Commit 3dfe1c06 authored by Cristian Toader's avatar Cristian Toader
Browse files

initia stages of runtime dynamic filters

parent abe082e7

src/common/sandbox.c

+20 −58
Original line number Diff line number Diff line
@@ -33,9 +33,9 @@ 
#include <signal.h>

#include <unistd.h>



ParFilterDynamic *filter_dynamic = NULL;

sandbox_cfg_t *filter_dynamic = NULL;



static ParFilterStatic filter_static[] = {

static sandbox_static_cfg_t filter_static[] = {

    // Example entries

    {SCMP_SYS(execve), PARAM_PTR, 0, (intptr_t)("/usr/local/bin/tor"), 0},

    {SCMP_SYS(rt_sigaction), PARAM_NUM, 0, (intptr_t)(SIGINT), 0},
@@ -48,34 +48,6 @@ static ParFilterStatic filter_static[] = { 
    {SCMP_SYS(rt_sigaction), PARAM_NUM, 0, (intptr_t)(SIGXFSZ), 0},

#endif

    {SCMP_SYS(rt_sigaction), PARAM_NUM, 0, (intptr_t)(SIGCHLD), 0},

    {SCMP_SYS(open), PARAM_PTR, 0,

        (intptr_t)("/home/cristi/.tor/cached-certs"), 0},

    {SCMP_SYS(open), PARAM_PTR, 0,

        (intptr_t)("/home/cristi/.tor/cached-consensus"), 0},

    {SCMP_SYS(open), PARAM_PTR, 0,

        (intptr_t)("/home/cristi/.tor/unverified-consensus"), 0},

    {SCMP_SYS(open), PARAM_PTR, 0,

        (intptr_t)("/home/cristi/.tor/cached-microdesc-consensus"), 0},

    {SCMP_SYS(open), PARAM_PTR, 0,

        (intptr_t)("/home/cristi/.tor/cached-microdesc-consensus.tmp"), 0},

    {SCMP_SYS(open), PARAM_PTR, 0,

        (intptr_t)("/home/cristi/.tor/cached-microdescs"), 0},

    {SCMP_SYS(open), PARAM_PTR, 0,

        (intptr_t)("/home/cristi/.tor/cached-microdescs.new"), 0},

    {SCMP_SYS(open), PARAM_PTR, 0,

        (intptr_t)("/home/cristi/.tor/unverified-microdesc-consensus"), 0},

    {SCMP_SYS(open), PARAM_PTR, 0,

        (intptr_t)("/home/cristi/.tor/cached-descriptors"), 0},

    {SCMP_SYS(open), PARAM_PTR, 0,

        (intptr_t)("/home/cristi/.tor/cached-descriptors.new"), 0},

    {SCMP_SYS(open), PARAM_PTR, 0,

        (intptr_t)("/home/cristi/.tor/cached-extrainfo"), 0},

    {SCMP_SYS(open), PARAM_PTR, 0,

        (intptr_t)("/home/cristi/.tor/state.tmp"), 0},

    {SCMP_SYS(open), PARAM_PTR, 0,

        (intptr_t)("/home/cristi/.tor/unparseable-desc.tmp"), 0},

    {SCMP_SYS(open), PARAM_PTR, 0,

        (intptr_t)("/home/cristi/.tor/unparseable-desc"), 0},

};



/** Variable used for storing all syscall numbers that will be allowed with the
@@ -192,7 +164,7 @@ char* 
get_prot_param(char *param)

{

  int i, filter_size;

  ParFilterDynamic *elem;

  sandbox_cfg_t *elem;



  if (param == NULL)

    return NULL;
@@ -256,36 +228,26 @@ prot_strdup(char* str) 
   return res;

}



int

add_dynamic_param_filter(char *syscall, char ptype, char pindex, intptr_t val)

sandbox_cfg_t*

sandbox_cfg_new()

{

  ParFilterDynamic **elem;



  for (elem = &filter_dynamic; *elem != NULL; elem = &(*elem)->next);



  *elem = (ParFilterDynamic*) malloc(sizeof(ParFilterDynamic));

  (*elem)->next = NULL;

  (*elem)->pindex = pindex;

  (*elem)->ptype = ptype;

  return NULL;

}



  switch (ptype) {

  case PARAM_PTR:

    (*elem)->param = (intptr_t) prot_strdup((char*) val);

    (*elem)->prot = 1;

    break;

int

sandbox_cfg_allow_open_filename(sandbox_cfg_t **cfg, char *file)

{

  sandbox_cfg_t *elem = (sandbox_cfg_t*) malloc(sizeof(sandbox_cfg_t));



  case PARAM_NUM:

    (*elem)->param = val;

    (*elem)->prot = 0;

    break;

  }

  elem->syscall = SCMP_SYS(open);

  elem->pindex = 0;

  elem->ptype = PARAM_PTR;

  elem->param = (intptr_t) prot_strdup((char*) file);

  elem->prot = 1;



  // TODO: and so on ..?

  if (!strcmp(syscall, "open")) {

    (*elem)->syscall = SCMP_SYS(open);

  } else if (!strcmp(syscall, "rt_sigaction")) {

    (*elem)->syscall = SCMP_SYS(rt_sigaction);

  }

  // fifo

  elem->next = filter_dynamic;

  filter_dynamic = elem;



  return 0;

}
@@ -294,7 +256,7 @@ static int 
add_param_filter(scmp_filter_ctx ctx)

{

  int i, filter_size, rc = 0;

  ParFilterDynamic *elem;

  sandbox_cfg_t *elem;



  if (filter_static != NULL) {

    filter_size = sizeof(filter_static) / sizeof(filter_static[0]);

src/common/sandbox.h

+3 −4
Original line number Diff line number Diff line
@@ -45,7 +45,7 @@ typedef struct { 
  intptr_t param;



  char prot;

} ParFilterStatic;

} sandbox_static_cfg_t;



struct pfd_elem {

  int syscall;
@@ -58,7 +58,7 @@ struct pfd_elem { 


  struct pfd_elem *next;

};

typedef struct pfd_elem ParFilterDynamic;

typedef struct pfd_elem sandbox_cfg_t;



/**

 * Linux 32 bit definitions
@@ -81,8 +81,7 @@ typedef struct pfd_elem ParFilterDynamic; 
void sandbox_set_debugging_fd(int fd);

int tor_global_sandbox(void);

char* get_prot_param(char *param);

int add_dynamic_param_filter(char *syscall, char ptype, char pindex,

    intptr_t val);

int sandbox_cfg_allow_open_filename(sandbox_cfg_t **cfg, char *file);



#endif /* SANDBOX_H_ */

src/or/main.c

+40 −0
Original line number Diff line number Diff line
@@ -2639,6 +2639,43 @@ find_flashcard_path(PWCHAR path, size_t size) 
}

#endif



static int

sandbox_cfg_init_open()

{

  sandbox_cfg_allow_open_filename(NULL,

      get_datadir_fname("cached-certs"));

  sandbox_cfg_allow_open_filename(NULL,

      get_datadir_fname("cached-consensus"));

  sandbox_cfg_allow_open_filename(NULL,

      get_datadir_fname("unverified-consensus"));

  sandbox_cfg_allow_open_filename(NULL,

      get_datadir_fname("cached-microdesc-consensus"));

  sandbox_cfg_allow_open_filename(NULL,

      get_datadir_fname("cached-microdesc-consensus.tmp"));

  sandbox_cfg_allow_open_filename(NULL,

      get_datadir_fname("cached-microdescs"));

  sandbox_cfg_allow_open_filename(NULL,

      get_datadir_fname("cached-microdescs.tmp"));

  sandbox_cfg_allow_open_filename(NULL,

      get_datadir_fname("cached-microdescs.new"));

  sandbox_cfg_allow_open_filename(NULL,

      get_datadir_fname("unverified-microdesc-consensus"));

  sandbox_cfg_allow_open_filename(NULL,

      get_datadir_fname("cached-descriptors"));

  sandbox_cfg_allow_open_filename(NULL,

      get_datadir_fname("cached-descriptors.new"));

  sandbox_cfg_allow_open_filename(NULL,

      get_datadir_fname("cached-extrainfo"));

  sandbox_cfg_allow_open_filename(NULL,

      get_datadir_fname("state.tmp"));

  sandbox_cfg_allow_open_filename(NULL,

      get_datadir_fname("unparseable-desc.tmp"));

  sandbox_cfg_allow_open_filename(NULL,

      get_datadir_fname("unparseable-desc"));



  return 0;

}



/** Main entry point for the Tor process.  Called from main(). */

/* This function is distinct from main() only so we can link main.c into

 * the unittest binary without conflicting with the unittests' main. */
@@ -2707,6 +2744,9 @@ tor_main(int argc, char *argv[]) 
    return -1;



  if (get_options()->Sandbox) {

    if (sandbox_cfg_init_open() < 0)

      return -1;



    if (tor_global_sandbox()) {

      log_err(LD_BUG,"Failed to create syscall sandbox filter");

      return -1;