Attachment #249274 for bug #142980

View Details Raw Unified Return to Bug 142980

| Differences between



2015-03-23  Michael Catanzaro  <mcatanzaro@igalia.com>

        [Seccomp] Should be easier to debug blocked syscalls
        https://bugs.webkit.org/show_bug.cgi?id=142980

        These should be printed even when not running in debug mode. There is no
        value in hiding errors from release build users. Also, I don't have the
        patience to use a debug build for development.

        Reviewed by NOBODY (OOPS!).

        * Shared/linux/SeccompFilters/SeccompBroker.cpp:
        (WebKit::SeccompBroker::runLoop): Don't close stderr et. al. in release builds.
        * Shared/linux/SeccompFilters/Syscall.cpp:
        (WebKit::write_uint): Added.
        (WebKit::reportUnexpectedSyscall): Added.
        (WebKit::Syscall::createFromContext): Call reportUnexpectedSyscall. Also, no need to crash
        here in release builds.
        * Shared/linux/SeccompFilters/SyscallPolicy.cpp:
        (WebKit::SyscallPolicy::hasPermissionForPath): Print a warning when access is denied.
        (WebKit::SyscallPolicy::permissionToString): Added.
        * Shared/linux/SeccompFilters/SyscallPolicy.h: Add permissionToString.

2015-01-04  Michael Catanzaro  <mcatanzaro@igalia.com>

        [GTK] Add seccomp filters support




NO_RETURN void SeccompBroker::runLoop(int socket)
{
    // Close unnecessary inherited file descriptors.
    for (int i = STDERR_FILENO + 1; i < FD_SETSIZE; ++i) {
#else
    int i = 0;
#endif
    // Close all inherited file descriptors other
    // than the socket to the sandboxed process.
    for (; i < FD_SETSIZE; ++i)
        if (i != socket)
            close(i);
    }

    while (true) {
        char buffer[messageMaxSize];



/*
 * Copyright (C) 2013 Intel Corporation. All rights reserved.
 * Copyright (C) 2015 Igalia S.L.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions

 * THE POSSIBILITY OF SUCH DAMAGE.
 */

/*
 * Safe printing based on code from http://outflux.net/teach-seccomp
 *
 * Copyright (c) 2012 The Chromium OS Authors <chromium-os-dev@chromium.org>
 * Authors:
 *  Will Drewry <wad@chromium.org>
 *  Kees Cook <keescook@chromium.org>
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions are
 * met:
 *
 *  * Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 *  * Redistributions in binary form must reproduce the above
 *    copyright notice, this list of conditions and the following disclaimer
 *    in the documentation and/or other materials provided with the
 *    distribution.
 *  * Neither the name of Google Inc. nor the names of its
 *    contributors may be used to endorse or promote products derived from
 *    this software without specific prior written permission.
 *
 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
 * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
 * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 */

#include "config.h"
#include "Syscall.h"


#include "OpenSyscall.h"
#include "SigactionSyscall.h"
#include "SigprocmaskSyscall.h"
#include <limits>
#include <seccomp.h>
#include <string.h>
#include <unistd.h>

namespace WebKit {

static const char* const message = "Blocked unexpected syscall: ";

// Since "sprintf" is not signal-safe, reimplement %d here.
static void writeUnsignedInt(char* buf, unsigned val)
{
    int width = 0;
    unsigned tens;

    if (!val) {
        strcpy(buf, "0");
        return;
    }
    for (tens = val; tens; tens /= 10)
        ++width;
    buf[width] = '\0';
    for (tens = val; tens; tens /= 10)
        buf[--width] = '0' + (tens % 10);
}

static void reportUnexpectedSyscall(int syscall)
{
    char buf[128];
    static_assert(strlen(message) + std::numeric_limits<int>::digits10 + 1 < sizeof(buf), "Buffer too small");
    strcpy(buf, message);
    writeUnsignedInt(buf + strlen(buf), syscall);
    strcat(buf, "\n");
    write(STDERR_FILENO, buf, strlen(buf));
}

std::unique_ptr<Syscall> Syscall::createFromContext(ucontext_t* ucontext)
{
    mcontext_t* mcontext = &ucontext->uc_mcontext;

    case __NR_rt_sigaction:
        return SigactionSyscall::createFromContext(mcontext);
    default:
        reportUnexpectedSyscall(mcontext->gregs[REG_SYSCALL]);
        ASSERT_NOT_REACHED();
    }

    return nullptr;



    free(basePath);
    free(canonicalPath);

    if ((permission & policy->value) == permission)
        return true;

    // Don't warn if the file doesn't exist at all.
    if (!access(path, F_OK) || errno != ENOENT)
        fprintf(stderr, "Blocked impermissible %s access to %s\n", SyscallPolicy::permissionToString(permission), path);
    return false;
}

void SyscallPolicy::addFilePermission(const String& path, Permission permission)

#endif
}

const char* SyscallPolicy::permissionToString(Permission permission)
{
    switch (permission) {
    case Read:
        return "read";
    case Write:
        return "write";
    case ReadAndWrite:
        return "read/write";
    case NotAllowed:
        return "disallowed";
    }
    CRASH();
}

} // namespace WebKit

#endif // ENABLE(SECCOMP_FILTERS)

Lines 52-57 public: a/Source/WebKit2/Shared/linux/SeccompFilters/SyscallPolicy.h_sec1
- a/Source/WebKit2/Shared/linux/SeccompFilters/SyscallPolicy.h +2 lines
52		52
53	void addDefaultWebProcessPolicy(const WebProcessCreationParameters&);	53	void addDefaultWebProcessPolicy(const WebProcessCreationParameters&);
54		54
		55	static const char* permissionToString(Permission);
		56
55	private:	57	private:
56	typedef HashMap<String, int> PermissionMap;	58	typedef HashMap<String, int> PermissionMap;
57	PermissionMap m_filePermission;	59	PermissionMap m_filePermission;

Return to Bug 142980

Lines 320-335 void SeccompBroker::initialize() a/Source/WebKit2/Shared/linux/SeccompFilters/SeccompBroker.cpp_sec1
- a/Source/WebKit2/Shared/linux/SeccompFilters/SeccompBroker.cpp -8 / +3 lines
320		320
321	NO_RETURN void SeccompBroker::runLoop(int socket)	321	NO_RETURN void SeccompBroker::runLoop(int socket)
322	{	322	{
323	#ifndef NDEBUG	323	// Close unnecessary inherited file descriptors.
324	int i = STDERR_FILENO + 1;	324	for (int i = STDERR_FILENO + 1; i < FD_SETSIZE; ++i) {
325	#else
326	int i = 0;
327	#endif
328	// Close all inherited file descriptors other
329	// than the socket to the sandboxed process.
330	for (; i < FD_SETSIZE; ++i)
331	if (i != socket)	325	if (i != socket)
332	close(i);	326	close(i);
		327	}
333		328
334	while (true) {	329	while (true) {
335	char buffer[messageMaxSize];	330	char buffer[messageMaxSize];

Lines 97-103 bool SyscallPolicy::hasPermissionForPath(const char* path, Permission permission a/Source/WebKit2/Shared/linux/SeccompFilters/SyscallPolicy.cpp_sec1
- a/Source/WebKit2/Shared/linux/SeccompFilters/SyscallPolicy.cpp -1 / +22 lines
97	free(basePath);	97	free(basePath);
98	free(canonicalPath);	98	free(canonicalPath);
99		99
100	return (permission & policy->value) == permission;	100	if ((permission & policy->value) == permission)
		101	return true;
		102
		103	// Don't warn if the file doesn't exist at all.
		104	if (!access(path, F_OK) \|\| errno != ENOENT)
		105	fprintf(stderr, "Blocked impermissible %s access to %s\n", SyscallPolicy::permissionToString(permission), path);
		106	return false;
101	}	107	}
102		108
103	void SyscallPolicy::addFilePermission(const String& path, Permission permission)	109	void SyscallPolicy::addFilePermission(const String& path, Permission permission)
Lines 256-261 void SyscallPolicy::addDefaultWebProcessPolicy(const WebProcessCreationParameter a/Source/WebKit2/Shared/linux/SeccompFilters/SyscallPolicy.cpp_sec2
256	#endif	262	#endif
257	}	263	}
258		264
		265	const char* SyscallPolicy::permissionToString(Permission permission)
		266	{
		267	switch (permission) {
		268	case Read:
		269	return "read";
		270	case Write:
		271	return "write";
		272	case ReadAndWrite:
		273	return "read/write";
		274	case NotAllowed:
		275	return "disallowed";
		276	}
		277	CRASH();
		278	}
		279
259	} // namespace WebKit	280	} // namespace WebKit
260		281
261	#endif // ENABLE(SECCOMP_FILTERS)	282	#endif // ENABLE(SECCOMP_FILTERS)

Lines 1-3 a/Source/WebKit2/ChangeLog_sec1
- a/Source/WebKit2/ChangeLog +23 lines
		1	2015-03-23 Michael Catanzaro <mcatanzaro@igalia.com>
		2
		3	[Seccomp] Should be easier to debug blocked syscalls
		4	https://bugs.webkit.org/show_bug.cgi?id=142980
		5
		6	These should be printed even when not running in debug mode. There is no
		7	value in hiding errors from release build users. Also, I don't have the
		8	patience to use a debug build for development.
		9
		10	Reviewed by NOBODY (OOPS!).
		11
		12	* Shared/linux/SeccompFilters/SeccompBroker.cpp:
		13	(WebKit::SeccompBroker::runLoop): Don't close stderr et. al. in release builds.
		14	* Shared/linux/SeccompFilters/Syscall.cpp:
		15	(WebKit::write_uint): Added.
		16	(WebKit::reportUnexpectedSyscall): Added.
		17	(WebKit::Syscall::createFromContext): Call reportUnexpectedSyscall. Also, no need to crash
		18	here in release builds.
		19	* Shared/linux/SeccompFilters/SyscallPolicy.cpp:
		20	(WebKit::SyscallPolicy::hasPermissionForPath): Print a warning when access is denied.
		21	(WebKit::SyscallPolicy::permissionToString): Added.
		22	* Shared/linux/SeccompFilters/SyscallPolicy.h: Add permissionToString.
		23
1	2015-01-04 Michael Catanzaro <mcatanzaro@igalia.com>	24	2015-01-04 Michael Catanzaro <mcatanzaro@igalia.com>
2		25
3	[GTK] Add seccomp filters support	26	[GTK] Add seccomp filters support

Lines 1-5 a/Source/WebKit2/Shared/linux/SeccompFilters/Syscall.cpp_sec1
- a/Source/WebKit2/Shared/linux/SeccompFilters/Syscall.cpp -1 / +70 lines
1	/*	1	/*
2	* Copyright (C) 2013 Intel Corporation. All rights reserved.	2	* Copyright (C) 2013 Intel Corporation. All rights reserved.
		3	* Copyright (C) 2015 Igalia S.L.
3	*	4	*
4	* Redistribution and use in source and binary forms, with or without	5	* Redistribution and use in source and binary forms, with or without
5	* modification, are permitted provided that the following conditions	6	* modification, are permitted provided that the following conditions
Lines 23-28 a/Source/WebKit2/Shared/linux/SeccompFilters/Syscall.cpp_sec2
23	* THE POSSIBILITY OF SUCH DAMAGE.	24	* THE POSSIBILITY OF SUCH DAMAGE.
24	*/	25	*/
25		26
		27	/*
		28	* Safe printing based on code from http://outflux.net/teach-seccomp
		29	*
		30	* Copyright (c) 2012 The Chromium OS Authors <chromium-os-dev@chromium.org>
		31	* Authors:
		32	* Will Drewry <wad@chromium.org>
		33	* Kees Cook <keescook@chromium.org>
		34	*
		35	* Redistribution and use in source and binary forms, with or without
		36	* modification, are permitted provided that the following conditions are
		37	* met:
		38	*
		39	* * Redistributions of source code must retain the above copyright
		40	* notice, this list of conditions and the following disclaimer.
		41	* * Redistributions in binary form must reproduce the above
		42	* copyright notice, this list of conditions and the following disclaimer
		43	* in the documentation and/or other materials provided with the
		44	* distribution.
		45	* * Neither the name of Google Inc. nor the names of its
		46	* contributors may be used to endorse or promote products derived from
		47	* this software without specific prior written permission.
		48	*
		49	* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
		50	* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
		51	* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
		52	* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
		53	* OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
		54	* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
		55	* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
		56	* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
		57	* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
		58	* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
		59	* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
		60	*/
		61
26	#include "config.h"	62	#include "config.h"
27	#include "Syscall.h"	63	#include "Syscall.h"
28		64
Lines 32-41 a/Source/WebKit2/Shared/linux/SeccompFilters/Syscall.cpp_sec3
32	#include "OpenSyscall.h"	68	#include "OpenSyscall.h"
33	#include "SigactionSyscall.h"	69	#include "SigactionSyscall.h"
34	#include "SigprocmaskSyscall.h"	70	#include "SigprocmaskSyscall.h"
		71	#include <limits>
35	#include <seccomp.h>	72	#include <seccomp.h>
		73	#include <string.h>
		74	#include <unistd.h>
36		75
37	namespace WebKit {	76	namespace WebKit {
38		77
		78	static const char* const message = "Blocked unexpected syscall: ";
		79
		80	// Since "sprintf" is not signal-safe, reimplement %d here.
		81	static void writeUnsignedInt(char* buf, unsigned val)
		82	{
		83	int width = 0;
		84	unsigned tens;
		85
		86	if (!val) {
		87	strcpy(buf, "0");
		88	return;
		89	}
		90	for (tens = val; tens; tens /= 10)
		91	++width;
		92	buf[width] = '\0';
		93	for (tens = val; tens; tens /= 10)
		94	buf[--width] = '0' + (tens % 10);
		95	}
		96
		97	static void reportUnexpectedSyscall(int syscall)
		98	{
		99	char buf[128];
		100	static_assert(strlen(message) + std::numeric_limits<int>::digits10 + 1 < sizeof(buf), "Buffer too small");
		101	strcpy(buf, message);
		102	writeUnsignedInt(buf + strlen(buf), syscall);
		103	strcat(buf, "\n");
		104	write(STDERR_FILENO, buf, strlen(buf));
		105	}
		106
39	std::unique_ptr<Syscall> Syscall::createFromContext(ucontext_t* ucontext)	107	std::unique_ptr<Syscall> Syscall::createFromContext(ucontext_t* ucontext)
40	{	108	{
41	mcontext_t* mcontext = &ucontext->uc_mcontext;	109	mcontext_t* mcontext = &ucontext->uc_mcontext;
Lines 54-60 std::unique_ptr<Syscall> Syscall::createFromContext(ucontext_t* ucontext) a/Source/WebKit2/Shared/linux/SeccompFilters/Syscall.cpp_sec4
54	case __NR_rt_sigaction:	122	case __NR_rt_sigaction:
55	return SigactionSyscall::createFromContext(mcontext);	123	return SigactionSyscall::createFromContext(mcontext);
56	default:	124	default:
57	CRASH();	125	reportUnexpectedSyscall(mcontext->gregs[REG_SYSCALL]);
		126	ASSERT_NOT_REACHED();
58	}	127	}
59		128
60	return nullptr;	129	return nullptr;