- djm@cvs.openbsd.org 2011/07/29 14:42:45

     [sandbox-systrace.c]
     fail open(2) with EPERM rather than SIGKILLing the whole process. libc
     will call open() to do strerror() when NLS is enabled;
     feedback and ok markus@

diff --git a/ChangeLog b/ChangeLog
index 7de7fdbf862346c281195415a50ab07d29d61cf2..ccca485f8a1e9971138f7b364944a0d6d16cdd82 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -8,6 +8,11 @@
      bzero the agent address.  the kernel was for a while very cranky about
      these things.  evne though that's fixed, always good to initialize
      memory.  ok deraadt djm
+   - djm@cvs.openbsd.org 2011/07/29 14:42:45
+     [sandbox-systrace.c]
+     fail open(2) with EPERM rather than SIGKILLing the whole process. libc
+     will call open() to do strerror() when NLS is enabled;
+     feedback and ok markus@
 
 20110624
  - (djm) [configure.ac Makefile.in sandbox-darwin.c] Add a sandbox for

diff --git a/sandbox-systrace.c b/sandbox-systrace.c
index 8058b7d40557a3b470d5e831f648cb0b273a5cdb..5a39f4fe146f8bcc0e63d2e9227f9fb14efc4635 100644 (file)
--- a/sandbox-systrace.c
+++ b/sandbox-systrace.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: sandbox-systrace.c,v 1.3 2011/06/23 09:34:13 djm Exp $ */
+/* $OpenBSD: sandbox-systrace.c,v 1.4 2011/07/29 14:42:45 djm Exp $ */
 /*
  * Copyright (c) 2011 Damien Miller <djm@mindrot.org>
  *
@@ -41,22 +41,30 @@
 #include "ssh-sandbox.h"
 #include "xmalloc.h"
 
-static const int preauth_policy[] = {
-       SYS___sysctl,
-       SYS_close,
-       SYS_exit,
-       SYS_getpid,
-       SYS_gettimeofday,
-       SYS_madvise,
-       SYS_mmap,
-       SYS_mprotect,
-       SYS_poll,
-       SYS_munmap,
-       SYS_read,
-       SYS_select,
-       SYS_sigprocmask,
-       SYS_write,
-       -1
+struct sandbox_policy {
+       int syscall;
+       int action;
+};
+
+/* Permitted syscalls in preauth. Unlisted syscalls get SYSTR_POLICY_KILL */
+static const struct sandbox_policy preauth_policy[] = {
+       { SYS_open, SYSTR_POLICY_NEVER },
+
+       { SYS___sysctl, SYSTR_POLICY_PERMIT },
+       { SYS_close, SYSTR_POLICY_PERMIT },
+       { SYS_exit, SYSTR_POLICY_PERMIT },
+       { SYS_getpid, SYSTR_POLICY_PERMIT },
+       { SYS_gettimeofday, SYSTR_POLICY_PERMIT },
+       { SYS_madvise, SYSTR_POLICY_PERMIT },
+       { SYS_mmap, SYSTR_POLICY_PERMIT },
+       { SYS_mprotect, SYSTR_POLICY_PERMIT },
+       { SYS_poll, SYSTR_POLICY_PERMIT },
+       { SYS_munmap, SYSTR_POLICY_PERMIT },
+       { SYS_read, SYSTR_POLICY_PERMIT },
+       { SYS_select, SYSTR_POLICY_PERMIT },
+       { SYS_sigprocmask, SYSTR_POLICY_PERMIT },
+       { SYS_write, SYSTR_POLICY_PERMIT },
+       { -1, -1 }
 };
 
 struct ssh_sandbox {
@@ -64,7 +72,6 @@ struct ssh_sandbox {
        int parent_sock;
        int systrace_fd;
        pid_t child_pid;
-       struct systrace_policy policy;
 };
 
 struct ssh_sandbox *
@@ -104,10 +111,11 @@ ssh_sandbox_child(struct ssh_sandbox *box)
 
 static void
 ssh_sandbox_parent(struct ssh_sandbox *box, pid_t child_pid,
-    const int *allowed_syscalls)
+    const struct sandbox_policy *allowed_syscalls)
 {
        int dev_systrace, i, j, found;
        char whatever = 0;
+       struct systrace_policy policy;
 
        debug3("%s: wait for child %ld", __func__, (long)child_pid);
        box->child_pid = child_pid;
@@ -131,33 +139,35 @@ ssh_sandbox_parent(struct ssh_sandbox *box, pid_t child_pid,
                    box->systrace_fd, child_pid, strerror(errno));
 
        /* Allocate and assign policy */
-       bzero(&box->policy, sizeof(box->policy));
-       box->policy.strp_op = SYSTR_POLICY_NEW;
-       box->policy.strp_maxents = SYS_MAXSYSCALL;
-       if (ioctl(box->systrace_fd, STRIOCPOLICY, &box->policy) == -1)
+       bzero(&policy, sizeof(policy));
+       policy.strp_op = SYSTR_POLICY_NEW;
+       policy.strp_maxents = SYS_MAXSYSCALL;
+       if (ioctl(box->systrace_fd, STRIOCPOLICY, &policy) == -1)
                fatal("%s: ioctl(%d, STRIOCPOLICY (new)): %s", __func__,
                    box->systrace_fd, strerror(errno));
 
-       box->policy.strp_op = SYSTR_POLICY_ASSIGN;
-       box->policy.strp_pid = box->child_pid;
-       if (ioctl(box->systrace_fd, STRIOCPOLICY, &box->policy) == -1)
+       policy.strp_op = SYSTR_POLICY_ASSIGN;
+       policy.strp_pid = box->child_pid;
+       if (ioctl(box->systrace_fd, STRIOCPOLICY, &policy) == -1)
                fatal("%s: ioctl(%d, STRIOCPOLICY (assign)): %s",
                    __func__, box->systrace_fd, strerror(errno));
 
        /* Set per-syscall policy */
        for (i = 0; i < SYS_MAXSYSCALL; i++) {
-               for (j = found = 0; allowed_syscalls[j] != -1 && !found; j++) {
-                       if (allowed_syscalls[j] == i)
+               found = 0;
+               for (j = 0; allowed_syscalls[j].syscall != -1; j++) {
+                       if (allowed_syscalls[j].syscall == i) {
                                found = 1;
+                               break;
+                       }
                }
-               box->policy.strp_op = SYSTR_POLICY_MODIFY;
-               box->policy.strp_code = i;
-               box->policy.strp_policy = found ?
-                   SYSTR_POLICY_PERMIT : SYSTR_POLICY_KILL;
+               policy.strp_op = SYSTR_POLICY_MODIFY;
+               policy.strp_code = i;
+               policy.strp_policy = found ?
+                   allowed_syscalls[j].action : SYSTR_POLICY_KILL;
                if (found)
                        debug3("%s: policy: enable syscall %d", __func__, i);
-               if (ioctl(box->systrace_fd, STRIOCPOLICY,
-                   &box->policy) == -1)
+               if (ioctl(box->systrace_fd, STRIOCPOLICY, &policy) == -1)
                        fatal("%s: ioctl(%d, STRIOCPOLICY (modify)): %s",
                            __func__, box->systrace_fd, strerror(errno));
        }