// Copyright 2014 The Chromium Authors
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

#include "sandbox/linux/seccomp-bpf-helpers/baseline_policy_android.h"

#include <errno.h>
#include <fcntl.h>
#include <linux/android/binder.h>
#include <linux/ashmem.h>
#include <linux/incrementalfs.h>
#include <linux/nbd.h>
#include <linux/net.h>
#include <linux/userfaultfd.h>
#include <sched.h>
#include <sys/mman.h>
#include <sys/socket.h>
#include <sys/syscall.h>
#include <sys/types.h>

#include "build/build_config.h"
#include "sandbox/linux/bpf_dsl/bpf_dsl.h"
#include "sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.h"
#include "sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.h"
#include "sandbox/linux/seccomp-bpf-helpers/syscall_sets.h"
#include "sandbox/linux/system_headers/linux_syscalls.h"

#if defined(__x86_64__)
#include <asm/prctl.h>
#endif

using sandbox::bpf_dsl::AllOf;
using sandbox::bpf_dsl::Allow;
using sandbox::bpf_dsl::AnyOf;
using sandbox::bpf_dsl::Arg;
using sandbox::bpf_dsl::BoolConst;
using sandbox::bpf_dsl::BoolExpr;
using sandbox::bpf_dsl::Error;
using sandbox::bpf_dsl::If;
using sandbox::bpf_dsl::ResultExpr;

namespace sandbox {

namespace {

// Restricts the arguments to sys_socket() to AF_UNIX. Returns a BoolExpr that
// evaluates to true if the syscall should be allowed.
BoolExpr RestrictSocketArguments(const Arg<int>& domain,
                                 const Arg<int>& type,
                                 const Arg<int>& protocol) {
  const int kSockFlags = SOCK_CLOEXEC | SOCK_NONBLOCK;
  return AllOf(domain == AF_UNIX,
               AnyOf((type & ~kSockFlags) == SOCK_DGRAM,
                     (type & ~kSockFlags) == SOCK_STREAM),
               protocol == 0);
}

ResultExpr RestrictAndroidIoctl(bool allow_userfaultfd_ioctls) {
  const Arg<unsigned int> request(1);

  // There is no way at runtime to test if the system is running with
  // BINDER_IPC_32BIT. Instead, compute the corresponding bitness' ioctl
  // request number, so that either are allowed in the case of mixed-bitness
  // systems.
#ifdef BINDER_IPC_32BIT
  const unsigned int kBinderWriteRead32 = BINDER_WRITE_READ;
  const unsigned int kBinderWriteRead64 =
      (BINDER_WRITE_READ & ~IOCSIZE_MASK) |
      ((sizeof(binder_write_read) * 2) << _IOC_SIZESHIFT);
#else
  const unsigned int kBinderWriteRead64 = BINDER_WRITE_READ;
  const unsigned int kBinderWriteRead32 =
      (BINDER_WRITE_READ & ~IOCSIZE_MASK) |
      ((sizeof(binder_write_read) / 2) << _IOC_SIZESHIFT);
#endif

  // ANDROID_ALARM_GET_TIME(ANDROID_ALARM_ELAPSED_REALTIME), a legacy interface
  // for getting clock information from /dev/alarm. It was removed in Android O
  // (https://android-review.googlesource.com/c/221812), and it can be safely
  // blocked in earlier releases because there is a fallback. Constant expanded
  // from
  // https://cs.android.com/android/platform/superproject/+/android-7.0.0_r1:external/kernel-headers/original/uapi/linux/android_alarm.h;l=57.
  // The size is a `struct timespec`, which has a different width on 32- and
  // 64-bit systems, so handle both.
  const unsigned int kAndroidAlarmGetTimeElapsedRealtime32 = 0x40086134;
  const unsigned int kAndroidAlarmGetTimeElapsedRealtime64 = 0x40106134;
  return Switch(request)
      .Cases(
          {// Android shared memory.
           ASHMEM_SET_NAME, ASHMEM_GET_NAME, ASHMEM_SET_SIZE, ASHMEM_GET_SIZE,
           ASHMEM_SET_PROT_MASK, ASHMEM_GET_PROT_MASK, ASHMEM_PIN, ASHMEM_UNPIN,
           ASHMEM_GET_PIN_STATUS,
           // Binder.
           kBinderWriteRead32, kBinderWriteRead64, BINDER_SET_MAX_THREADS,
           BINDER_THREAD_EXIT, BINDER_VERSION,
           BINDER_ENABLE_ONEWAY_SPAM_DETECTION, BINDER_GET_EXTENDED_ERROR,
           // incfs read ops.
           INCFS_IOC_READ_FILE_SIGNATURE, INCFS_IOC_GET_FILLED_BLOCKS,
           INCFS_IOC_GET_READ_TIMEOUTS, INCFS_IOC_GET_LAST_READ_ERROR,
           INCFS_IOC_GET_BLOCK_COUNT, INCFS_IOC_SET_READ_TIMEOUTS},
          Allow())
      .Cases(
          {// userfaultfd ART GC (https://crbug.com/1300653).
           UFFDIO_REGISTER, UFFDIO_UNREGISTER, UFFDIO_WAKE, UFFDIO_COPY,
           UFFDIO_ZEROPAGE, UFFDIO_CONTINUE,
           // crbug.com/393204193
           UFFDIO_MOVE},
          If(BoolConst(allow_userfaultfd_ioctls), Allow())
              .Else(RestrictIoctl()))
      .Cases(
          {// Deprecated Android /dev/alarm interface.
           kAndroidAlarmGetTimeElapsedRealtime32,
           kAndroidAlarmGetTimeElapsedRealtime64,
           // Linux Network Block Device requests observed in the field
           // https://crbug.com/1314105.
           NBD_CLEAR_SOCK, NBD_SET_BLKSIZE},
          Error(EINVAL))
      .Default(RestrictIoctl());
}

ResultExpr RestrictCloneParameters() {
  const Arg<unsigned long> flags(0);

  const uint64_t kForkFlags =
      CLONE_CHILD_SETTID | CLONE_CHILD_CLEARTID | SIGCHLD;
  const uint64_t kPthreadCreateFlags =
      CLONE_VM | CLONE_FS | CLONE_FILES | CLONE_SIGHAND | CLONE_THREAD |
      CLONE_SYSVSEM | CLONE_SETTLS | CLONE_PARENT_SETTID | CLONE_CHILD_CLEARTID;

  const BoolExpr is_fork_or_pthread =
      AnyOf(flags == kForkFlags, flags == kPthreadCreateFlags);
  return If(is_fork_or_pthread, Allow()).Else(CrashSIGSYSClone());
}

bool IsBaselinePolicyAllowed(int sysno) {
  // The following syscalls are used in the renderer policy on Android but still
  // need to be allowed on Android and should not be filtered out of other
  // processes: mremap, ftruncate, ftruncate64, pwrite64, getcpu, fdatasync,
  // fsync, getrlimit, ugetrlimit, setrlimit.

  switch (sysno) {
    case __NR_epoll_pwait:
    case __NR_fdatasync:
    case __NR_flock:
    case __NR_fsync:
#if defined(__LP64__)
    case __NR_ftruncate:
    case __NR_newfstatat:
    case __NR_fstatfs:
#else
    case __NR_ftruncate64:
    case __NR_fstatat64:
    case __NR_fstatfs64:
#endif
#if defined(__arm__) || defined(__aarch64__)
    // getcpu() is allowed on ARM chips because it is used in
    // //third_party/cpuinfo/ on those chips.
    case __NR_getcpu:
#endif
    case __NR_getdents64:
    case __NR_getpriority:
    case __NR_membarrier:  // https://crbug.com/966433
#if defined(__i386__)
    // Used on pre-N to initialize threads in ART.
    case __NR_modify_ldt:
#endif
    case __NR_mremap:
    case __NR_msync:
      // File system access cannot be restricted with seccomp-bpf on Android,
      // since the JVM classloader and other Framework features require file
      // access. It may be possible to restrict the filesystem with SELinux.
      // Currently we rely on the app/service UID isolation to create a
      // filesystem "sandbox".
    case __NR_openat:
    case __NR_pwrite64:
    case __NR_rt_sigtimedwait:
#if !defined(__LP64__)
    // TODO(crbug.com/40528912): bionic has no plans to support 64-bit time_t on ILP32.
    case __NR_rt_sigtimedwait_time64:
#endif
    case __NR_sched_getparam:
    case __NR_sched_getscheduler:
    case __NR_sched_setscheduler:
    case __NR_setpriority:
#if defined(__i386__)
    // Used on N+ instead of __NR_modify_ldt to initialize threads in ART.
    case __NR_set_thread_area:
#endif
    case __NR_set_tid_address:
#if defined(__LP64__)
    case __NR_getrlimit:
#else
    case __NR_ugetrlimit:
#endif

      // Permit socket operations so that renderers can connect to logd and
      // debuggerd. The arguments to socket() are further restricted below.
      // Note that on i386 (until API level 38), both of these calls mapped
      // to __NR_socketcall, which is demultiplexed below.
    case __NR_getsockopt:
    case __NR_connect:

      return true;
    default:
      return false;
  }
}

}  // namespace

BaselinePolicyAndroid::BaselinePolicyAndroid() = default;

BaselinePolicyAndroid::BaselinePolicyAndroid(const RuntimeOptions& options)
    : options_(options) {}

BaselinePolicyAndroid::~BaselinePolicyAndroid() = default;

ResultExpr BaselinePolicyAndroid::EvaluateSyscall(int sysno) const {
  if (sysno == __NR_clone) {
    if (options_.should_restrict_clone_params) {
      return RestrictCloneParameters();
    }
    return Allow();
  }
  if (sysno == __NR_sched_setaffinity || sysno == __NR_sched_getaffinity) {
    return Error(EPERM);
  }

  if (sysno == __NR_ioctl) {
    return RestrictAndroidIoctl(options_.allow_userfaultfd_ioctls);
  }

  if (sysno == __NR_madvise) {
    // Allow MADV_PAGEOUT
    const Arg<int> advice(2);
    return If(advice == MADV_PAGEOUT, Allow())
        .Else(BaselinePolicy::EvaluateSyscall(sysno));
  }

  // Ptrace is allowed so the crash reporter can fork in a renderer
  // and then ptrace the parent. https://crbug.com/933418
  if (sysno == __NR_ptrace) {
    return RestrictPtrace();
  }

  // https://crbug.com/766245
  if (sysno == __NR_process_vm_readv) {
    const Arg<pid_t> pid(0);
    return If(pid == policy_pid(), Allow())
           .Else(Error(EPERM));
  }

  if (!options_.should_restrict_renderer_syscalls) {
    if (sysno == __NR_sysinfo) {
      return Allow();
    }
    // https://crbug.com/655299
    if (sysno == __NR_clock_getres
#if !defined(__LP64__)
      // TODO(crbug.com/40528912): bionic has no plans to support 64-bit time_t on ILP32.
      || sysno == __NR_clock_getres_time64
#endif
    ) {
    return RestrictClockID();
    }
  }

  // https://crbug.com/826289
  if (sysno == __NR_getrusage) {
    return RestrictGetrusage();
  }

#if defined(__x86_64__)
  if (sysno == __NR_arch_prctl) {
    const Arg<int> code(0);
    return If(code == ARCH_SET_GS, Allow()).Else(Error(EPERM));
  }
#endif

  // Restrict socket-related operations.
  if (sysno == __NR_socket) {
    const Arg<int> domain(0);
    const Arg<int> type(1);
    const Arg<int> protocol(2);
    return If(RestrictSocketArguments(domain, type, protocol), Allow())
           .Else(Error(EPERM));
  }

  // https://crbug.com/655300
  if (sysno == __NR_getsockname) {
    // Rather than blocking with SIGSYS, just return an error. This is not
    // documented to be a valid errno, but we will use it anyways.
    return Error(EPERM);
  }

  // https://crbug.com/682488, https://crbug.com/701137
  if (sysno == __NR_setsockopt) {
    // The baseline policy applies other restrictions to setsockopt.
    const Arg<int> level(1);
    const Arg<int> option(2);
    return If(AllOf(level == SOL_SOCKET,
                    AnyOf(option == SO_SNDTIMEO,
                          option == SO_RCVTIMEO,
                          option == SO_SNDBUF,
                          option == SO_REUSEADDR,
                          option == SO_PASSCRED)),
              Allow())
           .Else(BaselinePolicy::EvaluateSyscall(sysno));
  }

#if defined(__i386__)
  // On i386 (until API level 38), the socketcall syscall demultiplexes socket
  // operations and the individual system calls above aren't used.
  // TODO(crbug.com/40528912): disallow and rewrite socketcall()s if individual
  // syscalls like socket() are usable in the current environment.
  if (sysno == __NR_socketcall) {
    // The baseline policy allows other socketcall sub-calls.
    const Arg<int> socketcall(0);
    return Switch(socketcall)
        .Cases({SYS_CONNECT,
                SYS_SOCKET,
                SYS_SETSOCKOPT,
                SYS_GETSOCKOPT},
               Allow())
        .Default(BaselinePolicy::EvaluateSyscall(sysno));
  }
#endif

  if (IsBaselinePolicyAllowed(sysno)) {
    return Allow();
  }

  return BaselinePolicy::EvaluateSyscall(sysno);
}

}  // namespace sandbox