diff options
Diffstat (limited to 'lib/supple')
| -rw-r--r-- | lib/supple/capi.c | 88 | ||||
| -rw-r--r-- | lib/supple/sandbox.lua | 128 |
2 files changed, 216 insertions, 0 deletions
diff --git a/lib/supple/capi.c b/lib/supple/capi.c index c413c20..c0f8f48 100644 --- a/lib/supple/capi.c +++ b/lib/supple/capi.c @@ -13,7 +13,12 @@ #include <lua.h> #include <lauxlib.h> +#include <sys/types.h> #include <string.h> +#include <stdbool.h> +#include <unistd.h> +#include <stdlib.h> +#include <errno.h> /* The API exposed, increment on backward-compatible changes */ #define CAPI_API 1 @@ -157,12 +162,95 @@ supple_capi_rawtype(lua_State *L) return 1; } +/* Lockdown function, takes nothing, returns a string token and errno which + * explains the result. We're using SUPPLE_MKDTEMP as a template for + * mkdtemp(). The wrapper ensures it is unset unless testing. + */ +#define TEMPDIR_NAME ((getenv("SUPPLE_MKDTEMP") != NULL) ? \ + (getenv("SUPPLE_MKDTEMP")) : ("/var/tmp/suppleXXXXXX")) +static int +supple_capi_lockdown(lua_State *L) +{ + bool rootly = (geteuid() == 0); + char *tempdir; + lua_settop(L, 0); /* Discard any arguments */ + + /* Prepare a copy of the tempdir template ready */ + tempdir = lua_newuserdata(L, strlen(TEMPDIR_NAME)); + strcpy(tempdir, TEMPDIR_NAME); + /* And make a temp directory to use */ + if (mkdtemp(tempdir) != tempdir) { + /* Failed to make the temp dir, give up */ + int saved_errno = errno; + lua_pushliteral(L, "mkdir"); + lua_pushnumber(L, saved_errno); + return 2; + } + + /* Temporary directory made, if we're rootly, chown it */ + if (rootly) { + if (chown(tempdir, 0, 0) != 0) { + int saved_errno = errno; + rmdir(tempdir); + lua_pushliteral(L, "chown"); + lua_pushnumber(L, saved_errno); + return 2; + } + } + + /* Change into that directory */ + if (chdir(tempdir) != 0) { + int saved_errno = errno; + rmdir(tempdir); + lua_pushliteral(L, "chdir"); + lua_pushnumber(L, saved_errno); + return 2; + } + + /* Remove the directory */ + if (rmdir(tempdir) != 0) { + int saved_errno = errno; + lua_pushliteral(L, "rmdir"); + lua_pushnumber(L, saved_errno); + return 2; + } + + /* chroot() to the ephemeral dir */ + if (rootly && (chroot(".") != 0)) { + int saved_errno = errno; + lua_pushliteral(L, "chroot"); + lua_pushnumber(L, saved_errno); + return 2; + } + + /* Ensure our PWD is "/" */ + if (rootly && chdir("/") != 0) { + int saved_errno = errno; + lua_pushliteral(L, "chdir"); + lua_pushnumber(L, saved_errno); + return 2; + } + + /* Drop privs */ + if (rootly && setuid(getuid()) != 0) { + int saved_errno = errno; + lua_pushliteral(L, "setuid"); + lua_pushnumber(L, saved_errno); + return 2; + } + + lua_pushstring(L, (rootly ? "ok" : "oknonroot")); + lua_pushnumber(L, 0); + return 2; +} + static const struct luaL_Reg supple_capi_functions[] = { { "explain", supple_capi_explain }, { "new_proxy", supple_capi_new_proxy }, { "type", supple_capi_type }, { "rawtype", supple_capi_rawtype }, + { "lockdown", supple_capi_lockdown }, { NULL, NULL } }; diff --git a/lib/supple/sandbox.lua b/lib/supple/sandbox.lua new file mode 100644 index 0000000..6b2d3ab --- /dev/null +++ b/lib/supple/sandbox.lua @@ -0,0 +1,128 @@ +-- lib/supple/sandbox.lua +-- +-- Sandbox (for) Untrusted Procedure Partitioning (in) Lua Engine +-- +-- Code which runs the core sandbox functionality of supple. +-- +-- This module runs in the sandbox interpreter which means some of the code +-- runs with root access. As such, we minimise what can be done before +-- we drop privileges. +-- +-- The wrapper used to run us already ensured that LUA_PATH etc are +-- not set, so we don't have to worry about non-system-installed modules +-- getting in our way. Once the supple libraries are loaded (which will +-- include loading luxio etc) we're good to go and can ask the supple.capi +-- module to lock us down. +-- +-- Copyright 2012 Daniel Silverstone <dsilvers@digital-scurf.org> +-- +-- For licence terms, see COPYING +-- + +local capi = require 'supple.capi' +local luxio = require 'luxio' +local sio = require 'luxio.simple' + +local load = load +local setfenv = setfenv +local type = type + +-- Run fn with globs as its globals. Returns a function to run which +-- returns the return values of fn, and also wrap returns the table +-- which will be filled with any new globals fn creates. +-- +-- If fn is a string then it is used as the source of the function, if it +-- is a function then it is expected to be a closure which when called +-- repeatedly returns more data loaded (perhaps from a file?). src is +-- expected to be the name associated with this source code. +-- +-- In case of error, returns nil, errmsg +local function _wrap(fn, src, globs) + local fn_glob = setmetatable({}, { __index = globs, __metatable=true }) + local fn_ret, msg + + assert(fn, "No function/source provided?") + assert(src, "No source name provided?") + globs = globs or {} + + if setfenv then + -- Lua 5.1 style load... + fn_ret, msg = ((type(fn) == "string") and loadstring or load)(fn, src) + if not fn_ret then + return nil, msg + end + setfenv(fn_ret, fn_glob) + else + -- Lua 5.2 style load... + fn_ret, msg = load(fn, src, "t", fn_glob) + if not fn_ret then + return nil, msg + end + end + + assert(fn_ret, "Unusual, missing fn_ret now?") + + return fn_ret, fn_glob +end + +local function sandboxed_go() + -- Remove ourselves from the globals table so we cannot + -- be reentered + go = nil; + +-- return io.receive() + return 0 +end + +local function run() + -- Run the sandbox + local result, errno = capi.lockdown() + + if result ~= "ok" +-- START_TEST_ONLY + and result ~= "oknonroot" +-- END_TEST_ONLY + then + -- Failure to sandbox, so abort + print(result, luxio.strerror(errno)) + return errno + end + +-- START_TEST_ONLY + if result ~= "oknonroot" then +-- END_TEST_ONLY + -- Check that we're definitely solidly jailed + fh, errno = sio.open("testfile", "rw") + if fh then + fh:close() + luxio.unlink("testfile") + return 1 + end +-- START_TEST_ONLY + end +-- END_TEST_ONLY + + -- Prepare a severely limited sandbox + local sandbox_globals = {} + + for _, k in ipairs({ "table", "string", "pairs", "ipairs", "pcall", + "xpcall", "unpack", "tostring", "tonumber", "math", + "type", "coroutine", "select", "error", "assert" }) do + sandbox_globals[k] = _G[k] + end + -- Complete its "globals" + sandbox_globals._G = sandbox_globals + -- And add in the magic function we need + sandbox_globals.go = sandboxed_go + + local fn, globs = _wrap("return go()", "sandbox", sandbox_globals) + if not fn then + return 1 + end + + return fn() +end + +return { + run = run, +} |