summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--Makefile5
-rw-r--r--data.c39
-rw-r--r--landloc.h175
-rw-r--r--sandbox.c113
-rw-r--r--snac.h2
5 files changed, 295 insertions, 39 deletions
diff --git a/Makefile b/Makefile
index 05e65f5..2977cd4 100644
--- a/Makefile
+++ b/Makefile
@@ -4,7 +4,7 @@ CFLAGS?=-g -Wall -Wextra -pedantic
4 4
5all: snac 5all: snac
6 6
7snac: snac.o main.o data.o http.o httpd.o webfinger.o \ 7snac: snac.o main.o sandbox.o data.o http.o httpd.o webfinger.o \
8 activitypub.o html.o utils.o format.o upgrade.o mastoapi.o 8 activitypub.o html.o utils.o format.o upgrade.o mastoapi.o
9 $(CC) $(CFLAGS) -L$(PREFIX)/lib *.o -lcurl -lcrypto $(LDFLAGS) -pthread -o $@ 9 $(CC) $(CFLAGS) -L$(PREFIX)/lib *.o -lcurl -lcrypto $(LDFLAGS) -pthread -o $@
10 10
@@ -36,6 +36,9 @@ uninstall:
36activitypub.o: activitypub.c xs.h xs_json.h xs_curl.h xs_mime.h \ 36activitypub.o: activitypub.c xs.h xs_json.h xs_curl.h xs_mime.h \
37 xs_openssl.h xs_regex.h xs_time.h xs_set.h xs_match.h snac.h \ 37 xs_openssl.h xs_regex.h xs_time.h xs_set.h xs_match.h snac.h \
38 http_codes.h 38 http_codes.h
39sandbox.o: sandbox.c xs.h xs_hex.h xs_io.h xs_json.h xs_openssl.h \
40 xs_glob.h xs_set.h xs_time.h xs_regex.h xs_match.h xs_unicode.h \
41 landloc.h snac.h
39data.o: data.c xs.h xs_hex.h xs_io.h xs_json.h xs_openssl.h xs_glob.h \ 42data.o: data.c xs.h xs_hex.h xs_io.h xs_json.h xs_openssl.h xs_glob.h \
40 xs_set.h xs_time.h xs_regex.h xs_match.h xs_unicode.h xs_random.h snac.h \ 43 xs_set.h xs_time.h xs_regex.h xs_match.h xs_unicode.h xs_random.h snac.h \
41 http_codes.h 44 http_codes.h
diff --git a/data.c b/data.c
index 36c41f3..eb4c9d5 100644
--- a/data.c
+++ b/data.c
@@ -115,44 +115,7 @@ int srv_open(const char *basedir, int auto_upgrade)
115#define st_mtim st_mtimespec 115#define st_mtim st_mtimespec
116#endif 116#endif
117 117
118#ifdef __OpenBSD__ 118 sbox_enter(srv_basedir);
119 if (xs_is_true(xs_dict_get(srv_config, "disable_openbsd_security"))) {
120 srv_debug(1, xs_dup("OpenBSD security disabled by admin"));
121 }
122 else {
123 int smail = !xs_is_true(xs_dict_get(srv_config, "disable_email_notifications"));
124 const char *address = xs_dict_get(srv_config, "address");
125
126 srv_debug(1, xs_fmt("Calling unveil()"));
127 unveil(basedir, "rwc");
128 unveil("/tmp", "rwc");
129 unveil("/etc/resolv.conf", "r");
130 unveil("/etc/hosts", "r");
131 unveil("/etc/ssl/openssl.cnf", "r");
132 unveil("/etc/ssl/cert.pem", "r");
133 unveil("/usr/share/zoneinfo", "r");
134
135 if (smail)
136 unveil("/usr/sbin/sendmail", "x");
137
138 if (*address == '/')
139 unveil(address, "rwc");
140
141 unveil(NULL, NULL);
142
143 srv_debug(1, xs_fmt("Calling pledge()"));
144
145 xs *p = xs_str_new("stdio rpath wpath cpath flock inet proc dns fattr");
146
147 if (smail)
148 p = xs_str_cat(p, " exec");
149
150 if (*address == '/')
151 p = xs_str_cat(p, " unix");
152
153 pledge(p, NULL);
154 }
155#endif /* __OpenBSD__ */
156 119
157 /* read (and drop) emojis.json, possibly creating it */ 120 /* read (and drop) emojis.json, possibly creating it */
158 xs_free(emojis()); 121 xs_free(emojis());
diff --git a/landloc.h b/landloc.h
new file mode 100644
index 0000000..e1ade20
--- /dev/null
+++ b/landloc.h
@@ -0,0 +1,175 @@
1/**
2 * Zero-Clause BSD
3 * ===============
4 *
5 * Copyright 2024 shtrophic <christoph@liebender.dev>
6 *
7 * Permission to use, copy, modify, and/or distribute this software for
8 * any purpose with or without fee is hereby granted.
9 *
10 * THE SOFTWARE IS PROVIDED “AS IS” AND THE AUTHOR DISCLAIMS ALL
11 * WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES
12 * OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE
13 * FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY
14 * DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN
15 * AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
16 * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17 *
18 */
19
20/**
21 * Repository: https://git.sr.ht/~shtrophic/landloc.h
22 */
23
24/**
25 * Usage:
26 *
27 * Define a sandboxing function using the LL_BEGIN(...) and LL_END macros.
28 * the arguments of LL_BEGIN are the function's signature.
29 * Between those macros, implement your sandbox using LL_PATH() and LL_PORT() macros.
30 * Calling LL_PATH() and LL_PORT() anywhere else will not work.
31 * You may prepend `static` before LL_BEGIN to make the function static.
32 * You need (should) wrap your sandboxing code in another set of braces:
33 *
34LL_BEGIN(my_sandbox_function, const char *rw_path) {
35
36 LL_PATH(rw_path, LANDLOCK_ACCESS_FS_READ_FILE | LANDLOCK_ACCESS_FS_READ_DIR | LANDLOCK_ACCESS_FS_EXECUTE);
37 LL_PORT(443, LANDLOCK_ACCESS_NET_CONNECT_TCP);
38
39} LL_END
40
41 *
42 * Then, call it in your application's code.
43 *
44
45int main(void) {
46
47 int status = my_sandbox_function("some/path");
48
49 if (status != 0) {
50 // error
51 }
52
53}
54
55 *
56 * You may define LL_PRINTERR(fmt, ...) before including this header to enable debug output:
57 *
58
59#define LL_PRINTERR(fmt, ...) fprintf(stderr, fmt "\n", __VA_ARGS__)
60#include "landloc.h"
61
62 */
63
64#ifndef __LANDLOC_H__
65#define __LANDLOC_H__
66
67#ifndef __linux__
68#error "no landlock without linux"
69#endif
70
71#include <unistd.h>
72#include <linux/landlock.h>
73#include <sys/syscall.h>
74#include <sys/prctl.h>
75#include <fcntl.h>
76
77#ifndef O_PATH
78#define O_PATH 010000000
79#endif
80
81#ifndef LL_PRINTERR
82#define LL_PRINTERR(fmt, ...) (void)fmt;
83#else
84#include <string.h>
85#include <errno.h>
86#endif
87
88#define LL_FS_ALL (\
89 LANDLOCK_ACCESS_FS_EXECUTE |\
90 LANDLOCK_ACCESS_FS_WRITE_FILE |\
91 LANDLOCK_ACCESS_FS_READ_FILE |\
92 LANDLOCK_ACCESS_FS_READ_DIR |\
93 LANDLOCK_ACCESS_FS_REMOVE_DIR |\
94 LANDLOCK_ACCESS_FS_REMOVE_FILE |\
95 LANDLOCK_ACCESS_FS_MAKE_CHAR |\
96 LANDLOCK_ACCESS_FS_MAKE_DIR |\
97 LANDLOCK_ACCESS_FS_MAKE_REG |\
98 LANDLOCK_ACCESS_FS_MAKE_SOCK |\
99 LANDLOCK_ACCESS_FS_MAKE_FIFO |\
100 LANDLOCK_ACCESS_FS_MAKE_BLOCK |\
101 LANDLOCK_ACCESS_FS_MAKE_SYM |\
102 LANDLOCK_ACCESS_FS_REFER |\
103 LANDLOCK_ACCESS_FS_TRUNCATE |\
104 LANDLOCK_ACCESS_FS_IOCTL_DEV )
105
106#define LL_NET_ALL (\
107 LANDLOCK_ACCESS_NET_BIND_TCP |\
108 LANDLOCK_ACCESS_NET_CONNECT_TCP )
109
110#define LL_BEGIN(function, ...) int function(__VA_ARGS__) {\
111 int ll_rule_fd, ll_abi;\
112 struct landlock_ruleset_attr __rattr = {0};\
113 struct landlock_path_beneath_attr __pattr = {0};\
114 struct landlock_net_port_attr __nattr = {0};\
115 int __err = 0;\
116 __rattr.handled_access_fs = LL_FS_ALL;\
117 __rattr.handled_access_net = LL_NET_ALL;\
118 ll_abi = (int)syscall(SYS_landlock_create_ruleset, NULL, 0, LANDLOCK_CREATE_RULESET_VERSION);\
119 switch (ll_abi) {\
120 case -1: return -1;\
121 case 1: __rattr.handled_access_fs &= ~LANDLOCK_ACCESS_FS_REFER; __attribute__((fallthrough));\
122 case 2: __rattr.handled_access_fs &= ~LANDLOCK_ACCESS_FS_TRUNCATE; __attribute__((fallthrough));\
123 case 3: __rattr.handled_access_net &= ~(LANDLOCK_ACCESS_NET_BIND_TCP | LANDLOCK_ACCESS_NET_CONNECT_TCP); __attribute__((fallthrough));\
124 case 4: __rattr.handled_access_fs &= ~LANDLOCK_ACCESS_FS_IOCTL_DEV;\
125 default: break;\
126 }\
127 ll_rule_fd = (int)syscall(SYS_landlock_create_ruleset, &__rattr, sizeof(struct landlock_ruleset_attr), 0);\
128 if (-1 == ll_rule_fd) {\
129 LL_PRINTERR("landlock_create_ruleset: %s", strerror(errno));\
130 return -1;\
131 }
132
133#define LL_END \
134 __err = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);\
135 if (-1 == __err) {\
136 LL_PRINTERR("set_no_new_privs: %s", strerror(errno));\
137 goto __close;\
138 }\
139 __err = (int)syscall(SYS_landlock_restrict_self, ll_rule_fd, 0);\
140 if (__err)\
141 LL_PRINTERR("landlock_restrict_self: %s", strerror(errno));\
142 __close: close(ll_rule_fd);\
143 return __err; }
144
145#define LL_PATH(p, rules) do {\
146 const char *__path = (p);\
147 __pattr.allowed_access = (rules) & __rattr.handled_access_fs;\
148 __pattr.parent_fd = open(__path, O_PATH | O_CLOEXEC);\
149 if (-1 == __pattr.parent_fd) {\
150 LL_PRINTERR("open(%s): %s", __path, strerror(errno));\
151 __err = -1;\
152 goto __close;\
153 }\
154 __err = (int)syscall(SYS_landlock_add_rule, ll_rule_fd, LANDLOCK_RULE_PATH_BENEATH, &__pattr, 0);\
155 if (__err) {\
156 LL_PRINTERR("landlock_add_rule(%s): %s", __path, strerror(errno));\
157 goto __close;\
158 }\
159 close(__pattr.parent_fd);\
160} while (0)
161
162#define LL_PORT(p, rules) do {\
163 unsigned short __port = (p);\
164 __nattr.allowed_access = (rules);\
165 if (ll_abi > 3) {\
166 __nattr.port = __port;\
167 __err = (int)syscall(SYS_landlock_add_rule, ll_rule_fd, LANDLOCK_RULE_NET_PORT, &__nattr, 0);\
168 if (__err) {\
169 LL_PRINTERR("landlock_add_rule(%u): %s", __port, strerror(errno));\
170 goto __close;\
171 }\
172 }\
173} while (0)
174
175#endif /* __LANDLOC_H__ */
diff --git a/sandbox.c b/sandbox.c
new file mode 100644
index 0000000..6eafc43
--- /dev/null
+++ b/sandbox.c
@@ -0,0 +1,113 @@
1#include "xs.h"
2
3#include "snac.h"
4
5#include <unistd.h>
6
7#if defined (__linux__)
8
9#define LL_PRINTERR(fmt, ...) srv_debug(0, xs_fmt(fmt, __VA_ARGS__))
10#include "landloc.h"
11
12static
13LL_BEGIN(sbox_enter_linux_, const char* basedir, const char *address, int smail) {
14
15 const unsigned long long
16 rd = LANDLOCK_ACCESS_FS_READ_DIR,
17 rf = LANDLOCK_ACCESS_FS_READ_FILE,
18 w = LANDLOCK_ACCESS_FS_WRITE_FILE |
19 LANDLOCK_ACCESS_FS_TRUNCATE,
20 c = LANDLOCK_ACCESS_FS_MAKE_DIR |
21 LANDLOCK_ACCESS_FS_MAKE_REG |
22 LANDLOCK_ACCESS_FS_TRUNCATE |
23 LANDLOCK_ACCESS_FS_MAKE_SYM |
24 LANDLOCK_ACCESS_FS_REMOVE_DIR |
25 LANDLOCK_ACCESS_FS_REMOVE_FILE |
26 LANDLOCK_ACCESS_FS_REFER,
27 s = LANDLOCK_ACCESS_FS_MAKE_SOCK,
28 x = LANDLOCK_ACCESS_FS_EXECUTE;
29
30 LL_PATH(basedir, rf|rd|w|c);
31 LL_PATH("/tmp", rf|rd|w|c);
32#ifndef WITHOUT_SHM
33 LL_PATH("/dev/shm", rf|w|c );
34#endif
35 LL_PATH("/etc/resolv.conf", rf );
36 LL_PATH("/etc/hosts", rf );
37 LL_PATH("/etc/ssl/openssl.cnf", rf );
38 LL_PATH("/etc/ssl/cert.pem", rf );
39 LL_PATH("/usr/share/zoneinfo", rf );
40
41 if (*address == '/')
42 LL_PATH(address, s);
43
44 if (smail)
45 LL_PATH("/usr/sbin/sendmail", x);
46
47 if (*address != '/') {
48 unsigned short listen_port = xs_number_get(xs_dict_get(srv_config, "port"));
49 LL_PORT(listen_port, LANDLOCK_ACCESS_NET_BIND_TCP);
50 }
51
52 LL_PORT(80, LANDLOCK_ACCESS_NET_CONNECT_TCP);
53 LL_PORT(443, LANDLOCK_ACCESS_NET_CONNECT_TCP);
54
55} LL_END
56
57#endif
58
59void sbox_enter(const char *basedir)
60{
61 if (xs_is_true(xs_dict_get(srv_config, "disable_openbsd_security"))) {
62 srv_log(xs_dup("disable_openbsd_security is deprecated. Use disable_sandbox instead."));
63 return;
64 }
65 if (xs_is_true(xs_dict_get(srv_config, "disable_sandbox"))) {
66 srv_debug(0, xs_dup("Sandbox disabled by admin"));
67 return;
68 }
69
70 const char *address = xs_dict_get(srv_config, "address");
71
72 int smail = !xs_is_true(xs_dict_get(srv_config, "disable_email_notifications"));
73
74#if defined (__OpenBSD__)
75 srv_debug(1, xs_fmt("Calling unveil()"));
76 unveil(basedir, "rwc");
77 unveil("/tmp", "rwc");
78 unveil("/etc/resolv.conf", "r");
79 unveil("/etc/hosts", "r");
80 unveil("/etc/ssl/openssl.cnf", "r");
81 unveil("/etc/ssl/cert.pem", "r");
82 unveil("/usr/share/zoneinfo", "r");
83
84 if (smail)
85 unveil("/usr/sbin/sendmail", "x");
86
87 if (*address == '/')
88 unveil(address, "rwc");
89
90 unveil(NULL, NULL);
91
92 srv_debug(1, xs_fmt("Calling pledge()"));
93
94 xs *p = xs_str_new("stdio rpath wpath cpath flock inet proc dns fattr");
95
96 if (smail)
97 p = xs_str_cat(p, " exec");
98
99 if (*address == '/')
100 p = xs_str_cat(p, " unix");
101
102 pledge(p, NULL);
103
104 xs_free(p);
105#elif defined (__linux__)
106
107 if (sbox_enter_linux_(basedir, address, smail) == 0)
108 srv_log(xs_dup("landlocked"));
109 else
110 srv_log(xs_dup("landlocking failed"));
111
112#endif
113}
diff --git a/snac.h b/snac.h
index af6e597..96916d1 100644
--- a/snac.h
+++ b/snac.h
@@ -75,6 +75,8 @@ void snac_log(snac *user, xs_str *str);
75int srv_open(const char *basedir, int auto_upgrade); 75int srv_open(const char *basedir, int auto_upgrade);
76void srv_free(void); 76void srv_free(void);
77 77
78void sbox_enter(const char *basedir);
79
78int user_open(snac *snac, const char *uid); 80int user_open(snac *snac, const char *uid);
79void user_free(snac *snac); 81void user_free(snac *snac);
80xs_list *user_list(void); 82xs_list *user_list(void);
HIC SVNT DRACONES