RFC: android: Add support for untrusted_app sandboxing (#697)

executor: add support for android_untrusted_app sandbox

This adds a new sandbox type, 'android_untrusted_app', which restricts
syz-executor to the privileges which are available to third-party applications,
e.g. those installed from the Google Play store.

In particular, this uses the UID space reserved for applications (instead of
the 'setuid' sandbox, which uses the traditional 'nobody' user / 65534)
as well as a set of groups which the Android-specific kernels are aware of,
and finally ensures that the SELinux context is set appropriately.

Dependencies on libselinux are avoided by manually implementing the few
functions that are needed to change the context of the current process,
and arbitrary files.  The underlying mechanisms are relatively simple.

Fixes google/syzkaller#643

Test: make presubmit
Bug: http://b/112900774

1 files changed, 116 insertions, 5 deletions

diff --git a/pkg/csource/generated.go b/pkg/csource/generated.go
index 7b5d05f63..475982ae5 100644
--- a/pkg/csource/generated.go
+++ b/pkg/csource/generated.go
@@ -393,6 +393,7 @@ void child()
 #if SYZ_EXECUTOR
 #define do_sandbox_setuid() 0
 #define do_sandbox_namespace() 0
+#define do_sandbox_android_untrusted_app() 0
 #endif
 
 #elif GOOS_freebsd || GOOS_netbsd || GOOS_openbsd
@@ -411,6 +412,7 @@ static int do_sandbox_none(void)
 #if SYZ_EXECUTOR
 #define do_sandbox_setuid() 0
 #define do_sandbox_namespace() 0
+#define do_sandbox_android_untrusted_app() 0
 #endif
 
 #if GOOS_openbsd
@@ -682,6 +684,7 @@ static int do_sandbox_none(void)
 #if SYZ_EXECUTOR
 #define do_sandbox_setuid() 0
 #define do_sandbox_namespace() 0
+#define do_sandbox_android_untrusted_app() 0
 #endif
 #define CAST(f) ({void* p = (void*)f; p; })
 
@@ -1177,7 +1180,7 @@ static long syz_open_pts(long a0, long a1)
 #endif
 
 #if SYZ_EXECUTOR || __NR_syz_init_net_socket
-#if SYZ_EXECUTOR || SYZ_SANDBOX_NONE || SYZ_SANDBOX_SETUID || SYZ_SANDBOX_NAMESPACE
+#if SYZ_EXECUTOR || SYZ_SANDBOX_NONE || SYZ_SANDBOX_SETUID || SYZ_SANDBOX_NAMESPACE || SYZ_SANDBOX_ANDROID_UNTRUSTED_APP
 #include <fcntl.h>
 #include <sched.h>
 #include <sys/stat.h>
@@ -2983,7 +2986,7 @@ static void setup_binfmt_misc()
 }
 #endif
 
-#if SYZ_EXECUTOR || SYZ_SANDBOX_NONE || SYZ_SANDBOX_SETUID || SYZ_SANDBOX_NAMESPACE
+#if SYZ_EXECUTOR || SYZ_SANDBOX_NONE || SYZ_SANDBOX_SETUID || SYZ_SANDBOX_NAMESPACE || SYZ_SANDBOX_ANDROID_UNTRUSTED_APP
 #include <errno.h>
 #include <sys/mount.h>
 
@@ -2997,9 +3000,7 @@ static void setup_common()
 	setup_binfmt_misc();
 #endif
 }
-#endif
 
-#if SYZ_EXECUTOR || SYZ_SANDBOX_NONE || SYZ_SANDBOX_SETUID || SYZ_SANDBOX_NAMESPACE
 #include <sched.h>
 #include <sys/prctl.h>
 #include <sys/resource.h>
@@ -3255,6 +3256,113 @@ static int do_sandbox_namespace(void)
 }
 #endif
 
+#if SYZ_EXECUTOR || SYZ_SANDBOX_ANDROID_UNTRUSTED_APP
+#include <fcntl.h>
+#include <grp.h>
+#include <sys/xattr.h>
+
+#define AID_NET_BT_ADMIN 3001
+#define AID_NET_BT 3002
+#define AID_INET 3003
+#define AID_EVERYBODY 9997
+#define AID_APP 10000
+
+#define UNTRUSTED_APP_UID AID_APP + 999
+#define UNTRUSTED_APP_GID AID_APP + 999
+
+const char* SELINUX_CONTEXT_UNTRUSTED_APP = "u:r:untrusted_app:s0:c512,c768";
+const char* SELINUX_LABEL_APP_DATA_FILE = "u:object_r:app_data_file:s0:c512,c768";
+const char* SELINUX_CONTEXT_FILE = "/proc/thread-self/attr/current";
+const char* SELINUX_XATTR_NAME = "security.selinux";
+
+const gid_t UNTRUSTED_APP_GROUPS[] = {UNTRUSTED_APP_GID, AID_NET_BT_ADMIN, AID_NET_BT, AID_INET, AID_EVERYBODY};
+const size_t UNTRUSTED_APP_NUM_GROUPS = sizeof(UNTRUSTED_APP_GROUPS) / sizeof(UNTRUSTED_APP_GROUPS[0]);
+static void syz_getcon(char* context, size_t context_size)
+{
+	int fd = open(SELINUX_CONTEXT_FILE, O_RDONLY);
+
+	if (fd < 0)
+		fail("getcon: Couldn't open %s", SELINUX_CONTEXT_FILE);
+
+	ssize_t nread = read(fd, context, context_size);
+
+	close(fd);
+
+	if (nread <= 0)
+		fail("getcon: Failed to read from %s", SELINUX_CONTEXT_FILE);
+	if (context[nread - 1] == '\n')
+		context[nread - 1] = '\0';
+}
+static void syz_setcon(const char* context)
+{
+	char new_context[512];
+	int fd = open(SELINUX_CONTEXT_FILE, O_WRONLY);
+
+	if (fd < 0)
+		fail("setcon: Could not open %s", SELINUX_CONTEXT_FILE);
+
+	ssize_t bytes_written = write(fd, context, strlen(context));
+	close(fd);
+
+	if (bytes_written != (ssize_t)strlen(context))
+		fail("setcon: Could not write entire context.  Wrote %zi, expected %zu", bytes_written, strlen(context));
+	syz_getcon(new_context, sizeof(new_context));
+
+	if (strcmp(context, new_context) != 0)
+		fail("setcon: Failed to change to %s, context is %s", context, new_context);
+}
+static int syz_getfilecon(const char* path, char* context, size_t context_size)
+{
+	int length = getxattr(path, SELINUX_XATTR_NAME, context, context_size);
+
+	if (length == -1)
+		fail("getfilecon: getxattr failed");
+
+	return length;
+}
+static void syz_setfilecon(const char* path, const char* context)
+{
+	char new_context[512];
+
+	if (setxattr(path, SELINUX_XATTR_NAME, context, strlen(context) + 1, 0) != 0)
+		fail("setfilecon: setxattr failed");
+
+	if (syz_getfilecon(path, new_context, sizeof(new_context)) != 0)
+		fail("setfilecon: getfilecon failed");
+
+	if (strcmp(context, new_context) != 0)
+		fail("setfilecon: could not set context to %s, currently %s", context, new_context);
+}
+
+static int do_sandbox_android_untrusted_app(void)
+{
+	setup_common();
+	sandbox_common();
+
+	if (setgroups(UNTRUSTED_APP_NUM_GROUPS, UNTRUSTED_APP_GROUPS) != 0)
+		fail("setgroups failed");
+
+	if (setresgid(UNTRUSTED_APP_GID, UNTRUSTED_APP_GID, UNTRUSTED_APP_GID) != 0)
+		fail("setresgid failed");
+
+	if (setresuid(UNTRUSTED_APP_UID, UNTRUSTED_APP_UID, UNTRUSTED_APP_UID) != 0)
+		fail("setresuid failed");
+
+	syz_setfilecon(".", SELINUX_LABEL_APP_DATA_FILE);
+	syz_setcon(SELINUX_CONTEXT_UNTRUSTED_APP);
+
+#if SYZ_EXECUTOR || SYZ_TUN_ENABLE
+	initialize_tun();
+#endif
+#if SYZ_EXECUTOR || SYZ_ENABLE_NETDEV
+	initialize_netdevices();
+#endif
+
+	loop();
+	doexit(1);
+}
+#endif
+
 #if SYZ_EXECUTOR || SYZ_REPEAT && SYZ_USE_TMP_DIR
 #include <dirent.h>
 #include <errno.h>
@@ -3623,6 +3731,7 @@ static int do_sandbox_none(void)
 #if SYZ_EXECUTOR
 #define do_sandbox_setuid() 0
 #define do_sandbox_namespace() 0
+#define do_sandbox_android_untrusted_app() 0
 #endif
 
 #elif GOOS_windows
@@ -3739,6 +3848,7 @@ static int do_sandbox_none(void)
 #if SYZ_EXECUTOR
 #define do_sandbox_setuid() 0
 #define do_sandbox_namespace() 0
+#define do_sandbox_android_untrusted_app() 0
 #endif
 
 #elif GOOS_test
@@ -3794,6 +3904,7 @@ static int do_sandbox_none(void)
 #if SYZ_EXECUTOR
 #define do_sandbox_setuid() 0
 #define do_sandbox_namespace() 0
+#define do_sandbox_android_untrusted_app() 0
 #endif
 
 #else
@@ -4015,7 +4126,7 @@ static void loop(void)
 
 [[RESULTS]]
 
-#if SYZ_THREADED || SYZ_REPEAT || SYZ_SANDBOX_NONE || SYZ_SANDBOX_SETUID || SYZ_SANDBOX_NAMESPACE
+#if SYZ_THREADED || SYZ_REPEAT || SYZ_SANDBOX_NONE || SYZ_SANDBOX_SETUID || SYZ_SANDBOX_NAMESPACE || SYZ_SANDBOX_ANDROID_UNTRUSTED_APP
 #if SYZ_THREADED
 void execute_call(int call)
 #elif SYZ_REPEAT