1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
|
// Copyright 2014 The Chromium Authors
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
#include "sandbox/linux/services/yama.h"
#include <errno.h>
#include <fcntl.h>
#include <stddef.h>
#include <sys/prctl.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <unistd.h>
#include "base/check.h"
#include "base/files/file_util.h"
#include "base/files/scoped_file.h"
#include "base/notreached.h"
#include "base/posix/eintr_wrapper.h"
#include "sandbox/linux/system_headers/linux_prctl.h"
namespace sandbox {
namespace {
// Enable or disable the Yama ptracers restrictions.
// Return false if Yama is not present on this kernel.
bool SetYamaPtracersRestriction(bool enable_restrictions) {
unsigned long set_ptracer_arg;
if (enable_restrictions) {
set_ptracer_arg = 0;
} else {
set_ptracer_arg = PR_SET_PTRACER_ANY;
}
const int ret = prctl(PR_SET_PTRACER, set_ptracer_arg);
const int prctl_errno = errno;
if (0 == ret) {
return true;
} else {
// ENOSYS or EINVAL means Yama is not in the current kernel.
CHECK(ENOSYS == prctl_errno || EINVAL == prctl_errno);
return false;
}
}
bool CanAccessProcFS() {
static const char kProcfsKernelSysPath[] = "/proc/sys/kernel/";
int ret = access(kProcfsKernelSysPath, F_OK);
if (ret) {
return false;
}
return true;
}
} // namespace
// static
bool Yama::RestrictPtracersToAncestors() {
return SetYamaPtracersRestriction(true /* enable_restrictions */);
}
// static
bool Yama::DisableYamaRestrictions() {
return SetYamaPtracersRestriction(false /* enable_restrictions */);
}
// static
int Yama::GetStatus() {
if (!CanAccessProcFS()) {
return 0;
}
static const char kPtraceScopePath[] = "/proc/sys/kernel/yama/ptrace_scope";
base::ScopedFD yama_scope(HANDLE_EINTR(open(kPtraceScopePath, O_RDONLY)));
if (!yama_scope.is_valid()) {
const int open_errno = errno;
DCHECK(ENOENT == open_errno);
// The status is known, yama is not present.
return STATUS_KNOWN;
}
char yama_scope_value = 0;
ssize_t num_read = HANDLE_EINTR(read(yama_scope.get(), &yama_scope_value, 1));
PCHECK(1 == num_read);
switch (yama_scope_value) {
case '0':
return STATUS_KNOWN | STATUS_PRESENT;
case '1':
return STATUS_KNOWN | STATUS_PRESENT | STATUS_ENFORCING;
case '2':
case '3':
return STATUS_KNOWN | STATUS_PRESENT | STATUS_ENFORCING |
STATUS_STRICT_ENFORCING;
default:
NOTREACHED();
}
}
// static
bool Yama::IsPresent() { return GetStatus() & STATUS_PRESENT; }
// static
bool Yama::IsEnforcing() { return GetStatus() & STATUS_ENFORCING; }
} // namespace sandbox
|
