sandbox-capsicum.c

   1 /*
   2  * Copyright (c) 2011 Dag-Erling Smorgrav
   3  *
   4  * Permission to use, copy, modify, and distribute this software for any
   5  * purpose with or without fee is hereby granted, provided that the above
   6  * copyright notice and this permission notice appear in all copies.
   7  *
   8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
   9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  11  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  13  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  14  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  15  */
  16
  17 #include "includes.h"
  18
  19 #ifdef SANDBOX_CAPSICUM
  20
  21 #include <sys/types.h>
  22 #include <sys/time.h>
  23 #include <sys/resource.h>
  24 #include <sys/capsicum.h>
  25
  26 #include <errno.h>
  27 #include <stdarg.h>
  28 #include <stdio.h>
  29 #include <stdlib.h>
  30 #include <string.h>
  31 #include <unistd.h>
  32 #ifdef HAVE_CAPSICUM_HELPERS_H
  33 #include <capsicum_helpers.h>
  34 #endif
  35
  36 #include "log.h"
  37 #include "monitor.h"
  38 #include "ssh-sandbox.h"
  39 #include "xmalloc.h"
  40
  41 /*
  42  * Capsicum sandbox that sets zero nfiles, nprocs and filesize rlimits,
  43  * limits rights on stdout, stdin, stderr, monitor and switches to
  44  * capability mode.
  45  */
  46
  47 struct ssh_sandbox {
  48         struct monitor *monitor;
  49         pid_t child_pid;
  50 };
  51
  52 struct ssh_sandbox *
  53 ssh_sandbox_init(struct monitor *monitor)
  54 {
  55         struct ssh_sandbox *box;
  56
  57         /*
  58          * Strictly, we don't need to maintain any state here but we need
  59          * to return non-NULL to satisfy the API.
  60          */
  61         debug3("%s: preparing capsicum sandbox", __func__);
  62         box = xcalloc(1, sizeof(*box));
  63         box->monitor = monitor;
  64         box->child_pid = 0;
  65
  66         return box;
  67 }
  68
  69 void
  70 ssh_sandbox_child(struct ssh_sandbox *box)
  71 {
  72         struct rlimit rl_zero;
  73         cap_rights_t rights;
  74
  75 #ifdef HAVE_CAPH_CACHE_TZDATA
  76         caph_cache_tzdata();
  77 #endif
  78
  79         rl_zero.rlim_cur = rl_zero.rlim_max = 0;
  80
  81         if (setrlimit(RLIMIT_FSIZE, &rl_zero) == -1)
  82                 fatal("%s: setrlimit(RLIMIT_FSIZE, { 0, 0 }): %s",
  83                         __func__, strerror(errno));
  84 #ifndef SANDBOX_SKIP_RLIMIT_NOFILE
  85         if (setrlimit(RLIMIT_NOFILE, &rl_zero) == -1)
  86                 fatal("%s: setrlimit(RLIMIT_NOFILE, { 0, 0 }): %s",
  87                         __func__, strerror(errno));
  88 #endif
  89         if (setrlimit(RLIMIT_NPROC, &rl_zero) == -1)
  90                 fatal("%s: setrlimit(RLIMIT_NPROC, { 0, 0 }): %s",
  91                         __func__, strerror(errno));
  92
  93         cap_rights_init(&rights);
  94
  95         if (cap_rights_limit(STDIN_FILENO, &rights) < 0 && errno != ENOSYS)
  96                 fatal("can't limit stdin: %m");
  97         if (cap_rights_limit(STDOUT_FILENO, &rights) < 0 && errno != ENOSYS)
  98                 fatal("can't limit stdout: %m");
  99         if (cap_rights_limit(STDERR_FILENO, &rights) < 0 && errno != ENOSYS)
 100                 fatal("can't limit stderr: %m");
 101
 102         cap_rights_init(&rights, CAP_READ, CAP_WRITE);
 103         if (cap_rights_limit(box->monitor->m_recvfd, &rights) < 0 &&
 104             errno != ENOSYS)
 105                 fatal("%s: failed to limit the network socket", __func__);
 106         cap_rights_init(&rights, CAP_WRITE);
 107         if (cap_rights_limit(box->monitor->m_log_sendfd, &rights) < 0 &&
 108             errno != ENOSYS)
 109                 fatal("%s: failed to limit the logging socket", __func__);
 110         if (cap_enter() < 0 && errno != ENOSYS)
 111                 fatal("%s: failed to enter capability mode", __func__);
 112
 113 }
 114
 115 void
 116 ssh_sandbox_parent_finish(struct ssh_sandbox *box)
 117 {
 118         free(box);
 119         debug3("%s: finished", __func__);
 120 }
 121
 122 void
 123 ssh_sandbox_parent_preauth(struct ssh_sandbox *box, pid_t child_pid)
 124 {
 125         box->child_pid = child_pid;
 126 }
 127
 128 #endif /* SANDBOX_CAPSICUM */