From 6565f24da9f4eb36702339ba290213995fcc902f Mon Sep 17 00:00:00 2001 From: Greg Steuck Date: Mon, 10 Dec 2018 02:20:16 -0800 Subject: executor: add setuid sandbox for openbsd * executor/common_bsd: add setuid sandbox Fixes #833 cc @mptre * Reduced duplications, resolved TODO. --- executor/common_bsd.h | 74 +++++++++++++++++++++++++++++++++++++++++++++++++ executor/executor_bsd.h | 19 ------------- 2 files changed, 74 insertions(+), 19 deletions(-) (limited to 'executor') diff --git a/executor/common_bsd.h b/executor/common_bsd.h index 9c61917d7..53ffc8668 100644 --- a/executor/common_bsd.h +++ b/executor/common_bsd.h @@ -267,10 +267,42 @@ static long syz_extract_tcp_res(long a0, long a1, long a2) #endif #endif // GOOS_freebsd || GOOS_openbsd +#if SYZ_EXECUTOR || SYZ_SANDBOX_SETUID || SYZ_SANDBOX_NONE + +#include +#include + +static void sandbox_common() +{ + if (setsid() == -1) + fail("setsid failed"); + + // Some minimal sandboxing. + struct rlimit rlim; +#ifndef GOOS_openbsd + // Documented bug in OpenBSD. + // This causes frequent random aborts on netbsd. Reason unknown. + rlim.rlim_cur = rlim.rlim_max = 128 << 20; + setrlimit(RLIMIT_AS, &rlim); +#endif + rlim.rlim_cur = rlim.rlim_max = 8 << 20; + setrlimit(RLIMIT_MEMLOCK, &rlim); + rlim.rlim_cur = rlim.rlim_max = 1 << 20; + setrlimit(RLIMIT_FSIZE, &rlim); + rlim.rlim_cur = rlim.rlim_max = 1 << 20; + setrlimit(RLIMIT_STACK, &rlim); + rlim.rlim_cur = rlim.rlim_max = 0; + setrlimit(RLIMIT_CORE, &rlim); + rlim.rlim_cur = rlim.rlim_max = 256; // see kMaxFd + setrlimit(RLIMIT_NOFILE, &rlim); +} +#endif // SYZ_EXECUTOR || SYZ_SANDBOX_SETUID || SYZ_SANDBOX_NONE + #if SYZ_EXECUTOR || SYZ_SANDBOX_NONE static void loop(); static int do_sandbox_none(void) { + sandbox_common(); #if (GOOS_freebsd || GOOS_openbsd) && (SYZ_EXECUTOR || SYZ_TUN_ENABLE) initialize_tun(procid); #endif @@ -278,3 +310,45 @@ static int do_sandbox_none(void) return 0; } #endif // SYZ_EXECUTOR || SYZ_SANDBOX_NONE + +#if SYZ_EXECUTOR || SYZ_SANDBOX_SETUID + +#include +#include +#include + +static int wait_for_loop(int pid) +{ + if (pid < 0) + fail("sandbox fork failed"); + debug("spawned loop pid %d\n", pid); + int status = 0; + while (waitpid(-1, &status, WUNTRACED) != pid) { + } + return WEXITSTATUS(status); +} + +#define SYZ_HAVE_SANDBOX_SETUID 1 +static int do_sandbox_setuid(void) +{ + int pid = fork(); + if (pid != 0) + return wait_for_loop(pid); + + sandbox_common(); +#if (GOOS_freebsd || GOOS_openbsd) && (SYZ_EXECUTOR || SYZ_TUN_ENABLE) + initialize_tun(procid); +#endif + + const int nobody = 65534; + if (setgroups(0, NULL)) + fail("failed to setgroups"); + if (setresgid(nobody, nobody, nobody)) + fail("failed to setresgid"); + if (setresuid(nobody, nobody, nobody)) + fail("failed to setresuid"); + + loop(); + doexit(1); +} +#endif // SYZ_EXECUTOR || SYZ_SANDBOX_SETUID diff --git a/executor/executor_bsd.h b/executor/executor_bsd.h index 7119a3992..8f364ca13 100644 --- a/executor/executor_bsd.h +++ b/executor/executor_bsd.h @@ -21,25 +21,6 @@ static void os_init(int argc, char** argv, void* data, size_t data_size) if (mmap(data, data_size, prot, MAP_ANON | MAP_PRIVATE | MAP_FIXED, -1, 0) != data) fail("mmap of data segment failed"); - - // Some minimal sandboxing. - // TODO: this should go into common_bsd.h because csource needs this too. - struct rlimit rlim; -#if GOOS_netbsd - // This causes frequent random aborts on netbsd. Reason unknown. - rlim.rlim_cur = rlim.rlim_max = 128 << 20; - setrlimit(RLIMIT_AS, &rlim); -#endif - rlim.rlim_cur = rlim.rlim_max = 8 << 20; - setrlimit(RLIMIT_MEMLOCK, &rlim); - rlim.rlim_cur = rlim.rlim_max = 1 << 20; - setrlimit(RLIMIT_FSIZE, &rlim); - rlim.rlim_cur = rlim.rlim_max = 1 << 20; - setrlimit(RLIMIT_STACK, &rlim); - rlim.rlim_cur = rlim.rlim_max = 0; - setrlimit(RLIMIT_CORE, &rlim); - rlim.rlim_cur = rlim.rlim_max = 256; // see kMaxFd - setrlimit(RLIMIT_NOFILE, &rlim); } static long execute_syscall(const call_t* c, long a[kMaxArgs]) -- cgit mrf-deployment