,
 522  * we're using a libc that remaps all the opens into openats. */
 523 static int
 524 allow_file_open(scmp_filter_ctx ctx, int use_openat, const char *file)
 525 {
 526   if (use_openat) {
 527     return seccomp_rule_add_2(ctx, SCMP_ACT_ALLOW, SCMP_SYS(openat),
 528                               SCMP_CMP_LOWER32_EQ(0, AT_FDCWD),
 529                               SCMP_CMP_STR(1, SCMP_CMP_EQ, file));
 530   } else {
 531     return seccomp_rule_add_1(ctx, SCMP_ACT_ALLOW, SCMP_SYS(open),
 532                               SCMP_CMP_STR(0, SCMP_CMP_EQ, file));
 533   }
 534 }
 535
 536 /**
 537  * Function responsible for setting up the open syscall for
 538  * the seccomp filter sandbox.
 539  */
 540 static int
 541 sb_open(scmp_filter_ctx ctx, sandbox_cfg_t *filter)
 542 {
 543   int rc;
 544   sandbox_cfg_t *elem = NULL;
 545
 546   int use_openat = libc_uses_openat_for_open();
 547
 548 #ifdef ENABLE_FRAGILE_HARDENING
 549   /* AddressSanitizer uses the "open" syscall to access information about the
 550    * running process via the filesystem, so that call must be allowed without
 551    * restriction or the sanitizer will be unable to execute normally when the
 552    * process terminates. */
 553   rc = seccomp_rule_add_0(ctx, SCMP_ACT_ALLOW, SCMP_SYS(open));
 554   if (rc != 0) {
 555     log_err(LD_BUG,"(Sandbox) failed to add open syscall, received "
 556         "libseccomp error %d", rc);
 557     return rc;
 558   }
 559
 560   /* If glibc also uses only the "open" syscall to open files on this system
 561    * there is no need to consider any additional rules. */
 562   if (!use_openat)
 563     return 0;
 564 #endif
 565
 566   // for each dynamic parameter filters
 567   for (elem = filter; elem != NULL; elem = elem->next) {
 568     smp_param_t *param = elem->param;
 569
 570     if (param != NULL && param->prot == 1 && param->syscall
 571         == SCMP_SYS(open)) {
 572       rc = allow_file_open(ctx, use_openat, param->value);
 573       if (rc != 0) {
 574         log_err(LD_BUG,"(Sandbox) failed to add open syscall, received "
 575             "libseccomp error %d", rc);
 576         return rc;
 577       }
 578     }
 579   }
 580
 581   return 0;
 582 }
 583
 584 static int
 585 sb_chmod(scmp_filter_ctx ctx, sandbox_cfg_t *filter)
 586 {
 587   int rc;
 588   sandbox_cfg_t *elem = NULL;
 589
 590   // for each dynamic parameter filters
 591   for (elem = filter; elem != NULL; elem = elem->next) {
 592     smp_param_t *param = elem->param;
 593
 594     if (param != NULL && param->prot == 1 && param->syscall
 595         == SCMP_SYS(chmod)) {
 596       rc = seccomp_rule_add_1(ctx, SCMP_ACT_ALLOW, SCMP_SYS(chmod),
 597             SCMP_CMP_STR(0, SCMP_CMP_EQ, param->value));
 598       if (rc != 0) {
 599         log_err(LD_BUG,"(Sandbox) failed to add chmod syscall, received "
 600             "libseccomp error %d", rc);
 601         return rc;
 602       }
 603     }
 604   }
 605
 606   return 0;
 607 }
 608
 609 static int
 610 sb_fchmodat(scmp_filter_ctx ctx, sandbox_cfg_t *filter)
 611 {
 612   int rc;
 613   sandbox_cfg_t *elem = NULL;
 614
 615   // for each dynamic parameter filters
 616   for (elem = filter; elem != NULL; elem = elem->next) {
 617     smp_param_t *param = elem->param;
 618
 619     if (param != NULL && param->prot == 1 && param->syscall
 620         == SCMP_SYS(fchmodat)) {
 621       rc = seccomp_rule_add_2(ctx, SCMP_ACT_ALLOW, SCMP_SYS(fchmodat),
 622           SCMP_CMP_LOWER32_EQ(0, AT_FDCWD),
 623           SCMP_CMP_STR(1, SCMP_CMP_EQ, param->value));
 624       if (rc != 0) {
 625         log_err(LD_BUG,"(Sandbox) failed to add fchmodat syscall, received "
 626             "libseccomp error %d", rc);
 627         return rc;
 628       }
 629     }
 630   }
 631
 632   return 0;
 633 }
 634
 635 #ifdef __i386__
 636 static int
 637 sb_chown32(scmp_filter_ctx ctx, sandbox_cfg_t *filter)
 638 {
 639   int rc;
 640   sandbox_cfg_t *elem = NULL;
 641
 642   // for each dynamic parameter filters
 643   for (elem = filter; elem != NULL; elem = elem->next) {
 644     smp_param_t *param = elem->param;
 645
 646     if (param != NULL && param->prot == 1 && param->syscall
 647         == SCMP_SYS(chown32)) {
 648       rc = seccomp_rule_add_1(ctx, SCMP_ACT_ALLOW, SCMP_SYS(chown32),
 649             SCMP_CMP_STR(0, SCMP_CMP_EQ, param->value));
 650       if (rc != 0) {
 651         log_err(LD_BUG,"(Sandbox) failed to add chown32 syscall, received "
 652             "libseccomp error %d", rc);
 653         return rc;
 654       }
 655     }
 656   }
 657
 658   return 0;
 659 }
 660 #else
 661 static int
 662 sb_chown(scmp_filter_ctx ctx, sandbox_cfg_t *filter)
 663 {
 664   int rc;
 665   sandbox_cfg_t *elem = NULL;
 666
 667   // for each dynamic parameter filters
 668   for (elem = filter; elem != NULL; elem = elem->next) {
 669     smp_param_t *param = elem->param;
 670
 671     if (param != NULL && param->prot == 1 && param->syscall
 672         == SCMP_SYS(chown)) {
 673       rc = seccomp_rule_add_1(ctx, SCMP_ACT_ALLOW, SCMP_SYS(chown),
 674             SCMP_CMP_STR(0, SCMP_CMP_EQ, param->value));
 675       if (rc != 0) {
 676         log_err(LD_BUG,"(Sandbox) failed to add chown syscall, received "
 677             "libseccomp error %d", rc);
 678         return rc;
 679       }
 680     }
 681   }
 682
 683   return 0;
 684 }
 685 #endif /* defined(__i386__) */
 686
 687 static int
 688 sb_fchownat(scmp_filter_ctx ctx, sandbox_cfg_t *filter)
 689 {
 690   int rc;
 691   sandbox_cfg_t *elem = NULL;
 692
 693   // for each dynamic parameter filters
 694   for (elem = filter; elem != NULL; elem = elem->next) {
 695     smp_param_t *param = elem->param;
 696
 697     if (param != NULL && param->prot == 1 && param->syscall
 698         == SCMP_SYS(fchownat)) {
 699       rc = seccomp_rule_add_2(ctx, SCMP_ACT_ALLOW, SCMP_SYS(fchownat),
 700           SCMP_CMP_LOWER32_EQ(0, AT_FDCWD),
 701           SCMP_CMP_STR(1, SCMP_CMP_EQ, param->value));
 702       if (rc != 0) {
 703         log_err(LD_BUG,"(Sandbox) failed to add fchownat syscall, received "
 704             "libseccomp error %d", rc);
 705         return rc;
 706       }
 707     }
 708   }
 709
 710   return 0;
 711 }
 712
 713 /**
 714  * Function responsible for setting up the rename syscall for
 715  * the seccomp filter sandbox.
 716  */
 717 static int
 718 sb_rename(scmp_filter_ctx ctx, sandbox_cfg_t *filter)
 719 {
 720   int rc;
 721   sandbox_cfg_t *elem = NULL;
 722
 723   // for each dynamic parameter filters
 724   for (elem = filter; elem != NULL; elem = elem->next) {
 725     smp_param_t *param = elem->param;
 726
 727     if (param != NULL && param->prot == 1 &&
 728         param->syscall == SCMP_SYS(rename)) {
 729
 730       rc = seccomp_rule_add_2(ctx, SCMP_ACT_ALLOW, SCMP_SYS(rename),
 731             SCMP_CMP_STR(0, SCMP_CMP_EQ, param->value),
 732             SCMP_CMP_STR(1, SCMP_CMP_EQ, param->value2));
 733       if (rc != 0) {
 734         log_err(LD_BUG,"(Sandbox) failed to add rename syscall, received "
 735             "libseccomp error %d", rc);
 736         return rc;
 737       }
 738     }
 739   }
 740
 741   return 0;
 742 }
 743
 744 /**
 745  * Function responsible for setting up the renameat syscall for
 746  * the seccomp filter sandbox.
 747  */
 748 static int
 749 sb_renameat(scmp_filter_ctx ctx, sandbox_cfg_t *filter)
 750 {
 751   int rc;
 752   sandbox_cfg_t *elem = NULL;
 753
 754   // for each dynamic parameter filters
 755   for (elem = filter; elem != NULL; elem = elem->next) {
 756     smp_param_t *param = elem->param;
 757
 758     if (param != NULL && param->prot == 1 &&
 759         param->syscall == SCMP_SYS(renameat)) {
 760
 761       rc = seccomp_rule_add_4(ctx, SCMP_ACT_ALLOW, SCMP_SYS(renameat),
 762             SCMP_CMP_LOWER32_EQ(0, AT_FDCWD),
 763             SCMP_CMP_STR(1, SCMP_CMP_EQ, param->value),
 764             SCMP_CMP_LOWER32_EQ(2, AT_FDCWD),
 765             SCMP_CMP_STR(3, SCMP_CMP_EQ, param->value2));
 766       if (rc != 0) {
 767         log_err(LD_BUG,"(Sandbox) failed to add renameat syscall, received "
 768             "libseccomp error %d", rc);
 769         return rc;
 770       }
 771     }
 772   }
 773
 774   return 0;
 775 }
 776
 777 /**
 778  * Function responsible for setting up the openat syscall for
 779  * the seccomp filter sandbox.
 780  */
 781 static int
 782 sb_openat(scmp_filter_ctx ctx, sandbox_cfg_t *filter)
 783 {
 784   int rc;
 785   sandbox_cfg_t *elem = NULL;
 786
 787   // for each dynamic parameter filters
 788   for (elem = filter; elem != NULL; elem = elem->next) {
 789     smp_param_t *param = elem->param;
 790
 791     if (param != NULL && param->prot == 1 && param->syscall
 792         == SCMP_SYS(openat)) {
 793       rc = seccomp_rule_add_3(ctx, SCMP_ACT_ALLOW, SCMP_SYS(openat),
 794           SCMP_CMP_LOWER32_EQ(0, AT_FDCWD),
 795           SCMP_CMP_STR(1, SCMP_CMP_EQ, param->value),
 796           SCMP_CMP(2, SCMP_CMP_EQ, O_RDONLY|O_NONBLOCK|O_LARGEFILE|O_DIRECTORY|
 797               O_CLOEXEC));
 798       if (rc != 0) {
 799         log_err(LD_BUG,"(Sandbox) failed to add openat syscall, received "
 800             "libseccomp error %d", rc);
 801         return rc;
 802       }
 803     }
 804   }
 805
 806   return 0;
 807 }
 808
 809 static int
 810 sb_opendir(scmp_filter_ctx ctx, sandbox_cfg_t *filter)
 811 {
 812   int rc;
 813   sandbox_cfg_t *elem = NULL;
 814
 815   // for each dynamic parameter filters
 816   for (elem = filter; elem != NULL; elem = elem->next) {
 817     smp_param_t *param = elem->param;
 818
 819     if (param != NULL && param->prot == 1 && param->syscall
 820         == PHONY_OPENDIR_SYSCALL) {
 821       rc = allow_file_open(ctx, libc_uses_openat_for_opendir(), param->value);
 822       if (rc != 0) {
 823         log_err(LD_BUG,"(Sandbox) failed to add openat syscall, received "
 824             "libseccomp error %d", rc);
 825         return rc;
 826       }
 827     }
 828   }
 829
 830   return 0;
 831 }
 832
 833 #ifdef ENABLE_FRAGILE_HARDENING
 834 /**
 835  * Function responsible for setting up the ptrace syscall for
 836  * the seccomp filter sandbox.
 837  */
 838 static int
 839 sb_ptrace(scmp_filter_ctx ctx, sandbox_cfg_t *filter)
 840 {
 841   int rc;
 842   pid_t pid = getpid();
 843   (void) filter;
 844
 845   rc = seccomp_rule_add_2(ctx, SCMP_ACT_ALLOW, SCMP_SYS(ptrace),
 846       SCMP_CMP(0, SCMP_CMP_EQ, PTRACE_ATTACH),
 847       SCMP_CMP(1, SCMP_CMP_EQ, pid));
 848   if (rc)
 849     return rc;
 850
 851   rc = seccomp_rule_add_2(ctx, SCMP_ACT_ALLOW, SCMP_SYS(ptrace),
 852       SCMP_CMP(0, SCMP_CMP_EQ, PTRACE_GETREGS),
 853       SCMP_CMP(1, SCMP_CMP_EQ, pid));
 854   if (rc)
 855     return rc;
 856
 857   return 0;
 858 }
 859 #endif
 860
 861 /**
 862  * Function responsible for setting up the socket syscall for
 863  * the seccomp filter sandbox.
 864  */
 865 static int
 866 sb_socket(scmp_filter_ctx ctx, sandbox_cfg_t *filter)
 867 {
 868   int rc = 0;
 869   int i, j;
 870   (void) filter;
 871
 872 #ifdef __i386__
 873   rc = seccomp_rule_add_0(ctx, SCMP_ACT_ALLOW, SCMP_SYS(socket));
 874   if (rc)
 875     return rc;
 876 #endif
 877
 878   rc = seccomp_rule_add_2(ctx, SCMP_ACT_ALLOW, SCMP_SYS(socket),
 879       SCMP_CMP(0, SCMP_CMP_EQ, PF_FILE),
 880       SCMP_CMP_MASKED(1, SOCK_CLOEXEC|SOCK_NONBLOCK, SOCK_STREAM));
 881   if (rc)
 882     return rc;
 883
 884   for (i = 0; i < 2; ++i) {
 885     const int pf = i ? PF_INET : PF_INET6;
 886     for (j=0; j < 3; ++j) {
 887       const int type     = (j == 0) ? SOCK_STREAM :
 888                                       SOCK_DGRAM;
 889       const int protocol = (j == 0) ? IPPROTO_TCP :
 890                            (j == 1) ? IPPROTO_IP :
 891                                       IPPROTO_UDP;
 892       rc = seccomp_rule_add_3(ctx, SCMP_ACT_ALLOW, SCMP_SYS(socket),
 893         SCMP_CMP(0, SCMP_CMP_EQ, pf),
 894         SCMP_CMP_MASKED(1, SOCK_CLOEXEC|SOCK_NONBLOCK, type),
 895         SCMP_CMP(2, SCMP_CMP_EQ, protocol));
 896       if (rc)
 897         return rc;
 898     }
 899   }
 900
 901 #ifdef ENABLE_NSS
 902   rc = seccomp_rule_add_3(ctx, SCMP_ACT_ALLOW, SCMP_SYS(socket),
 903     SCMP_CMP(0, SCMP_CMP_EQ, PF_INET),
 904     SCMP_CMP(1, SCMP_CMP_EQ, SOCK_STREAM),
 905     SCMP_CMP(2, SCMP_CMP_EQ, IPPROTO_IP));
 906   if (rc)
 907     return rc;
 908 #endif /* defined(ENABLE_NSS) */
 909
 910   rc = seccomp_rule_add_3(ctx, SCMP_ACT_ALLOW, SCMP_SYS(socket),
 911       SCMP_CMP(0, SCMP_CMP_EQ, PF_UNIX),
 912       SCMP_CMP_MASKED(1, SOCK_CLOEXEC|SOCK_NONBLOCK, SOCK_STREAM),
 913       SCMP_CMP(2, SCMP_CMP_EQ, 0));
 914   if (rc)
 915     return rc;
 916
 917   rc = seccomp_rule_add_3(ctx, SCMP_ACT_ALLOW, SCMP_SYS(socket),
 918       SCMP_CMP(0, SCMP_CMP_EQ, PF_UNIX),
 919       SCMP_CMP_MASKED(1, SOCK_CLOEXEC|SOCK_NONBLOCK, SOCK_DGRAM),
 920       SCMP_CMP(2, SCMP_CMP_EQ, 0));
 921   if (rc)
 922     return rc;
 923
 924   rc = seccomp_rule_add_3(ctx, SCMP_ACT_ALLOW, SCMP_SYS(socket),
 925       SCMP_CMP(0, SCMP_CMP_EQ, PF_NETLINK),
 926       SCMP_CMP_MASKED(1, SOCK_CLOEXEC, SOCK_RAW),
 927       SCMP_CMP(2, SCMP_CMP_EQ, 0));
 928   if (rc)
 929     return rc;
 930
 931   return 0;
 932 }
 933
 934 /**
 935  * Function responsible for setting up the socketpair syscall for
 936  * the seccomp filter sandbox.
 937  */
 938 static int
 939 sb_socketpair(scmp_filter_ctx ctx, sandbox_cfg_t *filter)
 940 {
 941   int rc = 0;
 942   (void) filter;
 943
 944 #ifdef __i386__
 945   rc = seccomp_rule_add_0(ctx, SCMP_ACT_ALLOW, SCMP_SYS(socketpair));
 946   if (rc)
 947     return rc;
 948 #endif
 949
 950   rc = seccomp_rule_add_2(ctx, SCMP_ACT_ALLOW, SCMP_SYS(socketpair),
 951       SCMP_CMP(0, SCMP_CMP_EQ, PF_FILE),
 952       SCMP_CMP(1, SCMP_CMP_EQ, SOCK_STREAM|SOCK_CLOEXEC));
 953   if (rc)
 954     return rc;
 955
 956   return 0;
 957 }
 958
 959 #ifdef HAVE_KIST_SUPPORT
 960
 961 #include <linux/sockios.h>
 962
 963 static int
 964 sb_ioctl(scmp_filter_ctx ctx, sandbox_cfg_t *filter)
 965 {
 966   int rc;
 967   (void) filter;
 968
 969   rc = seccomp_rule_add_1(ctx, SCMP_ACT_ALLOW, SCMP_SYS(ioctl),
 970                           SCMP_CMP(1, SCMP_CMP_EQ, SIOCOUTQNSD));
 971   if (rc)
 972     return rc;
 973   return 0;
 974 }
 975
 976 #endif /* defined(HAVE_KIST_SUPPORT) */
 977
 978 /**
 979  * Function responsible for setting up the setsockopt syscall for
 980  * the seccomp filter sandbox.
 981  */
 982 static int
 983 sb_setsockopt(scmp_filter_ctx ctx, sandbox_cfg_t *filter)
 984 {
 985   int rc = 0;
 986   (void) filter;
 987
 988 #ifdef __i386__
 989   rc = seccomp_rule_add_0(ctx, SCMP_ACT_ALLOW, SCMP_SYS(setsockopt));
 990   if (rc)
 991     return rc;
 992 #endif
 993
 994   rc = seccomp_rule_add_2(ctx, SCMP_ACT_ALLOW, SCMP_SYS(setsockopt),
 995       SCMP_CMP(1, SCMP_CMP_EQ, SOL_SOCKET),
 996       SCMP_CMP(2, SCMP_CMP_EQ, SO_REUSEADDR));
 997   if (rc)
 998     return rc;
 999
1000   rc = seccomp_rule_add_2(ctx, SCMP_ACT_ALLOW, SCMP_SYS(setsockopt),
1001       SCMP_CMP(1, SCMP_CMP_EQ, SOL_SOCKET),
1002       SCMP_CMP(2, SCMP_CMP_EQ, SO_SNDBUF));
1003   if (rc)
1004     return rc;
1005
1006   rc = seccomp_rule_add_2(ctx, SCMP_ACT_ALLOW, SCMP_SYS(setsockopt),
1007       SCMP_CMP(1, SCMP_CMP_EQ, SOL_SOCKET),
1008       SCMP_CMP(2, SCMP_CMP_EQ, SO_RCVBUF));
1009   if (rc)
1010     return rc;
1011
1012 #ifdef HAVE_SYSTEMD
1013   rc = seccomp_rule_add_2(ctx, SCMP_ACT_ALLOW, SCMP_SYS(setsockopt),
1014       SCMP_CMP(1, SCMP_CMP_EQ, SOL_SOCKET),
1015       SCMP_CMP(2, SCMP_CMP_EQ, SO_SNDBUFFORCE));
1016   if (rc)
1017     return rc;
1018 #endif /* defined(HAVE_SYSTEMD) */
1019
1020 #ifdef IP_TRANSPARENT
1021   rc = seccomp_rule_add_2(ctx, SCMP_ACT_ALLOW, SCMP_SYS(setsockopt),
1022       SCMP_CMP(1, SCMP_CMP_EQ, SOL_IP),
1023       SCMP_CMP(2, SCMP_CMP_EQ, IP_TRANSPARENT));
1024   if (rc)
1025     return rc;
1026 #endif /* defined(IP_TRANSPARENT) */
1027
1028 #ifdef IPV6_V6ONLY
1029   rc = seccomp_rule_add_2(ctx, SCMP_ACT_ALLOW, SCMP_SYS(setsockopt),
1030       SCMP_CMP(1, SCMP_CMP_EQ, IPPROTO_IPV6),
1031       SCMP_CMP(2, SCMP_CMP_EQ, IPV6_V6ONLY));
1032   if (rc)
1033     return rc;
1034 #endif /* defined(IPV6_V6ONLY) */
1035
1036   return 0;
1037 }
1038
1039 /**
1040  * Function responsible for setting up the getsockopt syscall for
1041  * the seccomp filter sandbox.
1042  */
1043 static int
1044 sb_getsockopt(scmp_filter_ctx ctx, sandbox_cfg_t *filter)
1045 {
1046   int rc = 0;
1047   (void) filter;
1048
1049 #ifdef __i386__
1050   rc = seccomp_rule_add_0(ctx, SCMP_ACT_ALLOW, SCMP_SYS(getsockopt));
1051   if (rc)
1052     return rc;
1053 #endif
1054
1055   rc = seccomp_rule_add_2(ctx, SCMP_ACT_ALLOW, SCMP_SYS(getsockopt),
1056       SCMP_CMP(1, SCMP_CMP_EQ, SOL_SOCKET),
1057       SCMP_CMP(2, SCMP_CMP_EQ, SO_ERROR));
1058   if (rc)
1059     return rc;
1060
1061   rc = seccomp_rule_add_2(ctx, SCMP_ACT_ALLOW, SCMP_SYS(getsockopt),
1062       SCMP_CMP(1, SCMP_CMP_EQ, SOL_SOCKET),
1063       SCMP_CMP(2, SCMP_CMP_EQ, SO_ACCEPTCONN));
1064   if (rc)
1065     return rc;
1066
1067 #ifdef HAVE_SYSTEMD
1068   rc = seccomp_rule_add_2(ctx, SCMP_ACT_ALLOW, SCMP_SYS(getsockopt),
1069       SCMP_CMP(1, SCMP_CMP_EQ, SOL_SOCKET),
1070       SCMP_CMP(2, SCMP_CMP_EQ, SO_SNDBUF));
1071   if (rc)
1072     return rc;
1073 #endif /* defined(HAVE_SYSTEMD) */
1074
1075 #ifdef HAVE_LINUX_NETFILTER_IPV4_H
1076   rc = seccomp_rule_add_2(ctx, SCMP_ACT_ALLOW, SCMP_SYS(getsockopt),
1077       SCMP_CMP(1, SCMP_CMP_EQ, SOL_IP),
1078       SCMP_CMP(2, SCMP_CMP_EQ, SO_ORIGINAL_DST));
1079   if (rc)
1080     return rc;
1081 #endif /* defined(HAVE_LINUX_NETFILTER_IPV4_H) */
1082
1083 #ifdef HAVE_LINUX_NETFILTER_IPV6_IP6_TABLES_H
1084   rc = seccomp_rule_add_2(ctx, SCMP_ACT_ALLOW, SCMP_SYS(getsockopt),
1085       SCMP_CMP(1, SCMP_CMP_EQ, SOL_IPV6),
1086       SCMP_CMP(2, SCMP_CMP_EQ, IP6T_SO_ORIGINAL_DST));
1087   if (rc)
1088     return rc;
1089 #endif /* defined(HAVE_LINUX_NETFILTER_IPV6_IP6_TABLES_H) */
1090
1091 #ifdef HAVE_KIST_SUPPORT
1092 #include <netinet/tcp.h>
1093   rc = seccomp_rule_add_2(ctx, SCMP_ACT_ALLOW, SCMP_SYS(getsockopt),
1094       SCMP_CMP(1, SCMP_CMP_EQ, SOL_TCP),
1095       SCMP_CMP(2, SCMP_CMP_EQ, TCP_INFO));
1096   if (rc)
1097     return rc;
1098 #endif /* defined(HAVE_KIST_SUPPORT) */
1099
1100   return 0;
1101 }
1102
1103 #ifdef __NR_fcntl64
1104 /**
1105  * Function responsible for setting up the fcntl64 syscall for
1106  * the seccomp filter sandbox.
1107  */
1108 static int
1109 sb_fcntl64(scmp_filter_ctx ctx, sandbox_cfg_t *filter)
1110 {
1111   int rc = 0;
1112   (void) filter;
1113
1114   rc = seccomp_rule_add_1(ctx, SCMP_ACT_ALLOW, SCMP_SYS(fcntl64),
1115       SCMP_CMP(1, SCMP_CMP_EQ, F_GETFL));
1116   if (rc)
1117     return rc;
1118
1119   rc = seccomp_rule_add_2(ctx, SCMP_ACT_ALLOW, SCMP_SYS(fcntl64),
1120       SCMP_CMP(1, SCMP_CMP_EQ, F_SETFL),
1121       SCMP_CMP(2, SCMP_CMP_EQ, O_RDWR|O_NONBLOCK));
1122   if (rc)
1123     return rc;
1124
1125   rc = seccomp_rule_add_1(ctx, SCMP_ACT_ALLOW, SCMP_SYS(fcntl64),
1126       SCMP_CMP(1, SCMP_CMP_EQ, F_GETFD));
1127   if (rc)
1128     return rc;
1129
1130   rc = seccomp_rule_add_2(ctx, SCMP_ACT_ALLOW, SCMP_SYS(fcntl64),
1131       SCMP_CMP(1, SCMP_CMP_EQ, F_SETFD),
1132       SCMP_CMP(2, SCMP_CMP_EQ, FD_CLOEXEC));
1133   if (rc)
1134     return rc;
1135
1136   return 0;
1137 }
1138 #endif /* defined(__NR_fcntl64) */
1139
1140 /**
1141  * Function responsible for setting up the epoll_ctl syscall for
1142  * the seccomp filter sandbox.
1143  *
1144  *  Note: basically allows everything but will keep for now..
1145  */
1146 static int
1147 sb_epoll_ctl(scmp_filter_ctx ctx, sandbox_cfg_t *filter)
1148 {
1149   int rc = 0;
1150   (void) filter;
1151
1152   rc = seccomp_rule_add_1(ctx, SCMP_ACT_ALLOW, SCMP_SYS(epoll_ctl),
1153       SCMP_CMP(1, SCMP_CMP_EQ, EPOLL_CTL_ADD));
1154   if (rc)
1155     return rc;
1156
1157   rc = seccomp_rule_add_1(ctx, SCMP_ACT_ALLOW, SCMP_SYS(epoll_ctl),
1158       SCMP_CMP(1, SCMP_CMP_EQ, EPOLL_CTL_MOD));
1159   if (rc)
1160     return rc;
1161
1162   rc = seccomp_rule_add_1(ctx, SCMP_ACT_ALLOW, SCMP_SYS(epoll_ctl),
1163       SCMP_CMP(1, SCMP_CMP_EQ, EPOLL_CTL_DEL));
1164   if (rc)
1165     return rc;
1166
1167   return 0;
1168 }
1169
1170 /**
1171  * Function responsible for setting up the prctl syscall for
1172  * the seccomp filter sandbox.
1173  *
1174  * NOTE: if multiple filters need to be added, the PR_SECCOMP parameter needs
1175  * to be allowlisted in this function.
1176  */
1177 static int
1178 sb_prctl(scmp_filter_ctx ctx, sandbox_cfg_t *filter)
1179 {
1180   int rc = 0;
1181   (void) filter;
1182
1183 #ifdef ENABLE_FRAGILE_HARDENING
1184   rc = seccomp_rule_add_1(ctx, SCMP_ACT_ALLOW, SCMP_SYS(prctl),
1185       SCMP_CMP(0, SCMP_CMP_EQ, PR_GET_DUMPABLE));
1186   if (rc)
1187     return rc;
1188
1189   rc = seccomp_rule_add_1(ctx, SCMP_ACT_ALLOW, SCMP_SYS(prctl),
1190       SCMP_CMP(0, SCMP_CMP_EQ, PR_SET_PTRACER));
1191   if (rc)
1192     return rc;
1193 #endif
1194
1195   rc = seccomp_rule_add_1(ctx, SCMP_ACT_ALLOW, SCMP_SYS(prctl),
1196       SCMP_CMP(0, SCMP_CMP_EQ, PR_SET_DUMPABLE));
1197   if (rc)
1198     return rc;
1199
1200   return 0;
1201 }
1202
1203 /**
1204  * Function responsible for setting up the mprotect syscall for
1205  * the seccomp filter sandbox.
1206  *
1207  * NOTE: does not NEED to be here.. currently only occurs before filter; will
1208  * keep just in case for the future.
1209  */
1210 static int
1211 sb_mprotect(scmp_filter_ctx ctx, sandbox_cfg_t *filter)
1212 {
1213   int rc = 0;
1214   (void) filter;
1215
1216   rc = seccomp_rule_add_1(ctx, SCMP_ACT_ALLOW, SCMP_SYS(mprotect),
1217       SCMP_CMP(2, SCMP_CMP_EQ, PROT_READ));
1218   if (rc)
1219     return rc;
1220
1221   rc = seccomp_rule_add_1(ctx, SCMP_ACT_ALLOW, SCMP_SYS(mprotect),
1222       SCMP_CMP(2, SCMP_CMP_EQ, PROT_NONE));
1223   if (rc)
1224     return rc;
1225
1226   return 0;
1227 }
1228
1229 /**
1230  * Function responsible for setting up the rt_sigprocmask syscall for
1231  * the seccomp filter sandbox.
1232  */
1233 static int
1234 sb_rt_sigprocmask(scmp_filter_ctx ctx, sandbox_cfg_t *filter)
1235 {
1236   int rc = 0;
1237   (void) filter;
1238
1239 #ifdef ENABLE_FRAGILE_HARDENING
1240   rc = seccomp_rule_add_1(ctx, SCMP_ACT_ALLOW, SCMP_SYS(rt_sigprocmask),
1241       SCMP_CMP(0, SCMP_CMP_EQ, SIG_BLOCK));
1242   if (rc)
1243     return rc;
1244 #endif
1245
1246   rc = seccomp_rule_add_1(ctx, SCMP_ACT_ALLOW, SCMP_SYS(rt_sigprocmask),
1247       SCMP_CMP(0, SCMP_CMP_EQ, SIG_UNBLOCK));
1248   if (rc)
1249     return rc;
1250
1251   rc = seccomp_rule_add_1(ctx, SCMP_ACT_ALLOW, SCMP_SYS(rt_sigprocmask),
1252       SCMP_CMP(0, SCMP_CMP_EQ, SIG_SETMASK));
1253   if (rc)
1254     return rc;
1255
1256   return 0;
1257 }
1258
1259 /**
1260  * Function responsible for setting up the flock syscall for
1261  * the seccomp filter sandbox.
1262  *
1263  *  NOTE: does not need to be here, occurs before filter is applied.
1264  */
1265 static int
1266 sb_flock(scmp_filter_ctx ctx, sandbox_cfg_t *filter)
1267 {
1268   int rc = 0;
1269   (void) filter;
1270
1271   rc = seccomp_rule_add_1(ctx, SCMP_ACT_ALLOW, SCMP_SYS(flock),
1272       SCMP_CMP(1, SCMP_CMP_EQ, LOCK_EX|LOCK_NB));
1273   if (rc)
1274     return rc;
1275
1276   rc = seccomp_rule_add_1(ctx, SCMP_ACT_ALLOW, SCMP_SYS(flock),
1277       SCMP_CMP(1, SCMP_CMP_EQ, LOCK_UN));
1278   if (rc)
1279     return rc;
1280
1281   return 0;
1282 }
1283
1284 /**
1285  * Function responsible for setting up the futex syscall for
1286  * the seccomp filter sandbox.
1287  */
1288 static int
1289 sb_futex(scmp_filter_ctx ctx, sandbox_cfg_t *filter)
1290 {
1291   int rc = 0;
1292   (void) filter;
1293
1294   // can remove
1295   rc = seccomp_rule_add_1(ctx, SCMP_ACT_ALLOW, SCMP_SYS(futex),
1296       SCMP_CMP(1, SCMP_CMP_EQ,
1297           FUTEX_WAIT_BITSET_PRIVATE|FUTEX_CLOCK_REALTIME));
1298   if (rc)
1299     return rc;
1300
1301   rc = seccomp_rule_add_1(ctx, SCMP_ACT_ALLOW, SCMP_SYS(futex),
1302       SCMP_CMP(1, SCMP_CMP_EQ, FUTEX_WAKE_PRIVATE));
1303   if (rc)
1304     return rc;
1305
1306   rc = seccomp_rule_add_1(ctx, SCMP_ACT_ALLOW, SCMP_SYS(futex),
1307       SCMP_CMP(1, SCMP_CMP_EQ, FUTEX_WAIT_PRIVATE));
1308   if (rc)
1309     return rc;
1310
1311   return 0;
1312 }
1313
1314 /**
1315  * Function responsible for setting up the mremap syscall for
1316  * the seccomp filter sandbox.
1317  *
1318  *  NOTE: so far only occurs before filter is applied.
1319  */
1320 static int
1321 sb_mremap(scmp_filter_ctx ctx, sandbox_cfg_t *filter)
1322 {
1323   int rc = 0;
1324   (void) filter;
1325
1326   rc = seccomp_rule_add_1(ctx, SCMP_ACT_ALLOW, SCMP_SYS(mremap),
1327       SCMP_CMP(3, SCMP_CMP_EQ, MREMAP_MAYMOVE));
1328   if (rc)
1329     return rc;
1330
1331   return 0;
1332 }
1333
1334 #ifdef __NR_stat64
1335 /**
1336  * Function responsible for setting up the stat64 syscall for
1337  * the seccomp filter sandbox.
1338  */
1339 static int
1340 sb_stat64(scmp_filter_ctx ctx, sandbox_cfg_t *filter)
1341 {
1342   int rc = 0;
1343   sandbox_cfg_t *elem = NULL;
1344
1345   // for each dynamic parameter filters
1346   for (elem = filter; elem != NULL; elem = elem->next) {
1347     smp_param_t *param = elem->param;
1348
1349     if (param != NULL && param->prot == 1 && (param->syscall == SCMP_SYS(open)
1350         || param->syscall == SCMP_SYS(stat64))) {
1351       rc = seccomp_rule_add_1(ctx, SCMP_ACT_ALLOW, SCMP_SYS(stat64),
1352           SCMP_CMP_STR(0, SCMP_CMP_EQ, param->value));
1353       if (rc != 0) {
1354         log_err(LD_BUG,"(Sandbox) failed to add stat64 syscall, received "
1355             "libseccomp error %d", rc);
1356         return rc;
1357       }
1358     }
1359   }
1360
1361   return 0;
1362 }
1363 #endif /* defined(__NR_stat64) */
1364
1365 static int
1366 sb_kill(scmp_filter_ctx ctx, sandbox_cfg_t *filter)
1367 {
1368   (void) filter;
1369 #ifdef __NR_kill
1370   /* Allow killing anything with signal 0 -- it isn't really a kill. */
1371   return seccomp_rule_add_1(ctx, SCMP_ACT_ALLOW, SCMP_SYS(kill),
1372        SCMP_CMP(1, SCMP_CMP_EQ, 0));
1373 #else
1374   return 0;
1375 #endif /* defined(__NR_kill) */
1376 }
1377
1378 /**
1379  * Array of function pointers responsible for filtering different syscalls at
1380  * a parameter level.
1381  */
1382 static sandbox_filter_func_t filter_func[] = {
1383     sb_rt_sigaction,
1384     sb_rt_sigprocmask,
1385 #ifdef __NR_time
1386     sb_time,
1387 #endif
1388     sb_accept4,
1389 #ifdef __NR_mmap2
1390     sb_mmap2,
1391 #endif
1392 #ifdef __i386__
1393     sb_chown32,
1394 #else
1395     sb_chown,
1396 #endif
1397     sb_fchownat,
1398     sb_chmod,
1399     sb_fchmodat,
1400     sb_open,
1401     sb_openat,
1402     sb_opendir,
1403 #ifdef ENABLE_FRAGILE_HARDENING
1404     sb_ptrace,
1405 #endif
1406     sb_rename,
1407     sb_renameat,
1408 #ifdef __NR_fcntl64
1409     sb_fcntl64,
1410 #endif
1411     sb_epoll_ctl,
1412     sb_prctl,
1413     sb_mprotect,
1414     sb_flock,
1415     sb_futex,
1416     sb_mremap,
1417 #ifdef __NR_stat64
1418     sb_stat64,
1419 #endif
1420
1421     sb_socket,
1422     sb_setsockopt,
1423     sb_getsockopt,
1424     sb_socketpair,
1425 #ifdef HAVE_KIST_SUPPORT
1426     sb_ioctl,
1427 #endif
1428     sb_kill
1429 };
1430
1431 /**
1432  * Return the interned (and hopefully sandbox-permitted) string equal
1433  * to @a str.
1434  *
1435  * Return NULL if `str` is NULL, or `str` is not an interned string.
1436  **/
1437 const char *
1438 sandbox_intern_string(const char *str)
1439 {
1440   const char *interned = sandbox_get_interned_string(str);
1441
1442   if (sandbox_active && str != NULL && interned == NULL) {
1443     log_warn(LD_BUG, "No interned sandbox parameter found for %s", str);
1444   }
1445
1446   return interned ? interned : str;
1447 }
1448
1449 /**
1450  * Return true if the sandbox is running and we are missing an interned string
1451  * equal to @a str.
1452  */
1453 bool
1454 sandbox_interned_string_is_missing(const char *str)
1455 {
1456   return sandbox_active && sandbox_get_interned_string(str) == NULL;
1457 }
1458
1459 /**
1460  * Try to find and return the interned string equal to @a str.
1461  *
1462  * If there is no such string, return NULL.
1463  **/
1464 static const char *
1465 sandbox_get_interned_string(const char *str)
1466 {
1467   sandbox_cfg_t *elem;
1468
1469   if (str == NULL)
1470     return NULL;
1471
1472   for (elem = filter_dynamic; elem != NULL; elem = elem->next) {
1473     smp_param_t *param = elem->param;
1474
1475     if (param->prot) {
1476       if (!strcmp(str, (char*)(param->value))) {
1477         return (char*)param->value;
1478       }
1479       if (param->value2 && !strcmp(str, (char*)param->value2)) {
1480         return (char*)param->value2;
1481       }
1482     }
1483   }
1484
1485   return NULL;
1486 }
1487
1488 /* DOCDOC */
1489 static int
1490 prot_strings_helper(strmap_t *locations,
1491                     char **pr_mem_next_p,
1492                     size_t *pr_mem_left_p,
1493                     char **value_p)
1494 {
1495   char *param_val;
1496   size_t param_size;
1497   void *location;
1498
1499   if (*value_p == 0)
1500     return 0;
1501
1502   param_val = (char*) *value_p;
1503   param_size = strlen(param_val) + 1;
1504   location = strmap_get(locations, param_val);
1505
1506   if (location) {
1507     // We already interned this string.
1508     tor_free(param_val);
1509     *value_p = location;
1510     return 0;
1511   } else if (*pr_mem_left_p >= param_size) {
1512     // copy to protected
1513     location = *pr_mem_next_p;
1514     memcpy(location, param_val, param_size);
1515
1516     // re-point el parameter to protected
1517     tor_free(param_val);
1518     *value_p = location;
1519
1520     strmap_set(locations, location, location); /* good real estate advice */
1521
1522     // move next available protected memory
1523     *pr_mem_next_p += param_size;
1524     *pr_mem_left_p -= param_size;
1525     return 0;
1526   } else {
1527     log_err(LD_BUG,"(Sandbox) insufficient protected memory!");
1528     return -1;
1529   }
1530 }
1531
1532 /**
1533  * Protects all the strings in the sandbox's parameter list configuration. It
1534  * works by calculating the total amount of memory required by the parameter
1535  * list, allocating the memory using mmap, and protecting it from writes with
1536  * mprotect().
1537  */
1538 static int
1539 prot_strings(scmp_filter_ctx ctx, sandbox_cfg_t* cfg)
1540 {
1541   int ret = 0;
1542   size_t pr_mem_size = 0, pr_mem_left = 0;
1543   char *pr_mem_next = NULL, *pr_mem_base;
1544   sandbox_cfg_t *el = NULL;
1545   strmap_t *locations = NULL;
1546
1547   // get total number of bytes required to mmap. (Overestimate.)
1548   for (el = cfg; el != NULL; el = el->next) {
1549     pr_mem_size += strlen((char*) el->param->value) + 1;
1550     if (el->param->value2)
1551       pr_mem_size += strlen((char*) el->param->value2) + 1;
1552   }
1553
1554   // allocate protected memory with MALLOC_MP_LIM canary
1555   pr_mem_base = (char*) mmap(NULL, MALLOC_MP_LIM + pr_mem_size,
1556       PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANON, -1, 0);
1557   if (pr_mem_base == MAP_FAILED) {
1558     log_err(LD_BUG,"(Sandbox) failed allocate protected memory! mmap: %s",
1559         strerror(errno));
1560     ret = -1;
1561     goto out;
1562   }
1563
1564   pr_mem_next = pr_mem_base + MALLOC_MP_LIM;
1565   pr_mem_left = pr_mem_size;
1566
1567   locations = strmap_new();
1568
1569   // change el value pointer to protected
1570   for (el = cfg; el != NULL; el = el->next) {
1571     if (prot_strings_helper(locations, &pr_mem_next, &pr_mem_left,
1572                             &el->param->value) < 0) {
1573       ret = -2;
1574       goto out;
1575     }
1576     if (prot_strings_helper(locations, &pr_mem_next, &pr_mem_left,
1577                             &el->param->value2) < 0) {
1578       ret = -2;
1579       goto out;
1580     }
1581     el->param->prot = 1;
1582   }
1583
1584   // protecting from writes
1585   if (mprotect(pr_mem_base, MALLOC_MP_LIM + pr_mem_size, PROT_READ)) {
1586     log_err(LD_BUG,"(Sandbox) failed to protect memory! mprotect: %s",
1587         strerror(errno));
1588     ret = -3;
1589     goto out;
1590   }
1591
1592   /*
1593    * Setting sandbox restrictions so the string memory cannot be tampered with
1594    */
1595   // no mremap of the protected base address
1596   ret = seccomp_rule_add_1(ctx, SCMP_ACT_KILL, SCMP_SYS(mremap),
1597       SCMP_CMP(0, SCMP_CMP_EQ, (intptr_t) pr_mem_base));
1598   if (ret) {
1599     log_err(LD_BUG,"(Sandbox) mremap protected memory filter fail!");
1600     goto out;
1601   }
1602
1603   // no munmap of the protected base address
1604   ret = seccomp_rule_add_1(ctx, SCMP_ACT_KILL, SCMP_SYS(munmap),
1605         SCMP_CMP(0, SCMP_CMP_EQ, (intptr_t) pr_mem_base));
1606   if (ret) {
1607     log_err(LD_BUG,"(Sandbox) munmap protected memory filter fail!");
1608     goto out;
1609   }
1610
1611   /*
1612    * Allow mprotect with PROT_READ|PROT_WRITE because openssl uses it, but
1613    * never over the memory region used by the protected strings.
1614    *
1615    * PROT_READ|PROT_WRITE was originally fully allowed in sb_mprotect(), but
1616    * had to be removed due to limitation of libseccomp regarding intervals.
1617    *
1618    * There is a restriction on how much you can mprotect with R|W up to the
1619    * size of the canary.
1620    */
1621   ret = seccomp_rule_add_3(ctx, SCMP_ACT_ALLOW, SCMP_SYS(mprotect),
1622       SCMP_CMP(0, SCMP_CMP_LT, (intptr_t) pr_mem_base),
1623       SCMP_CMP(1, SCMP_CMP_LE, MALLOC_MP_LIM),
1624       SCMP_CMP(2, SCMP_CMP_EQ, PROT_READ|PROT_WRITE));
1625   if (ret) {
1626     log_err(LD_BUG,"(Sandbox) mprotect protected memory filter fail (LT)!");
1627     goto out;
1628   }
1629
1630   ret = seccomp_rule_add_3(ctx, SCMP_ACT_ALLOW, SCMP_SYS(mprotect),
1631       SCMP_CMP(0, SCMP_CMP_GT, (intptr_t) pr_mem_base + pr_mem_size +
1632           MALLOC_MP_LIM),
1633       SCMP_CMP(1, SCMP_CMP_LE, MALLOC_MP_LIM),
1634       SCMP_CMP(2, SCMP_CMP_EQ, PROT_READ|PROT_WRITE));
1635   if (ret) {
1636     log_err(LD_BUG,"(Sandbox) mprotect protected memory filter fail (GT)!");
1637     goto out;
1638   }
1639
1640  out:
1641   strmap_free(locations, NULL);
1642   return ret;
1643 }
1644
1645 /**
1646  * Auxiliary function used in order to allocate a sandbox_cfg_t element and set
1647  * its values according the parameter list. All elements are initialised
1648  * with the 'prot' field set to false, as the pointer is not protected at this
1649  * point.
1650  */
1651 static sandbox_cfg_t*
1652 new_element2(int syscall, char *value, char *value2)
1653 {
1654   smp_param_t *param = NULL;
1655
1656   sandbox_cfg_t *elem = tor_malloc_zero(sizeof(sandbox_cfg_t));
1657   param = elem->param = tor_malloc_zero(sizeof(smp_param_t));
1658
1659   param->syscall = syscall;
1660   param->value = value;
1661   param->value2 = value2;
1662   param->prot = 0;
1663
1664   return elem;
1665 }
1666
1667 static sandbox_cfg_t*
1668 new_element(int syscall, char *value)
1669 {
1670   return new_element2(syscall, value, NULL);
1671 }
1672
1673 #ifdef __i386__
1674 #define SCMP_chown SCMP_SYS(chown32)
1675 #elif defined(__aarch64__) && defined(__LP64__)
1676 #define SCMP_chown SCMP_SYS(fchownat)
1677 #else
1678 #define SCMP_chown SCMP_SYS(chown)
1679 #endif
1680
1681 #if defined(__aarch64__) && defined(__LP64__)
1682 #define SCMP_chmod SCMP_SYS(fchmodat)
1683 #else
1684 #define SCMP_chmod SCMP_SYS(chmod)
1685 #endif
1686
1687 #if defined(__aarch64__) && defined(__LP64__)
1688 #define SCMP_rename SCMP_SYS(renameat)
1689 #else
1690 #define SCMP_rename SCMP_SYS(rename)
1691 #endif
1692
1693 #ifdef __NR_stat64
1694 #define SCMP_stat SCMP_SYS(stat64)
1695 #else
1696 #define SCMP_stat SCMP_SYS(stat)
1697 #endif
1698
1699 int
1700 sandbox_cfg_allow_stat_filename(sandbox_cfg_t **cfg, char *file)
1701 {
1702   sandbox_cfg_t *elem = NULL;
1703
1704   elem = new_element(SCMP_stat, file);
1705
1706   elem->next = *cfg;
1707   *cfg = elem;
1708
1709   return 0;
1710 }
1711
1712 int
1713 sandbox_cfg_allow_open_filename(sandbox_cfg_t **cfg, char *file)
1714 {
1715   sandbox_cfg_t *elem = NULL;
1716
1717   elem = new_element(SCMP_SYS(open), file);
1718
1719   elem->next = *cfg;
1720   *cfg = elem;
1721
1722   return 0;
1723 }
1724
1725 int
1726 sandbox_cfg_allow_chmod_filename(sandbox_cfg_t **cfg, char *file)
1727 {
1728   sandbox_cfg_t *elem = NULL;
1729
1730   elem = new_element(SCMP_chmod, file);
1731
1732   elem->next = *cfg;
1733   *cfg = elem;
1734
1735   return 0;
1736 }
1737
1738 int
1739 sandbox_cfg_allow_chown_filename(sandbox_cfg_t **cfg, char *file)
1740 {
1741   sandbox_cfg_t *elem = NULL;
1742
1743   elem = new_element(SCMP_chown, file);
1744
1745   elem->next = *cfg;
1746   *cfg = elem;
1747
1748   return 0;
1749 }
1750
1751 int
1752 sandbox_cfg_allow_rename(sandbox_cfg_t **cfg, char *file1, char *file2)
1753 {
1754   sandbox_cfg_t *elem = NULL;
1755
1756   elem = new_element2(SCMP_rename, file1, file2);
1757
1758   elem->next = *cfg;
1759   *cfg = elem;
1760
1761   return 0;
1762 }
1763
1764 int
1765 sandbox_cfg_allow_openat_filename(sandbox_cfg_t **cfg, char *file)
1766 {
1767   sandbox_cfg_t *elem = NULL;
1768
1769   elem = new_element(SCMP_SYS(openat), file);
1770
1771   elem->next = *cfg;
1772   *cfg = elem;
1773
1774   return 0;
1775 }
1776
1777 int
1778 sandbox_cfg_allow_opendir_dirname(sandbox_cfg_t **cfg, char *dir)
1779 {
1780   sandbox_cfg_t *elem = NULL;
1781
1782   elem = new_element(PHONY_OPENDIR_SYSCALL, dir);
1783
1784   elem->next = *cfg;
1785   *cfg = elem;
1786
1787   return 0;
1788 }
1789
1790 /**
1791  * Function responsible for going through the parameter syscall filters and
1792  * call each function pointer in the list.
1793  */
1794 static int
1795 add_param_filter(scmp_filter_ctx ctx, sandbox_cfg_t* cfg)
1796 {
1797   unsigned i;
1798   int rc = 0;
1799
1800   // function pointer
1801   for (i = 0; i < ARRAY_LENGTH(filter_func); i++) {
1802     rc = filter_func[i](ctx, cfg);
1803     if (rc) {
1804       log_err(LD_BUG,"(Sandbox) failed to add syscall %d, received libseccomp "
1805           "error %d", i, rc);
1806       return rc;
1807     }
1808   }
1809
1810   return 0;
1811 }
1812
1813 /**
1814  * Function responsible of loading the libseccomp syscall filters which do not
1815  * have parameter filtering.
1816  */
1817 static int
1818 add_noparam_filter(scmp_filter_ctx ctx)
1819 {
1820   unsigned i;
1821   int rc = 0;
1822
1823   // add general filters
1824   for (i = 0; i < ARRAY_LENGTH(filter_nopar_gen); i++) {
1825     rc = seccomp_rule_add_0(ctx, SCMP_ACT_ALLOW, filter_nopar_gen[i]);
1826     if (rc != 0) {
1827       log_err(LD_BUG,"(Sandbox) failed to add syscall index %d (NR=%d), "
1828           "received libseccomp error %d", i, filter_nopar_gen[i], rc);
1829       return rc;
1830     }
1831   }
1832
1833   if (is_libc_at_least(2, 33)) {
1834 #ifdef __NR_newfstatat
1835     // Libc 2.33 uses this syscall to implement both fstat() and stat().
1836     //
1837     // The trouble is that to implement fstat(fd, &st), it calls:
1838     //     newfstatat(fs, "", &st, AT_EMPTY_PATH)
1839     // We can't detect this usage in particular, because "" is a pointer
1840     // we don't control.  And we can't just look for AT_EMPTY_PATH, since
1841     // AT_EMPTY_PATH only has effect when the path string is empty.
1842     //
1843     // So our only solution seems to be allowing all fstatat calls, which
1844     // means that an attacker can stat() anything on the filesystem. That's
1845     // not a great solution, but I can't find a better one.
1846     rc = seccomp_rule_add_0(ctx, SCMP_ACT_ALLOW, SCMP_SYS(newfstatat));
1847     if (rc != 0) {
1848       log_err(LD_BUG,"(Sandbox) failed to add newfstatat() syscall; "
1849           "received libseccomp error %d", rc);
1850       return rc;
1851     }
1852 #endif
1853   }
1854
1855   return 0;
1856 }
1857
1858 /**
1859  * Function responsible for setting up and enabling a global syscall filter.
1860  * The function is a prototype developed for stage 1 of sandboxing Tor.
1861  * Returns 0 on success.
1862  */
1863 static int
1864 install_syscall_filter(sandbox_cfg_t* cfg)
1865 {
1866   int rc = 0;
1867   scmp_filter_ctx ctx;
1868
1869   ctx = seccomp_init(SCMP_ACT_ERRNO(EPERM));
1870   if (ctx == NULL) {
1871     log_err(LD_BUG,"(Sandbox) failed to initialise libseccomp context");
1872     rc = -1;
1873     goto end;
1874   }
1875
1876   // protecting sandbox parameter strings
1877   if ((rc = prot_strings(ctx, cfg))) {
1878     goto end;
1879   }
1880
1881   // add parameter filters
1882   if ((rc = add_param_filter(ctx, cfg))) {
1883     log_err(LD_BUG, "(Sandbox) failed to add param filters!");
1884     goto end;
1885   }
1886
1887   // adding filters with no parameters
1888   if ((rc = add_noparam_filter(ctx))) {
1889     log_err(LD_BUG, "(Sandbox) failed to add param filters!");
1890     goto end;
1891   }
1892
1893   // loading the seccomp2 filter
1894   if ((rc = seccomp_load(ctx))) {
1895     log_err(LD_BUG, "(Sandbox) failed to load: %d (%s)! "
1896             "Are you sure that your kernel has seccomp2 support? The "
1897             "sandbox won't work without it.", rc,
1898             strerror(-rc));
1899     goto end;
1900   }
1901
1902   // marking the sandbox as active
1903   sandbox_active = 1;
1904
1905  end:
1906   seccomp_release(ctx);
1907   return (rc < 0 ? -rc : rc);
1908 }
1909
1910 #ifdef SYSCALL_NAME_DEBUGGING
1911 #include "lib/sandbox/linux_syscalls.inc"
1912
1913 /** Return a string containing the name of a given syscall (if we know it) */
1914 static const char *
1915 get_syscall_name(int syscall_num)
1916 {
1917   int i;
1918   for (i = 0; SYSCALLS_BY_NUMBER[i].syscall_name; ++i) {
1919     if (SYSCALLS_BY_NUMBER[i].syscall_num == syscall_num)
1920       return SYSCALLS_BY_NUMBER[i].syscall_name;
1921   }
1922
1923   {
1924      static char syscall_name_buf[64];
1925      format_dec_number_sigsafe(syscall_num,
1926                                syscall_name_buf, sizeof(syscall_name_buf));
1927      return syscall_name_buf;
1928   }
1929 }
1930
1931 /** Return the syscall number from a ucontext_t that we got in a signal
1932  * handler (if we know how to do that). */
1933 static int
1934 get_syscall_from_ucontext(const ucontext_t *ctx)
1935 {
1936   return (int) ctx->uc_mcontext.M_SYSCALL;
1937 }
1938 #else /* !defined(SYSCALL_NAME_DEBUGGING) */
1939 static const char *
1940 get_syscall_name(int syscall_num)
1941 {
1942   (void) syscall_num;
1943   return "unknown";
1944 }
1945 static int
1946 get_syscall_from_ucontext(const ucontext_t *ctx)
1947 {
1948   (void) ctx;
1949   return -1;
1950 }
1951 #endif /* defined(SYSCALL_NAME_DEBUGGING) */
1952
1953 #ifdef USE_BACKTRACE
1954 #define MAX_DEPTH 256
1955 static void *syscall_cb_buf[MAX_DEPTH];
1956 #endif
1957
1958 /**
1959  * Function called when a SIGSYS is caught by the application. It notifies the
1960  * user that an error has occurred and either terminates or allows the
1961  * application to continue execution, based on the DEBUGGING_CLOSE symbol.
1962  */
1963 static void
1964 sigsys_debugging(int nr, siginfo_t *info, void *void_context)
1965 {
1966   ucontext_t *ctx = (ucontext_t *) (void_context);
1967   const char *syscall_name;
1968 #ifdef USE_BACKTRACE
1969   size_t depth;
1970   int n_fds, i;
1971   const int *fds = NULL;
1972 #endif
1973
1974   (void) nr;
1975
1976   if (info->si_code != SYS_SECCOMP)
1977     return;
1978
1979   if (!ctx)
1980     return;
1981
1982   int syscall = get_syscall_from_ucontext(ctx);
1983
1984 #ifdef USE_BACKTRACE
1985   depth = backtrace(syscall_cb_buf, MAX_DEPTH);
1986   /* Clean up the top stack frame so we get the real function
1987    * name for the most recently failing function. */
1988   clean_backtrace(syscall_cb_buf, depth, ctx);
1989 #endif /* defined(USE_BACKTRACE) */
1990
1991   syscall_name = get_syscall_name(syscall);
1992
1993   tor_log_err_sigsafe("(Sandbox) Caught a bad syscall attempt (syscall ",
1994                       syscall_name,
1995                       ")\n",
1996                       NULL);
1997
1998 #ifdef USE_BACKTRACE
1999   n_fds = tor_log_get_sigsafe_err_fds(&fds);
2000   for (i=0; i < n_fds; ++i)
2001     backtrace_symbols_fd(syscall_cb_buf, (int)depth, fds[i]);
2002 #endif
2003
2004 #if defined(DEBUGGING_CLOSE)
2005   _exit(1); // exit ok: programming error has led to sandbox failure.
2006 #endif // DEBUGGING_CLOSE
2007 }
2008
2009 /**
2010  * Function that adds a handler for SIGSYS, which is the signal thrown
2011  * when the application is issuing a syscall which is not allowed. The
2012  * main purpose of this function is to help with debugging by identifying
2013  * filtered syscalls.
2014  */
2015 static int
2016 install_sigsys_debugging(void)
2017 {
2018   struct sigaction act;
2019   sigset_t mask;
2020
2021   memset(&act, 0, sizeof(act));
2022   sigemptyset(&mask);
2023   sigaddset(&mask, SIGSYS);
2024
2025   act.sa_sigaction = &sigsys_debugging;
2026   act.sa_flags = SA_SIGINFO;
2027   if (sigaction(SIGSYS, &act, NULL) < 0) {
2028     log_err(LD_BUG,"(Sandbox) Failed to register SIGSYS signal handler");
2029     return -1;
2030   }
2031
2032   if (sigprocmask(SIG_UNBLOCK, &mask, NULL)) {
2033     log_err(LD_BUG,"(Sandbox) Failed call to sigprocmask()");
2034     return -2;
2035   }
2036
2037   return 0;
2038 }
2039
2040 /**
2041  * Function responsible of registering the sandbox_cfg_t list of parameter
2042  * syscall filters to the existing parameter list. This is used for incipient
2043  * multiple-sandbox support.
2044  */
2045 static int
2046 register_cfg(sandbox_cfg_t* cfg)
2047 {
2048   sandbox_cfg_t *elem = NULL;
2049
2050   if (filter_dynamic == NULL) {
2051     filter_dynamic = cfg;
2052     return 0;
2053   }
2054
2055   for (elem = filter_dynamic; elem->next != NULL; elem = elem->next)
2056     ;
2057
2058   elem->next = cfg;
2059
2060   return 0;
2061 }
2062
2063 #endif /* defined(USE_LIBSECCOMP) */
2064
2065 #ifdef USE_LIBSECCOMP
2066 /**
2067  * Initialises the syscall sandbox filter for any linux architecture, taking
2068  * into account various available features for different linux flavours.
2069  */
2070 static int
2071 initialise_libseccomp_sandbox(sandbox_cfg_t* cfg)
2072 {
2073   /* Prevent glibc from trying to open /dev/tty on fatal error */
2074   setenv("LIBC_FATAL_STDERR_", "1", 1);
2075
2076   if (install_sigsys_debugging())
2077     return -1;
2078
2079   if (install_syscall_filter(cfg))
2080     return -2;
2081
2082   if (register_cfg(cfg))
2083     return -3;
2084
2085   return 0;
2086 }
2087
2088 int
2089 sandbox_is_active(void)
2090 {
2091   return sandbox_active != 0;
2092 }
2093 #endif /* defined(USE_LIBSECCOMP) */
2094
2095 sandbox_cfg_t*
2096 sandbox_cfg_new(void)
2097 {
2098   return NULL;
2099 }
2100
2101 int
2102 sandbox_init(sandbox_cfg_t *cfg)
2103 {
2104 #if defined(USE_LIBSECCOMP)
2105   return initialise_libseccomp_sandbox(cfg);
2106
2107 #elif defined(__linux__)
2108   (void)cfg;
2109   log_warn(LD_GENERAL,
2110            "This version of Tor was built without support for sandboxing. To "
2111            "build with support for sandboxing on Linux, you must have "
2112            "libseccomp and its necessary header files (e.g. seccomp.h).");
2113   return 0;
2114
2115 #else
2116   (void)cfg;
2117   log_warn(LD_GENERAL,
2118            "Currently, sandboxing is only implemented on Linux. The feature "
2119            "is disabled on your platform.");
2120   return 0;
2121 #endif /* defined(USE_LIBSECCOMP) || ... */
2122 }
2123
2124 #ifndef USE_LIBSECCOMP
2125 int
2126 sandbox_cfg_allow_open_filename(sandbox_cfg_t **cfg, char *file)
2127 {
2128   (void)cfg; (void)file;
2129   return 0;
2130 }
2131
2132 int
2133 sandbox_cfg_allow_openat_filename(sandbox_cfg_t **cfg, char *file)
2134 {
2135   (void)cfg; (void)file;
2136   return 0;
2137 }
2138
2139 int
2140 sandbox_cfg_allow_opendir_dirname(sandbox_cfg_t **cfg, char *dir)
2141 {
2142   (void)cfg; (void)dir;
2143   return 0;
2144 }
2145
2146 int
2147 sandbox_cfg_allow_stat_filename(sandbox_cfg_t **cfg, char *file)
2148 {
2149   (void)cfg; (void)file;
2150   return 0;
2151 }
2152
2153 int
2154 sandbox_cfg_allow_chown_filename(sandbox_cfg_t **cfg, char *file)
2155 {
2156   (void)cfg; (void)file;
2157   return 0;
2158 }
2159
2160 int
2161 sandbox_cfg_allow_chmod_filename(sandbox_cfg_t **cfg, char *file)
2162 {
2163   (void)cfg; (void)file;
2164   return 0;
2165 }
2166
2167 int
2168 sandbox_cfg_allow_rename(sandbox_cfg_t **cfg, char *file1, char *file2)
2169 {
2170   (void)cfg; (void)file1; (void)file2;
2171   return 0;
2172 }
2173
2174 int
2175 sandbox_is_active(void)
2176 {
2177   return 0;
2178 }
2179
2180 #endif /* !defined(USE_LIBSECCOMP) */