From eacadbcc41eb0dd9ebbafbab8e1ae0fc84b61fdb Mon Sep 17 00:00:00 2001 From: Remi Gacogne Date: Wed, 3 Apr 2024 16:18:17 +0200 Subject: [PATCH] Restrict filesystem access to the download process whenever possible Signed-off-by: Remi Gacogne --- lib/libalpm/alpm.h | 4 +- lib/libalpm/dload.c | 2 +- lib/libalpm/meson.build | 1 + lib/libalpm/sandbox.c | 8 +- lib/libalpm/sandbox_fs.c | 173 +++++++++++++++++++++++++++++++++++++++ lib/libalpm/sandbox_fs.h | 27 ++++++ meson.build | 1 + src/pacman/conf.c | 10 +-- 8 files changed, 217 insertions(+), 9 deletions(-) create mode 100644 lib/libalpm/sandbox_fs.c create mode 100644 lib/libalpm/sandbox_fs.h diff --git a/lib/libalpm/alpm.h b/lib/libalpm/alpm.h index 268f7213..43d45198 100644 --- a/lib/libalpm/alpm.h +++ b/lib/libalpm/alpm.h @@ -2954,10 +2954,12 @@ const char *alpm_version(void); int alpm_capabilities(void); /** Drop privileges by switching to a different user. + * @param handle the context handle * @param sandboxuser the user to switch to + * @param sandbox_path if non-NULL, restrict writes to this filesystem path * @return 0 on success, -1 on failure */ -int alpm_sandbox_setup_child(const char *sandboxuser); +int alpm_sandbox_setup_child(alpm_handle_t *handle, const char *sandboxuser, const char *sandbox_path); /* End of libalpm_misc */ /** @} */ diff --git a/lib/libalpm/dload.c b/lib/libalpm/dload.c index b086fac1..9815d474 100644 --- a/lib/libalpm/dload.c +++ b/lib/libalpm/dload.c @@ -959,7 +959,7 @@ static int curl_download_internal_sandboxed(alpm_handle_t *handle, _alpm_log(handle, ALPM_LOG_ERROR, _("could not chdir to download directory %s\n"), localpath); ret = -1; } else { - ret = alpm_sandbox_setup_child(handle->sandboxuser); + ret = alpm_sandbox_setup_child(handle, handle->sandboxuser, localpath); if (ret != 0) { _alpm_log(handle, ALPM_LOG_ERROR, _("switching to sandbox user '%s' failed!\n"), handle->sandboxuser); _Exit(2); diff --git a/lib/libalpm/meson.build b/lib/libalpm/meson.build index 224fbf5f..1a6672da 100644 --- a/lib/libalpm/meson.build +++ b/lib/libalpm/meson.build @@ -25,6 +25,7 @@ libalpm_sources = files(''' rawstr.c remove.h remove.c sandbox.h sandbox.c + sandbox_fs.h sandbox_fs.c signing.c signing.h sync.h sync.c trans.h trans.c diff --git a/lib/libalpm/sandbox.c b/lib/libalpm/sandbox.c index 0f3d7084..fd3b8c45 100644 --- a/lib/libalpm/sandbox.c +++ b/lib/libalpm/sandbox.c @@ -1,7 +1,7 @@ /* * sandbox.c * - * Copyright (c) 2021-2022 Pacman Development Team + * Copyright (c) 2021-2024 Pacman Development Team * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by @@ -26,15 +26,19 @@ #include "alpm.h" #include "log.h" #include "sandbox.h" +#include "sandbox_fs.h" #include "util.h" -int SYMEXPORT alpm_sandbox_setup_child(const char* sandboxuser) +int SYMEXPORT alpm_sandbox_setup_child(alpm_handle_t *handle, const char* sandboxuser, const char* sandbox_path) { struct passwd const *pw = NULL; ASSERT(sandboxuser != NULL, return -1); ASSERT(getuid() == 0, return -1); ASSERT((pw = getpwnam(sandboxuser)), return -1); + if(sandbox_path != NULL) { + _alpm_sandbox_fs_restrict_writes_to(handle, sandbox_path); + } ASSERT(setgid(pw->pw_gid) == 0, return -1); ASSERT(setgroups(0, NULL) == 0, return -1); ASSERT(setuid(pw->pw_uid) == 0, return -1); diff --git a/lib/libalpm/sandbox_fs.c b/lib/libalpm/sandbox_fs.c new file mode 100644 index 00000000..3d7de013 --- /dev/null +++ b/lib/libalpm/sandbox_fs.c @@ -0,0 +1,173 @@ +/* + * sandbox_fs.c + * + * Copyright (c) 2021-2024 Pacman Development Team + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program. If not, see . + */ +#include +#include +#include +#include + +#include "config.h" +#include "log.h" +#include "sandbox_fs.h" +#include "util.h" + +#ifdef HAVE_LINUX_LANDLOCK_H +# include +# include +# include +#endif /* HAVE_LINUX_LANDLOCK_H */ + +#ifdef HAVE_LINUX_LANDLOCK_H +#ifndef landlock_create_ruleset +static inline int landlock_create_ruleset(const struct landlock_ruleset_attr *const attr, + const size_t size, const __u32 flags) +{ + return syscall(__NR_landlock_create_ruleset, attr, size, flags); +} +#endif /* landlock_create_ruleset */ + +#ifndef landlock_add_rule +static inline int landlock_add_rule(const int ruleset_fd, + const enum landlock_rule_type rule_type, + const void *const rule_attr, const __u32 flags) +{ + return syscall(__NR_landlock_add_rule, ruleset_fd, rule_type, rule_attr, flags); +} +#endif /* landlock_add_rule */ + +#ifndef landlock_restrict_self +static inline int landlock_restrict_self(const int ruleset_fd, const __u32 flags) +{ + return syscall(__NR_landlock_restrict_self, ruleset_fd, flags); +} +#endif /* landlock_restrict_self */ + +#define _LANDLOCK_ACCESS_FS_WRITE ( \ + LANDLOCK_ACCESS_FS_WRITE_FILE | \ + LANDLOCK_ACCESS_FS_REMOVE_DIR | \ + LANDLOCK_ACCESS_FS_REMOVE_FILE | \ + LANDLOCK_ACCESS_FS_MAKE_CHAR | \ + LANDLOCK_ACCESS_FS_MAKE_DIR | \ + LANDLOCK_ACCESS_FS_MAKE_REG | \ + LANDLOCK_ACCESS_FS_MAKE_SOCK | \ + LANDLOCK_ACCESS_FS_MAKE_FIFO | \ + LANDLOCK_ACCESS_FS_MAKE_BLOCK | \ + LANDLOCK_ACCESS_FS_MAKE_SYM) + +#define _LANDLOCK_ACCESS_FS_READ ( \ + LANDLOCK_ACCESS_FS_READ_FILE | \ + LANDLOCK_ACCESS_FS_READ_DIR) + +#ifdef LANDLOCK_ACCESS_FS_REFER +#define _LANDLOCK_ACCESS_FS_REFER LANDLOCK_ACCESS_FS_REFER +#else +#define _LANDLOCK_ACCESS_FS_REFER 0 +#endif /* LANDLOCK_ACCESS_FS_REFER */ + +#ifdef LANDLOCK_ACCESS_FS_TRUNCATE +#define _LANDLOCK_ACCESS_FS_TRUNCATE LANDLOCK_ACCESS_FS_TRUNCATE +#else +#define _LANDLOCK_ACCESS_FS_TRUNCATE 0 +#endif /* LANDLOCK_ACCESS_FS_TRUNCATE */ + +#endif /* HAVE_LINUX_LANDLOCK_H */ + +bool _alpm_sandbox_fs_restrict_writes_to(alpm_handle_t *handle, const char *path) +{ + ASSERT(handle != NULL, return false); + ASSERT(path != NULL, return false); + +#ifdef HAVE_LINUX_LANDLOCK_H + struct landlock_ruleset_attr ruleset_attr = { + .handled_access_fs = \ + _LANDLOCK_ACCESS_FS_READ | \ + _LANDLOCK_ACCESS_FS_WRITE | \ + _LANDLOCK_ACCESS_FS_REFER | \ + _LANDLOCK_ACCESS_FS_TRUNCATE | \ + LANDLOCK_ACCESS_FS_EXECUTE, + }; + struct landlock_path_beneath_attr path_beneath = { + .allowed_access = _LANDLOCK_ACCESS_FS_READ, + }; + int abi = 0; + int result = 0; + int ruleset_fd; + + abi = landlock_create_ruleset(NULL, 0, LANDLOCK_CREATE_RULESET_VERSION); + if(abi < 0) { + /* landlock is not supported/enabled in the kernel */ + _alpm_log(handle, ALPM_LOG_ERROR, _("restricting filesystem access failed because landlock is not supported by the kernel!\n")); + return true; + } +#ifdef LANDLOCK_ACCESS_FS_REFER + if(abi < 2) { + _alpm_log(handle, ALPM_LOG_DEBUG, _("landlock ABI < 2, LANDLOCK_ACCESS_FS_REFER is not supported\n")); + ruleset_attr.handled_access_fs &= ~LANDLOCK_ACCESS_FS_REFER; + } +#endif /* LANDLOCK_ACCESS_FS_REFER */ +#ifdef LANDLOCK_ACCESS_FS_TRUNCATE + if(abi < 3) { + _alpm_log(handle, ALPM_LOG_DEBUG, _("landlock ABI < 3, LANDLOCK_ACCESS_FS_TRUNCATE is not supported\n")); + ruleset_attr.handled_access_fs &= ~LANDLOCK_ACCESS_FS_TRUNCATE; + } +#endif /* LANDLOCK_ACCESS_FS_TRUNCATE */ + + ruleset_fd = landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0); + if(ruleset_fd < 0) { + _alpm_log(handle, ALPM_LOG_ERROR, _("restricting filesystem access failed because the landlock ruleset could not be created!\n")); + return false; + } + + /* allow / as read-only */ + path_beneath.parent_fd = open("/", O_PATH | O_CLOEXEC | O_DIRECTORY); + path_beneath.allowed_access = _LANDLOCK_ACCESS_FS_READ; + + if(landlock_add_rule(ruleset_fd, LANDLOCK_RULE_PATH_BENEATH, &path_beneath, 0) != 0) { + _alpm_log(handle, ALPM_LOG_ERROR, _("restricting filesystem access failed because the landlock rule for / could not be added!\n")); + close(path_beneath.parent_fd); + close(ruleset_fd); + return false; + } + + close(path_beneath.parent_fd); + + /* allow read-write access to the directory passed as parameter */ + path_beneath.parent_fd = open(path, O_PATH | O_CLOEXEC | O_DIRECTORY); + path_beneath.allowed_access = _LANDLOCK_ACCESS_FS_READ | _LANDLOCK_ACCESS_FS_WRITE | _LANDLOCK_ACCESS_FS_TRUNCATE; + + if(!landlock_add_rule(ruleset_fd, LANDLOCK_RULE_PATH_BENEATH, &path_beneath, 0) != 0) { + if(landlock_restrict_self(ruleset_fd, 0)) { + _alpm_log(handle, ALPM_LOG_ERROR, _("restricting filesystem access failed because the landlock ruleset could not be applied!\n")); + result = errno; + } + } else { + result = errno; + _alpm_log(handle, ALPM_LOG_ERROR, _("restricting filesystem access failed because the landlock rule for the temporary download directory could not be added!\n")); + } + + close(path_beneath.parent_fd); + close(ruleset_fd); + if(result == 0) { + _alpm_log(handle, ALPM_LOG_DEBUG, _("filesystem access has been restricted to %s, landlock ABI is %d\n"), path, abi); + return true; + } + return false; +#else /* HAVE_LINUX_LANDLOCK_H */ + return true; +#endif /* HAVE_LINUX_LANDLOCK_H */ +} diff --git a/lib/libalpm/sandbox_fs.h b/lib/libalpm/sandbox_fs.h new file mode 100644 index 00000000..70bfa157 --- /dev/null +++ b/lib/libalpm/sandbox_fs.h @@ -0,0 +1,27 @@ +/* + * sandbox_fs.h + * + * Copyright (c) 2021-2024 Pacman Development Team + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program. If not, see . + */ +#ifndef ALPM_SANDBOX_FS_H +#define ALPM_SANDBOX_FS_H + +#include +#include "alpm.h" + +bool _alpm_sandbox_fs_restrict_writes_to(alpm_handle_t *handle, const char *path); + +#endif /* ALPM_SANDBOX_FS_H */ diff --git a/meson.build b/meson.build index bc2ef468..21b8cede 100644 --- a/meson.build +++ b/meson.build @@ -123,6 +123,7 @@ else endif foreach header : [ + 'linux/landlock.h', 'mntent.h', 'sys/mnttab.h', 'sys/mount.h', diff --git a/src/pacman/conf.c b/src/pacman/conf.c index 2cf56bf1..9529aefc 100644 --- a/src/pacman/conf.c +++ b/src/pacman/conf.c @@ -218,7 +218,7 @@ static char *get_tempfile(const char *path, const char *filename) * - not thread-safe * - errno may be set by fork(), pipe(), or execvp() */ -static int systemvp(const char *file, char *const argv[], const char *sandboxuser) +static int systemvp(const char *file, char *const argv[]) { int pid, err = 0, ret = -1, err_fd[2]; sigset_t oldblock; @@ -245,10 +245,10 @@ static int systemvp(const char *file, char *const argv[], const char *sandboxuse sigaction(SIGQUIT, &oldquit, NULL); sigprocmask(SIG_SETMASK, &oldblock, NULL); - if (sandboxuser) { - ret = alpm_sandbox_setup_child(sandboxuser); + if (config->sandboxuser) { + ret = alpm_sandbox_setup_child(config->handle, config->sandboxuser, NULL); if (ret != 0) { - pm_printf(ALPM_LOG_ERROR, _("switching to sandbox user '%s' failed!\n"), sandboxuser); + pm_printf(ALPM_LOG_ERROR, _("switching to sandbox user '%s' failed!\n"), config->sandboxuser); _Exit(ret); } } @@ -363,7 +363,7 @@ static int download_with_xfercommand(void *ctx, const char *url, free(cmd); } } - retval = systemvp(argv[0], (char**)argv, config->sandboxuser); + retval = systemvp(argv[0], (char**)argv); if(retval == -1) { pm_printf(ALPM_LOG_WARNING, _("running XferCommand: fork failed!\n"));