/
githubmirror
/
bubblewrap
Обзор
Документация
Войти
/
githubmirror
/
bubblewrap
Код
Запросы
0
Пакеты
0
Релизы
0
Аналитика
Безопасность
main
tests/test-seccomp.py
635 строк
19 KB
Simon McVittie
tests: Exercise seccomp filters
31 янв 2022, 20:13
31 янв 2022, 20:13
3612534
Код
Авторство
О чём код?
#!/usr/bin/env python3 # Copyright 2021 Simon McVittie # SPDX-License-Identifier: LGPL-2.0-or-later import errno import logging import os import subprocess import sys import tempfile import termios import unittest try: import seccomp except ImportError: print('1..0 # SKIP cannot import seccomp Python module') sys.exit(0) # This is the @default set from systemd as of 2021-10-11 DEFAULT_SET = set(''' brk cacheflush clock_getres clock_getres_time64 clock_gettime clock_gettime64 clock_nanosleep clock_nanosleep_time64 execve exit exit_group futex futex_time64 get_robust_list get_thread_area getegid getegid32 geteuid geteuid32 getgid getgid32 getgroups getgroups32 getpgid getpgrp getpid getppid getrandom getresgid getresgid32 getresuid getresuid32 getrlimit getsid gettid gettimeofday getuid getuid32 membarrier mmap mmap2 munmap nanosleep pause prlimit64 restart_syscall rseq rt_sigreturn sched_getaffinity sched_yield set_robust_list set_thread_area set_tid_address set_tls sigreturn time ugetrlimit '''.split()) # This is the @basic-io set from systemd BASIC_IO_SET = set(''' _llseek close close_range dup dup2 dup3 lseek pread64 preadv preadv2 pwrite64 pwritev pwritev2 read readv write writev '''.split()) # This is the @filesystem-io set from systemd FILESYSTEM_SET = set(''' access chdir chmod close creat faccessat faccessat2 fallocate fchdir fchmod fchmodat fcntl fcntl64 fgetxattr flistxattr fremovexattr fsetxattr fstat fstat64 fstatat64 fstatfs fstatfs64 ftruncate ftruncate64 futimesat getcwd getdents getdents64 getxattr inotify_add_watch inotify_init inotify_init1 inotify_rm_watch lgetxattr link linkat listxattr llistxattr lremovexattr lsetxattr lstat lstat64 mkdir mkdirat mknod mknodat newfstatat oldfstat oldlstat oldstat open openat openat2 readlink readlinkat removexattr rename renameat renameat2 rmdir setxattr stat stat64 statfs statfs64 statx symlink symlinkat truncate truncate64 unlink unlinkat utime utimensat utimensat_time64 utimes '''.split()) # Miscellaneous syscalls used during process startup, at least on x86_64 ALLOWED = DEFAULT_SET | BASIC_IO_SET | FILESYSTEM_SET | set(''' arch_prctl ioctl madvise mprotect mremap prctl readdir umask '''.split()) # Syscalls we will try to use, expecting them to be either allowed or # blocked by our allow and/or deny lists TRY_SYSCALLS = [ 'chmod', 'chroot', 'clone3', 'ioctl TIOCNOTTY', 'ioctl TIOCSTI CVE-2019-10063', 'ioctl TIOCSTI', 'listen', 'prctl', ] class Test(unittest.TestCase): def setUp(self) -> None: here = os.path.dirname(os.path.abspath(__file__)) if 'G_TEST_SRCDIR' in os.environ: self.test_srcdir = os.getenv('G_TEST_SRCDIR') + '/tests' else: self.test_srcdir = here if 'G_TEST_BUILDDIR' in os.environ: self.test_builddir = os.getenv('G_TEST_BUILDDIR') + '/tests' else: self.test_builddir = here self.bwrap = os.getenv('BWRAP', 'bwrap') self.try_syscall = os.path.join(self.test_builddir, 'try-syscall') completed = subprocess.run( [ self.bwrap, '--ro-bind', '/', '/', 'true', ], stdin=subprocess.DEVNULL, stdout=subprocess.DEVNULL, stderr=2, ) if completed.returncode != 0: raise unittest.SkipTest( 'cannot run bwrap (does it need to be setuid?)' ) def tearDown(self) -> None: pass def test_no_seccomp(self) -> None: for syscall in TRY_SYSCALLS: print('# {} without seccomp'.format(syscall)) completed = subprocess.run( [ self.bwrap, '--ro-bind', '/', '/', self.try_syscall, syscall, ], stdin=subprocess.DEVNULL, stdout=subprocess.DEVNULL, stderr=2, ) if ( syscall == 'ioctl TIOCSTI CVE-2019-10063' and completed.returncode == errno.ENOENT ): print('# Cannot test 64-bit syscall parameter on 32-bit') continue if syscall == 'clone3': # If the kernel supports it, we didn't block it so # it fails with EFAULT. If the kernel doesn't support it, # it'll fail with ENOSYS instead. self.assertIn( completed.returncode, (errno.ENOSYS, errno.EFAULT), ) elif syscall.startswith('ioctl') or syscall == 'listen': self.assertEqual(completed.returncode, errno.EBADF) else: self.assertEqual(completed.returncode, errno.EFAULT) def test_seccomp_allowlist(self) -> None: with tempfile.TemporaryFile() as allowlist_temp: allowlist = seccomp.SyscallFilter(seccomp.ERRNO(errno.ENOSYS)) if os.uname().machine == 'x86_64': # Allow Python and try-syscall to be different word sizes allowlist.add_arch(seccomp.Arch.X86) for syscall in ALLOWED: try: allowlist.add_rule(seccomp.ALLOW, syscall) except Exception as e: print('# Cannot add {} to allowlist: {!r}'.format(syscall, e)) allowlist.export_bpf(allowlist_temp) for syscall in TRY_SYSCALLS: print('# allowlist vs. {}'.format(syscall)) allowlist_temp.seek(0, os.SEEK_SET) completed = subprocess.run( [ self.bwrap, '--ro-bind', '/', '/', '--seccomp', str(allowlist_temp.fileno()), self.try_syscall, syscall, ], pass_fds=(allowlist_temp.fileno(),), stdin=subprocess.DEVNULL, stdout=subprocess.DEVNULL, stderr=2, ) if ( syscall == 'ioctl TIOCSTI CVE-2019-10063' and completed.returncode == errno.ENOENT ): print('# Cannot test 64-bit syscall parameter on 32-bit') continue if syscall.startswith('ioctl'): # We allow this, so it is executed (and in this simple # example, immediately fails) self.assertEqual(completed.returncode, errno.EBADF) elif syscall in ('chroot', 'listen', 'clone3'): # We don't allow these, so they fail with ENOSYS. # clone3 might also be failing with ENOSYS because # the kernel genuinely doesn't support it. self.assertEqual(completed.returncode, errno.ENOSYS) else: # We allow this, so it is executed (and in this simple # example, immediately fails) self.assertEqual(completed.returncode, errno.EFAULT) def test_seccomp_denylist(self) -> None: with tempfile.TemporaryFile() as denylist_temp: denylist = seccomp.SyscallFilter(seccomp.ALLOW) if os.uname().machine == 'x86_64': # Allow Python and try-syscall to be different word sizes denylist.add_arch(seccomp.Arch.X86) # Using ECONNREFUSED here because it's unlikely that any of # these syscalls will legitimately fail with that code, so # if they fail like this, it will be as a result of seccomp. denylist.add_rule(seccomp.ERRNO(errno.ECONNREFUSED), 'chmod') denylist.add_rule(seccomp.ERRNO(errno.ECONNREFUSED), 'chroot') denylist.add_rule(seccomp.ERRNO(errno.ECONNREFUSED), 'prctl') denylist.add_rule( seccomp.ERRNO(errno.ECONNREFUSED), 'ioctl', seccomp.Arg(1, seccomp.MASKED_EQ, 0xffffffff, termios.TIOCSTI), ) denylist.export_bpf(denylist_temp) for syscall in TRY_SYSCALLS: print('# denylist vs. {}'.format(syscall)) denylist_temp.seek(0, os.SEEK_SET) completed = subprocess.run( [ self.bwrap, '--ro-bind', '/', '/', '--seccomp', str(denylist_temp.fileno()), self.try_syscall, syscall, ], pass_fds=(denylist_temp.fileno(),), stdin=subprocess.DEVNULL, stdout=subprocess.DEVNULL, stderr=2, ) if ( syscall == 'ioctl TIOCSTI CVE-2019-10063' and completed.returncode == errno.ENOENT ): print('# Cannot test 64-bit syscall parameter on 32-bit') continue if syscall == 'clone3': # If the kernel supports it, we didn't block it so # it fails with EFAULT. If the kernel doesn't support it, # it'll fail with ENOSYS instead. self.assertIn( completed.returncode, (errno.ENOSYS, errno.EFAULT), ) elif syscall in ('ioctl TIOCNOTTY', 'listen'): # Not on the denylist self.assertEqual(completed.returncode, errno.EBADF) else: # We blocked all of these self.assertEqual(completed.returncode, errno.ECONNREFUSED) def test_seccomp_stacked(self, allowlist_first=False) -> None: with tempfile.TemporaryFile( ) as allowlist_temp, tempfile.TemporaryFile( ) as denylist_temp: # This filter is a simplified version of what Flatpak wants allowlist = seccomp.SyscallFilter(seccomp.ERRNO(errno.ENOSYS)) denylist = seccomp.SyscallFilter(seccomp.ALLOW) if os.uname().machine == 'x86_64': # Allow Python and try-syscall to be different word sizes allowlist.add_arch(seccomp.Arch.X86) denylist.add_arch(seccomp.Arch.X86) for syscall in ALLOWED: try: allowlist.add_rule(seccomp.ALLOW, syscall) except Exception as e: print('# Cannot add {} to allowlist: {!r}'.format(syscall, e)) denylist.add_rule(seccomp.ERRNO(errno.ECONNREFUSED), 'chmod') denylist.add_rule(seccomp.ERRNO(errno.ECONNREFUSED), 'chroot') denylist.add_rule( seccomp.ERRNO(errno.ECONNREFUSED), 'ioctl', seccomp.Arg(1, seccomp.MASKED_EQ, 0xffffffff, termios.TIOCSTI), ) # All seccomp programs except the last must allow prctl(), # because otherwise we wouldn't be able to add the remaining # seccomp programs. We document that the last program can # block prctl, so test that. if allowlist_first: denylist.add_rule(seccomp.ERRNO(errno.ECONNREFUSED), 'prctl') allowlist.export_bpf(allowlist_temp) denylist.export_bpf(denylist_temp) for syscall in TRY_SYSCALLS: print('# stacked vs. {}'.format(syscall)) allowlist_temp.seek(0, os.SEEK_SET) denylist_temp.seek(0, os.SEEK_SET) if allowlist_first: fds = [allowlist_temp.fileno(), denylist_temp.fileno()] else: fds = [denylist_temp.fileno(), allowlist_temp.fileno()] completed = subprocess.run( [ self.bwrap, '--ro-bind', '/', '/', '--add-seccomp-fd', str(fds[0]), '--add-seccomp-fd', str(fds[1]), self.try_syscall, syscall, ], pass_fds=fds, stdin=subprocess.DEVNULL, stdout=subprocess.DEVNULL, stderr=2, ) if ( syscall == 'ioctl TIOCSTI CVE-2019-10063' and completed.returncode == errno.ENOENT ): print('# Cannot test 64-bit syscall parameter on 32-bit') continue if syscall == 'ioctl TIOCNOTTY': # Not denied by the denylist, and allowed by the allowlist self.assertEqual(completed.returncode, errno.EBADF) elif syscall in ('clone3', 'listen'): # We didn't deny these, so the denylist has no effect # and we fall back to the allowlist, which doesn't # include them either. # clone3 might also be failing with ENOSYS because # the kernel genuinely doesn't support it. self.assertEqual(completed.returncode, errno.ENOSYS) elif syscall == 'chroot': # This is denied by the denylist *and* not allowed by # the allowlist. The result depends which one we added # first: the most-recently-added filter "wins". if allowlist_first: self.assertEqual( completed.returncode, errno.ECONNREFUSED, ) else: self.assertEqual(completed.returncode, errno.ENOSYS) elif syscall == 'prctl': # We can only put this on the denylist if the denylist # is the last to be added. if allowlist_first: self.assertEqual( completed.returncode, errno.ECONNREFUSED, ) else: self.assertEqual(completed.returncode, errno.EFAULT) else: # chmod is allowed by the allowlist but blocked by the # denylist. Denying takes precedence over allowing, # regardless of order. self.assertEqual(completed.returncode, errno.ECONNREFUSED) def test_seccomp_stacked_allowlist_first(self) -> None: self.test_seccomp_stacked(allowlist_first=True) def test_seccomp_invalid(self) -> None: with tempfile.TemporaryFile( ) as allowlist_temp, tempfile.TemporaryFile( ) as denylist_temp: completed = subprocess.run( [ self.bwrap, '--ro-bind', '/', '/', '--add-seccomp-fd', '-1', 'true', ], stdin=subprocess.DEVNULL, stdout=subprocess.DEVNULL, stderr=subprocess.PIPE, ) self.assertIn(b'bwrap: Invalid fd: -1\n', completed.stderr) self.assertEqual(completed.returncode, 1) completed = subprocess.run( [ self.bwrap, '--ro-bind', '/', '/', '--seccomp', '0a', 'true', ], stdin=subprocess.DEVNULL, stdout=subprocess.DEVNULL, stderr=subprocess.PIPE, ) self.assertIn(b'bwrap: Invalid fd: 0a\n', completed.stderr) self.assertEqual(completed.returncode, 1) completed = subprocess.run( [ self.bwrap, '--ro-bind', '/', '/', '--add-seccomp-fd', str(denylist_temp.fileno()), '--seccomp', str(allowlist_temp.fileno()), 'true', ], pass_fds=(allowlist_temp.fileno(), denylist_temp.fileno()), stdin=subprocess.DEVNULL, stdout=subprocess.DEVNULL, stderr=subprocess.PIPE, ) self.assertIn( b'bwrap: --seccomp cannot be combined with --add-seccomp-fd\n', completed.stderr, ) self.assertEqual(completed.returncode, 1) completed = subprocess.run( [ self.bwrap, '--ro-bind', '/', '/', '--seccomp', str(allowlist_temp.fileno()), '--add-seccomp-fd', str(denylist_temp.fileno()), 'true', ], pass_fds=(allowlist_temp.fileno(), denylist_temp.fileno()), stdin=subprocess.DEVNULL, stdout=subprocess.DEVNULL, stderr=subprocess.PIPE, ) self.assertIn( b'--add-seccomp-fd cannot be combined with --seccomp', completed.stderr, ) self.assertEqual(completed.returncode, 1) completed = subprocess.run( [ self.bwrap, '--ro-bind', '/', '/', '--add-seccomp-fd', str(allowlist_temp.fileno()), '--add-seccomp-fd', str(allowlist_temp.fileno()), 'true', ], pass_fds=(allowlist_temp.fileno(), allowlist_temp.fileno()), stdin=subprocess.DEVNULL, stdout=subprocess.DEVNULL, stderr=subprocess.PIPE, ) self.assertIn( b"bwrap: Can't read seccomp data: ", completed.stderr, ) self.assertEqual(completed.returncode, 1) allowlist_temp.write(b'\x01') allowlist_temp.seek(0, os.SEEK_SET) completed = subprocess.run( [ self.bwrap, '--ro-bind', '/', '/', '--add-seccomp-fd', str(denylist_temp.fileno()), '--add-seccomp-fd', str(allowlist_temp.fileno()), 'true', ], pass_fds=(allowlist_temp.fileno(), denylist_temp.fileno()), stdin=subprocess.DEVNULL, stdout=subprocess.DEVNULL, stderr=subprocess.PIPE, ) self.assertIn( b'bwrap: Invalid seccomp data, must be multiple of 8\n', completed.stderr, ) self.assertEqual(completed.returncode, 1) def main(): logging.basicConfig(level=logging.DEBUG) try: from tap.runner import TAPTestRunner except ImportError: TAPTestRunner = None # type: ignore if TAPTestRunner is not None: runner = TAPTestRunner() runner.set_stream(True) unittest.main(testRunner=runner) else: print('# tap.runner not available, using simple TAP output') print('1..1') program = unittest.main(exit=False) if program.result.wasSuccessful(): print('ok 1 - %r' % program.result) else: print('not ok 1 - %r' % program.result) sys.exit(1) if __name__ == '__main__': main()