[v2,4/4] samples: Add example of using PTRACE_GETFD in conjunction with user trap

Message ID	20191209070646.GA32477@ircssh-2.c.rugged-nimbus-611.internal (mailing list archive)
State	New, archived
Headers	show Return-Path: <SRS0=vczE=Z7=vger.kernel.org=linux-fsdevel-owner@kernel.org> Date: Mon, 9 Dec 2019 07:06:49 +0000 From: Sargun Dhillon <sargun@sargun.me> To: linux-kernel@vger.kernel.org, containers@lists.linux-foundation.org, linux-api@vger.kernel.org, linux-fsdevel@vger.kernel.org Cc: tycho@tycho.ws, jannh@google.com, cyphar@cyphar.com, christian.brauner@ubuntu.com, oleg@redhat.com, luto@amacapital.net, viro@zeniv.linux.org.uk Subject: [PATCH v2 4/4] samples: Add example of using PTRACE_GETFD in conjunction with user trap Message-ID: <20191209070646.GA32477@ircssh-2.c.rugged-nimbus-611.internal> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.5.24 (2015-08-30) Sender: linux-fsdevel-owner@vger.kernel.org Precedence: bulk
Series	Add ptrace get_fd request \| expand [v2,0/4] Add ptrace get_fd request [v2,1/4] vfs, fdtable: Add get_task_file helper [v2,2/4] ptrace: add PTRACE_GETFD request to fetch file descriptors from tracees [v2,3/4] samples: split generalized user-trap code into helper file [v2,4/4] samples: Add example of using PTRACE_GETFD in conjunction with user trap

diff --git a/samples/seccomp/.gitignore b/samples/seccomp/.gitignore index d1e2e817d556..169bc130ec39 100644 --- a/samples/seccomp/.gitignore +++ b/samples/seccomp/.gitignore @@ -2,3 +2,4 @@ bpf-direct bpf-fancy dropper user-trap +user-trap-ptrace diff --git a/samples/seccomp/Makefile b/samples/seccomp/Makefile index 82b7347318d1..c0f3ef713f5b 100644 --- a/samples/seccomp/Makefile +++ b/samples/seccomp/Makefile @@ -1,6 +1,6 @@ # SPDX-License-Identifier: GPL-2.0 ifndef CROSS_COMPILE -hostprogs-y := bpf-fancy dropper bpf-direct user-trap +hostprogs-y := bpf-fancy dropper bpf-direct user-trap user-trap-ptrace HOSTCFLAGS_bpf-fancy.o += -I$(objtree)/usr/include HOSTCFLAGS_bpf-fancy.o += -idirafter $(objtree)/include @@ -24,6 +24,11 @@ HOSTCFLAGS_user-trap.o += -I$(objtree)/usr/include HOSTCFLAGS_user-trap.o += -idirafter $(objtree)/include user-trap-objs := user-trap.o user-trap-helper.o +HOSTCFLAGS_user-trap-ptrace.o += -I$(objtree)/usr/include +HOSTCFLAGS_user-trap-ptrace.o += -idirafter $(objtree)/include +user-trap-ptrace-objs := user-trap-ptrace.o user-trap-helper.o + + # Try to match the kernel target. ifndef CONFIG_64BIT @@ -39,10 +44,12 @@ HOSTCFLAGS_dropper.o += $(MFLAG) HOSTCFLAGS_bpf-helper.o += $(MFLAG) HOSTCFLAGS_bpf-fancy.o += $(MFLAG) HOSTCFLAGS_user-trap.o += $(MFLAG) +HOSTCFLAGS_user-trap-ptrace.o += $(MFLAG) HOSTLDLIBS_bpf-direct += $(MFLAG) HOSTLDLIBS_bpf-fancy += $(MFLAG) HOSTLDLIBS_dropper += $(MFLAG) HOSTLDLIBS_user-trap += $(MFLAG) +HOSTLDLIBS_user-trap-ptrace += $(MFLAG) endif always := $(hostprogs-y) endif diff --git a/samples/seccomp/user-trap-ptrace.c b/samples/seccomp/user-trap-ptrace.c new file mode 100644 index 000000000000..5cca1cb4916c --- /dev/null +++ b/samples/seccomp/user-trap-ptrace.c @@ -0,0 +1,193 @@ +// SPDX-License-Identifier: GPL-2.0 +#include <linux/seccomp.h> +#include <linux/ptrace.h> +#include <linux/prctl.h> +#include <sys/socket.h> +#include <sys/prctl.h> +#include <sys/types.h> +#include <sys/wait.h> +#include <sys/ioctl.h> +#include <assert.h> +#include <errno.h> +#include <stdio.h> +#include <string.h> +#include <stdlib.h> +#include <netinet/in.h> +#include "user-trap-helper.h" + +#define CHILD_PORT_TRY_BIND 80 +#define CHILD_PORT_ACTUAL_BIND 4998 + +static int ptrace(long request, long pid, void *addr, unsigned long data) +{ + errno = 0; + return syscall(__NR_ptrace, request, pid, addr, data); +} + +static int ptrace_getfd(long pid, struct ptrace_getfd_args *args) +{ + errno = 0; + return syscall(__NR_ptrace, PTRACE_GETFD, pid, sizeof(*args), args); +} + +static int tracee(void) +{ + struct sockaddr_in addr = { + .sin_family = AF_INET, + .sin_port = htons(CHILD_PORT_TRY_BIND), + .sin_addr = { + .s_addr = htonl(INADDR_ANY) + } + }; + socklen_t addrlen = sizeof(addr); + int sock, ret = 1; + + sock = socket(AF_INET, SOCK_STREAM, 0); + if (sock == -1) { + perror("socket"); + goto out; + } + + + if (bind(sock, (struct sockaddr *) &addr, sizeof(addr))) { + perror("bind"); + goto out; + } + + printf("Child successfully performed bind operation\n"); + if (getsockname(sock, (struct sockaddr *) &addr, &addrlen)) { + perror("getsockname"); + goto out; + } + + + printf("Socket bound to port %d\n", ntohs(addr.sin_port)); + assert(ntohs(addr.sin_port) == CHILD_PORT_ACTUAL_BIND); + + ret = 0; +out: + return ret; +} + +static int handle_req(int listener) +{ + struct sockaddr_in addr = { + .sin_family = AF_INET, + .sin_port = htons(4998), + .sin_addr = { + .s_addr = htonl(INADDR_LOOPBACK) + } + }; + struct ptrace_getfd_args getfd_args = { + .options = PTRACE_GETFD_O_CLOEXEC + }; + struct seccomp_notif_sizes sizes; + struct seccomp_notif_resp *resp; + struct seccomp_notif *req; + int fd, ret = 1; + + if (seccomp(SECCOMP_GET_NOTIF_SIZES, 0, &sizes) < 0) { + perror("seccomp(GET_NOTIF_SIZES)"); + goto out; + } + req = malloc(sizes.seccomp_notif); + if (!req) + goto out; + memset(req, 0, sizeof(*req)); + + resp = malloc(sizes.seccomp_notif_resp); + if (!resp) + goto out_free_req; + memset(resp, 0, sizeof(*resp)); + + if (ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, req)) { + perror("ioctl recv"); + goto out; + } + printf("Child tried to call bind with fd: %lld\n", req->data.args[0]); + getfd_args.fd = req->data.args[0]; + fd = ptrace_getfd(req->pid, &getfd_args); + if (fd == -1) { + perror("ptrace_getfd"); + goto out_free_resp; + } + if (bind(fd, (struct sockaddr *) &addr, sizeof(addr))) { + perror("bind"); + goto out_free_resp; + } + + resp->id = req->id; + resp->error = 0; + resp->val = 0; + if (ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, resp) < 0) { + perror("ioctl send"); + goto out_free_resp; + } + + ret = 0; +out_free_resp: + free(resp); +out_free_req: + free(req); +out: + return ret; +} + +int main(void) +{ + int listener, sk_pair[2], ret = 1; + pid_t pid; + + if (socketpair(PF_LOCAL, SOCK_SEQPACKET, 0, sk_pair) < 0) { + perror("socketpair"); + goto out; + } + + pid = fork(); + if (pid < 0) { + perror("fork"); + goto close_pair; + } + if (pid == 0) { + if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) { + perror("prctl(NO_NEW_PRIVS)"); + exit(1); + } + listener = user_trap_syscall(__NR_bind, + SECCOMP_FILTER_FLAG_NEW_LISTENER); + if (listener < 0) { + perror("seccomp"); + exit(1); + } + if (send_fd(sk_pair[1], listener) < 0) + exit(1); + close(listener); + exit(tracee()); + } + + if (ptrace(PTRACE_SEIZE, pid, 0, PTRACE_O_EXITKILL)) { + perror("ptrace(PTRACE_SEIZE)"); + goto kill_child; + } + + listener = recv_fd(sk_pair[0]); + if (listener < 0) + goto kill_child; + + if (handle_req(listener)) + goto kill_child; + + /* Wait for child to finish */ + waitpid(pid, NULL, 0); + + ret = 0; + goto close_pair; + +kill_child: + kill(pid, SIGKILL); +close_pair: + close(sk_pair[0]); + close(sk_pair[1]); +out: + return ret; +}

[v2,4/4] samples: Add example of using PTRACE_GETFD in conjunction with user trap

Commit Message

Comments

Patch