mirror of
https://github.com/OpenFusionProject/OpenFusion.git
synced 2024-11-05 15:00:06 +00:00
[sandbox] Initial Landlock support
This commit is contained in:
parent
7c66041a6f
commit
8137921154
@ -49,6 +49,7 @@ CNShardServer *shardServer = nullptr;
|
|||||||
std::thread *shardThread = nullptr;
|
std::thread *shardThread = nullptr;
|
||||||
|
|
||||||
void startShard(CNShardServer* server) {
|
void startShard(CNShardServer* server) {
|
||||||
|
sandbox_thread_start();
|
||||||
server->start();
|
server->start();
|
||||||
}
|
}
|
||||||
|
|
||||||
@ -150,6 +151,8 @@ int main() {
|
|||||||
/* not reached */
|
/* not reached */
|
||||||
}
|
}
|
||||||
|
|
||||||
|
sandbox_init();
|
||||||
|
|
||||||
std::cout << "[INFO] Starting Server Threads..." << std::endl;
|
std::cout << "[INFO] Starting Server Threads..." << std::endl;
|
||||||
CNLoginServer loginServer(settings::LOGINPORT);
|
CNLoginServer loginServer(settings::LOGINPORT);
|
||||||
shardServer = new CNShardServer(settings::SHARDPORT);
|
shardServer = new CNShardServer(settings::SHARDPORT);
|
||||||
@ -157,6 +160,7 @@ int main() {
|
|||||||
shardThread = new std::thread(startShard, (CNShardServer*)shardServer);
|
shardThread = new std::thread(startShard, (CNShardServer*)shardServer);
|
||||||
|
|
||||||
sandbox_start();
|
sandbox_start();
|
||||||
|
sandbox_thread_start();
|
||||||
|
|
||||||
loginServer.start();
|
loginServer.start();
|
||||||
|
|
||||||
|
@ -4,11 +4,16 @@
|
|||||||
#if defined(__linux__) || defined(__OpenBSD__)
|
#if defined(__linux__) || defined(__OpenBSD__)
|
||||||
|
|
||||||
# if !defined(CONFIG_NOSANDBOX)
|
# if !defined(CONFIG_NOSANDBOX)
|
||||||
|
void sandbox_init();
|
||||||
void sandbox_start();
|
void sandbox_start();
|
||||||
|
void sandbox_thread_start();
|
||||||
# else
|
# else
|
||||||
|
|
||||||
#include <iostream>
|
#include <iostream>
|
||||||
|
|
||||||
|
inline void sandbox_init() {}
|
||||||
|
inline void sandbox_thread_start() {}
|
||||||
|
|
||||||
inline void sandbox_start() {
|
inline void sandbox_start() {
|
||||||
std::cout << "[WARN] Built without a sandbox" << std::endl;
|
std::cout << "[WARN] Built without a sandbox" << std::endl;
|
||||||
}
|
}
|
||||||
@ -17,5 +22,7 @@ inline void sandbox_start() {
|
|||||||
|
|
||||||
#else
|
#else
|
||||||
// stub for unsupported platforms
|
// stub for unsupported platforms
|
||||||
|
inline void sandbox_init() {}
|
||||||
inline void sandbox_start() {}
|
inline void sandbox_start() {}
|
||||||
|
inline void sandbox_thread_start() {}
|
||||||
#endif
|
#endif
|
||||||
|
@ -13,6 +13,9 @@ static void eunveil(const char *path, const char *permissions) {
|
|||||||
err(1, "unveil");
|
err(1, "unveil");
|
||||||
}
|
}
|
||||||
|
|
||||||
|
void sandbox_init() {}
|
||||||
|
void sandbox_thread_start() {}
|
||||||
|
|
||||||
void sandbox_start() {
|
void sandbox_start() {
|
||||||
/*
|
/*
|
||||||
* There shouldn't ever be a reason to disable this one, but might as well
|
* There shouldn't ever be a reason to disable this one, but might as well
|
||||||
|
@ -4,6 +4,7 @@
|
|||||||
#include "settings.hpp"
|
#include "settings.hpp"
|
||||||
|
|
||||||
#include <stdlib.h>
|
#include <stdlib.h>
|
||||||
|
#include <fcntl.h>
|
||||||
|
|
||||||
#include <sys/prctl.h>
|
#include <sys/prctl.h>
|
||||||
#include <sys/ptrace.h>
|
#include <sys/ptrace.h>
|
||||||
@ -17,6 +18,8 @@
|
|||||||
#include <linux/audit.h>
|
#include <linux/audit.h>
|
||||||
#include <linux/net.h> // for socketcall() args
|
#include <linux/net.h> // for socketcall() args
|
||||||
|
|
||||||
|
#include <linux/landlock.h>
|
||||||
|
|
||||||
/*
|
/*
|
||||||
* Macros adapted from https://outflux.net/teach-seccomp/
|
* Macros adapted from https://outflux.net/teach-seccomp/
|
||||||
* Relevant license:
|
* Relevant license:
|
||||||
@ -297,19 +300,84 @@ static sock_fprog prog = {
|
|||||||
ARRLEN(filter), filter
|
ARRLEN(filter), filter
|
||||||
};
|
};
|
||||||
|
|
||||||
// our own wrapper for the seccomp() syscall
|
struct landlock_ruleset_attr ruleset_attr = {
|
||||||
|
.handled_access_fs = LANDLOCK_ACCESS_FS_READ_FILE
|
||||||
|
| LANDLOCK_ACCESS_FS_WRITE_FILE
|
||||||
|
| LANDLOCK_ACCESS_FS_READ_DIR
|
||||||
|
| LANDLOCK_ACCESS_FS_REMOVE_FILE
|
||||||
|
| LANDLOCK_ACCESS_FS_MAKE_REG
|
||||||
|
| LANDLOCK_ACCESS_FS_TRUNCATE
|
||||||
|
};
|
||||||
|
|
||||||
|
int landlock_fd;
|
||||||
|
|
||||||
|
/*
|
||||||
|
* Our own wrappers for sandboxing syscalls.
|
||||||
|
*/
|
||||||
|
|
||||||
int seccomp(unsigned int operation, unsigned int flags, void *args) {
|
int seccomp(unsigned int operation, unsigned int flags, void *args) {
|
||||||
return syscall(__NR_seccomp, operation, flags, args);
|
return syscall(__NR_seccomp, operation, flags, args);
|
||||||
}
|
}
|
||||||
|
|
||||||
void sandbox_start() {
|
int landlock_create_ruleset(const struct landlock_ruleset_attr *attr, size_t size, uint32_t flags) {
|
||||||
|
return syscall(__NR_landlock_create_ruleset, attr, size, flags);
|
||||||
|
}
|
||||||
|
|
||||||
|
int landlock_add_rule(int ruleset_fd, enum landlock_rule_type rule_type, const void *rule_attr, uint32_t flags) {
|
||||||
|
return syscall(__NR_landlock_add_rule, ruleset_fd, rule_type, rule_attr, flags);
|
||||||
|
}
|
||||||
|
|
||||||
|
int landlock_restrict_self(int ruleset_fd, uint32_t flags) {
|
||||||
|
return syscall(__NR_landlock_restrict_self, ruleset_fd, flags);
|
||||||
|
}
|
||||||
|
|
||||||
|
void landlock_path(std::string path, uint32_t perms) {
|
||||||
|
struct landlock_path_beneath_attr path_beneath = {
|
||||||
|
.allowed_access = perms
|
||||||
|
};
|
||||||
|
|
||||||
|
std::cout << "Landlock path: " << path << std::endl;
|
||||||
|
|
||||||
|
path_beneath.parent_fd = open(path.c_str(), O_PATH|O_CLOEXEC);
|
||||||
|
if (path_beneath.parent_fd < 0) {
|
||||||
|
perror("open");
|
||||||
|
exit(1);
|
||||||
|
}
|
||||||
|
|
||||||
|
if (landlock_add_rule(landlock_fd, LANDLOCK_RULE_PATH_BENEATH, &path_beneath, 0)) {
|
||||||
|
perror("landlock_add_rule");
|
||||||
|
exit(1);
|
||||||
|
}
|
||||||
|
|
||||||
|
close(path_beneath.parent_fd);
|
||||||
|
}
|
||||||
|
|
||||||
|
void sandbox_init() {
|
||||||
if (!settings::SANDBOX) {
|
if (!settings::SANDBOX) {
|
||||||
std::cout << "[WARN] Running without a sandbox" << std::endl;
|
std::cout << "[WARN] Running without a sandbox" << std::endl;
|
||||||
return;
|
return;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
std::cout << "[INFO] Setting up Landlock sandbox..." << std::endl;
|
||||||
|
|
||||||
|
landlock_fd = landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0);
|
||||||
|
if (landlock_fd < 0) {
|
||||||
|
perror("landlock_create_ruleset");
|
||||||
|
exit(1);
|
||||||
|
}
|
||||||
|
|
||||||
|
landlock_path(".", ruleset_attr.handled_access_fs);
|
||||||
|
landlock_path("/dev/urandom", LANDLOCK_ACCESS_FS_READ_FILE);
|
||||||
|
//landlock_path("/tmp/coredumps", ruleset_attr.handled_access_fs);
|
||||||
|
}
|
||||||
|
|
||||||
|
void sandbox_start() {
|
||||||
|
if (!settings::SANDBOX)
|
||||||
|
return;
|
||||||
|
|
||||||
std::cout << "[INFO] Starting seccomp-bpf sandbox..." << std::endl;
|
std::cout << "[INFO] Starting seccomp-bpf sandbox..." << std::endl;
|
||||||
|
|
||||||
|
#if 0
|
||||||
if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) < 0) {
|
if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) < 0) {
|
||||||
perror("prctl");
|
perror("prctl");
|
||||||
exit(1);
|
exit(1);
|
||||||
@ -319,6 +387,29 @@ void sandbox_start() {
|
|||||||
perror("seccomp");
|
perror("seccomp");
|
||||||
exit(1);
|
exit(1);
|
||||||
}
|
}
|
||||||
|
#endif
|
||||||
|
}
|
||||||
|
|
||||||
|
void sandbox_thread_start() {
|
||||||
|
if (!settings::SANDBOX)
|
||||||
|
return;
|
||||||
|
|
||||||
|
if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) < 0) {
|
||||||
|
perror("prctl");
|
||||||
|
exit(1);
|
||||||
|
}
|
||||||
|
|
||||||
|
if (landlock_restrict_self(landlock_fd, 0)) {
|
||||||
|
perror("landlock_restrict_self");
|
||||||
|
exit(1);
|
||||||
|
}
|
||||||
|
|
||||||
|
#if 0
|
||||||
|
if (seccomp(SECCOMP_SET_MODE_FILTER, 0, &prog) < 0) {
|
||||||
|
perror("seccomp");
|
||||||
|
exit(1);
|
||||||
|
}
|
||||||
|
#endif
|
||||||
}
|
}
|
||||||
|
|
||||||
#endif
|
#endif
|
||||||
|
Loading…
Reference in New Issue
Block a user