Security.c 4.8 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156
  1. /* vim: set expandtab ts=4 sw=4: */
  2. /*
  3. * You may redistribute this program and/or modify it under the terms of
  4. * the GNU General Public License as published by the Free Software Foundation,
  5. * either version 3 of the License, or (at your option) any later version.
  6. *
  7. * This program is distributed in the hope that it will be useful,
  8. * but WITHOUT ANY WARRANTY; without even the implied warranty of
  9. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  10. * GNU General Public License for more details.
  11. *
  12. * You should have received a copy of the GNU General Public License
  13. * along with this program. If not, see <http://www.gnu.org/licenses/>.
  14. */
  15. #define string_strerror
  16. #include "exception/Except.h"
  17. #include "util/log/Log.h"
  18. #include "util/Security.h"
  19. #include "util/platform/libc/string.h"
  20. #include "util/Seccomp.h"
  21. #include "memory/Allocator.h"
  22. #include <sys/resource.h>
  23. #include <sys/types.h>
  24. #include <pwd.h>
  25. #include <unistd.h>
  26. #include <errno.h>
  27. #include <stdlib.h>
  28. #define __USE_MISC // for MAP_ANONYMOUS
  29. #include <sys/mman.h>
  30. // Apple
  31. #ifndef MAP_ANONYMOUS
  32. #define MAP_ANONYMOUS MAP_ANON
  33. #endif
  34. int Security_setUser(char* userName, struct Log* logger, struct Except* eh)
  35. {
  36. struct passwd* pw = getpwnam(userName);
  37. if (!pw) {
  38. Except_throw(eh, "Failed to set UID, couldn't find user named [%s].", strerror(errno));
  39. }
  40. if (setuid(pw->pw_uid)) {
  41. if (errno == EPERM) {
  42. return Security_setUser_PERMISSION;
  43. }
  44. Except_throw(eh, "Failed to set UID [%s]", strerror(errno));
  45. }
  46. if (getuid() != pw->pw_uid) {
  47. Except_throw(eh, "Failed to set UID but seemed to succeed");
  48. }
  49. return 0;
  50. }
  51. static int canOpenFiles()
  52. {
  53. int file = dup(0);
  54. close(file);
  55. return file >= 0;
  56. }
  57. static void noFiles(struct Except* eh)
  58. {
  59. #if !defined(RLIMIT_NOFILE) && defined(RLIMIT_OFILE)
  60. #define RLIMIT_NOFILE RLIMIT_OFILE
  61. #endif
  62. if (!canOpenFiles()) {
  63. Except_throw(eh, "Unable to dupe stdin");
  64. }
  65. if (setrlimit(RLIMIT_NOFILE, &(struct rlimit){ 0, 0 })) {
  66. Except_throw(eh, "Failed to set open file limit to [%s]", strerror(errno));
  67. }
  68. if (canOpenFiles()) {
  69. Except_throw(eh, "Still able to dupe stdin after setting number of files to 0!");
  70. }
  71. }
  72. // RLIMIT_DATA doesn't prevent malloc() on linux.
  73. // see: http://lkml.indiana.edu/hypermail/linux/kernel/0707.1/0675.html
  74. #if !defined(RLIMIT_AS) && defined(RLIMIT_DATA)
  75. #define Security_MEMORY_RLIMIT RLIMIT_DATA
  76. #elif defined(RLIMIT_AS)
  77. #define Security_MEMORY_RLIMIT RLIMIT_AS
  78. #else
  79. #error RLIMIT_AS and RLIMIT_DATA are not defined
  80. #endif
  81. static unsigned long getMaxMem(struct Except* eh)
  82. {
  83. struct rlimit lim = { 0, 0 };
  84. if (getrlimit(Security_MEMORY_RLIMIT, &lim)) {
  85. Except_throw(eh, "Failed to get memory limit [%s]", strerror(errno));
  86. }
  87. // First time around, we try a very small mapping just to make sure it works.
  88. size_t tryMapping = 100;
  89. if (lim.rlim_max > 0) {
  90. tryMapping = lim.rlim_max * 2l;
  91. }
  92. void* ptr = mmap(NULL, tryMapping, PROT_READ | PROT_WRITE, MAP_ANONYMOUS, -1, 0);
  93. if (ptr != MAP_FAILED) {
  94. munmap(ptr, tryMapping);
  95. if (lim.rlim_max > 0) {
  96. Except_throw(eh, "Memory limit is not enforced, successfully mapped [%zu] bytes",
  97. tryMapping);
  98. }
  99. } else if (lim.rlim_max == 0) {
  100. Except_throw(eh, "Testing of memory limit not possible, unable to map memory");
  101. }
  102. return lim.rlim_max;
  103. }
  104. static void maxMemory(unsigned long max, struct Except* eh)
  105. {
  106. unsigned long realMax = getMaxMem(eh);
  107. if (realMax > 0 && realMax < max) {
  108. Except_throw(eh, "Failed to limit available memory to [%lu] "
  109. "because existing limit is [%lu]", max, realMax);
  110. }
  111. if (setrlimit(Security_MEMORY_RLIMIT, &(struct rlimit){ max, max })) {
  112. Except_throw(eh, "Failed to limit available memory [%s]", strerror(errno));
  113. }
  114. if (!setrlimit(Security_MEMORY_RLIMIT, &(struct rlimit){ max+1, max+1 })) {
  115. Except_throw(eh, "Available memory was modifyable after limiting");
  116. }
  117. realMax = getMaxMem(eh);
  118. if (realMax != max) {
  119. Except_throw(eh, "Limiting available memory failed");
  120. }
  121. }
  122. struct Security_Permissions* Security_checkPermissions(struct Allocator* alloc, struct Except* eh)
  123. {
  124. struct Security_Permissions* out =
  125. Allocator_calloc(alloc, sizeof(struct Security_Permissions), 1);
  126. out->noOpenFiles = !canOpenFiles();
  127. out->seccompExists = Seccomp_exists();
  128. out->seccompEnforcing = Seccomp_isWorking();
  129. out->memoryLimitBytes = getMaxMem(eh);
  130. return out;
  131. }
  132. void Security_dropPermissions(struct Allocator* tempAlloc, struct Log* logger, struct Except* eh)
  133. {
  134. maxMemory(100000000, eh);
  135. noFiles(eh);
  136. Seccomp_dropPermissions(tempAlloc, logger, eh);
  137. }