mirror/guix
mirror/guix
1
Fork 0
mirror of https://https.git.savannah.gnu.org/git/guix.git/ synced 2025-07-09 07:20:40 +02:00
Code Releases Activity
guix/config-daemon.ac
Reepca Russelstein c659f977bb
daemon: add seccomp filter for slirp4netns. 
The container that slirp4netns runs in should already be quite difficult to do
anything malicious in beyond basic denial of service or sending of network
traffic.  There is, however, one hole remaining in the case in which there is
an adversary able to run code locally: abstract unix sockets.  Because these
are governed by network namespaces, not IPC namespaces, and slirp4netns is in
the root network namespace, any process in the root network namespace can
cooperate with the slirp4netns process to take over its user.

To close this, we use seccomp to block the creation of unix-domain sockets by
slirp4netns.  This requires some finesse, since slirp4netns absolutely needs
to be able to create other types of sockets - at minimum AF_INET and AF_INET6

Seccomp has many, many pitfalls.  To name a few:

1. Seccomp provides you with an "arch" field, but this does not uniquely
   determine the ABI being used; the actual meaning of a system call number
   depends on both the number (which is often the result of ORing a related
   system call with a flag for an alternate ABI) and the architecture.

2. Seccomp provides no direct way of knowing what the native value for the
   arch field should be; the user must do configure/compile-time testing for
   every architecture+ABI combination they want to support.  Amusingly enough,
   the linux-internal header files have this exact information
   (SECCOMP_ARCH_NATIVE), but they aren't sharing it.

3. The only system call numbers we naturally have are the native ones in
   asm/unistd.h.  __NR_socket will always refer to the system call number for
   the target system's ABI.

4. Seccomp can only manipulate 32-bit words, but represents every system call
   argument as a uint64.

5. New system call numbers with as-yet-unknown semantics can be added to the
   kernel at any time.

6. Based on this comment in arch/x86/entry/syscalls/syscall_32.tbl:

   # 251 is available for reuse (was briefly sys_set_zone_reclaim)

   previously-invalid system call numbers may later be reused for new system
   calls.

7. Most architecture+ABI combinations have system call tables with many gaps
   in them.  arm-eabi, for example, has 35 such gaps (note: this is just the
   number of distinct gaps, not the number of system call numbers contained in
   those gaps).

8. Seccomp's BPF filters require a fully-acyclic control flow graph.
   Any operation on a data structure must therefore first be fully
   unrolled before it can be run.

9. Seccomp cannot dereference pointers.  Only the raw bits provided to the
   system calls can be inspected.

10. Some architecture+ABI combos have multiplexer system calls.  For example,
    socketcall can perform any socket-related system call.  The arguments to
    the multiplexed system call are passed indirectly, via a pointer to user
    memory.  They therefore cannot be inspected by seccomp.

11. Some valid system calls are not listed in any table in the kernel source.
    For example, __ARM_NR_cacheflush is an "ARM private" system call.  It does
    not appear in any *.tbl file.

12. Conditional branches are limited to relative jumps of at most 256
    instructions forward.

13. Prior to Linux 4.8, any process able to spawn another process and call
    ptrace could bypass seccomp restrictions.

To address (1), (2), and (3), we include preprocessor checks to identify the
native architecture value, and reject all system calls that don't use the
native architecture.

To address (4), we use the AC_C_BIGENDIAN autoconf check to conditionally
define WORDS_BIGENDIAN, and match up the proper portions of any uint64 we test
for with the value in the accumulator being tested against.

To address (5) and (6), we use system call pinning.  That is, we hardcode a
snapshot of all the valid system call numbers at the time of writing, and
reject any system call numbers not in the recorded set.  A set is recorded for
every architecture+ABI combo, and the native one is chosen at compile-time.
This ensures that not only are non-native architectures rejected, but so are
non-native ABIs.  For the sake of conciseness, we represent these sets as sets
of disjoint ranges.  Due to (7), checking each range in turn could add a lot
of overhead to each system call, so we instead binary search through the
ranges.  Due to (8), this binary search has to be fully unrolled, so we do
that too.

It can be tedious and error-prone to manually produce the syscall ranges by
looking at linux's *.tbl files, since the gaps are often small and
uncommented.  To address this, a script, build-aux/extract-syscall-ranges.sh,
is added that will produce them given a *.tbl filename and an ABI regex (some
tables seem to abuse the ABI field with strange values like "memfd_secret").
Note that producing the final values still requires looking at the proper
asm/unistd.h file to find any private numbers and to identify any offsets and
ABI variants used.

(10) used to have no good solution, but in the past decade most architectures
have gained dedicated system call alternatives to at least socketcall, so we
can (hopefully) just block it entirely.

To address (13), we block ptrace also.

* build-aux/extract-syscall-ranges.sh: new script.
* Makefile.am (EXTRA_DIST): register it.
* config-daemon.ac: use AC_C_BIGENDIAN.
* nix/libutil/spawn.cc (setNoNewPrivsAction, addSeccompFilterAction): new
  functions.
* nix/libutil/spawn.hh (setNoNewPrivsAction, addSeccompFilterAction): new
  declarations.
  (SpawnContext)[setNoNewPrivs, addSeccompFilter]: new fields.
* nix/libutil/seccomp.hh: new header file.
* nix/libutil/seccomp.cc: new file.
* nix/local.mk (libutil_a_SOURCES, libutil_headers): register them.
* nix/libstore/build.cc (slirpSeccompFilter, writeSeccompFilterDot):
  new functions.
  (spawnSlirp4netns): use them, set seccomp filter for slirp4netns.

Change-Id: Ic92c7f564ab12596b87ed0801b22f88fbb543b95
Signed-off-by: John Kehayias <john.kehayias@protonmail.com>
2025-06-24 10:07:58 -04:00

165 lines
5.1 KiB
Text
Raw Permalink Blame History

dnl -*- Autoconf -*- fragment for the C++ daemon.
AC_MSG_CHECKING([whether to build daemon])
AC_MSG_RESULT([$guix_build_daemon])
dnl C++ environment. This macro must be used unconditionnaly.
AC_PROG_CXX
AM_PROG_AR
AC_LANG([C++])
if test "x$guix_build_daemon" = "xyes"; then
GUIX_ASSERT_CXX11
AC_PROG_RANLIB
AC_CONFIG_HEADERS([nix/config.h])
dnl Use 64-bit file system calls so that we can support files > 2 GiB.
AC_SYS_LARGEFILE
dnl Look for zlib, a required dependency.
AC_CHECK_LIB([z], [gzdopen], [true],
[AC_MSG_ERROR([Guix requires zlib. See http://www.zlib.net/.])])
AC_CHECK_HEADERS([zlib.h], [true],
[AC_MSG_ERROR([Guix requires zlib. See http://www.zlib.net/.])])
dnl Look for libbz2, an optional dependency.
AC_CHECK_LIB([bz2], [BZ2_bzWriteOpen], [HAVE_LIBBZ2=yes], [HAVE_LIBBZ2=no])
if test "x$HAVE_LIBBZ2" = xyes; then
AC_CHECK_HEADERS([bzlib.h])
HAVE_LIBBZ2="$ac_cv_header_bzlib_h"
fi
dnl Look for SQLite, a required dependency.
PKG_CHECK_MODULES([SQLITE3], [sqlite3 >= 3.6.19])
AC_DEFINE_UNQUOTED([SYSTEM], ["$guix_system"],
[Guix host system type--i.e., platform and OS kernel tuple.])
case "$LIBGCRYPT_PREFIX" in
no)
LIBGCRYPT_CPPFLAGS=""
;;
*)
LIBGCRYPT_CPPFLAGS="-I$LIBGCRYPT_PREFIX/include"
;;
esac
case "$LIBGCRYPT_LIBDIR" in
no | "")
;;
*)
LIBGCRYPT_LDFLAGS="-L$LIBGCRYPT_LIBDIR"
;;
esac
LIBGCRYPT_LIBS="-lgcrypt"
AC_SUBST([LIBGCRYPT_CPPFLAGS])
AC_SUBST([LIBGCRYPT_LDFLAGS])
AC_SUBST([LIBGCRYPT_LIBS])
save_CPPFLAGS="$CPPFLAGS"
save_LDFLAGS="$LDFLAGS"
save_LIBS="$LIBS"
CPPFLAGS="$CPPFLAGS $LIBGCRYPT_CPPFLAGS"
LDFLAGS="$LDFLAGS $LIBGCRYPT_LDFLAGS"
LIBS="$LIBS $LIBGCRYPT_LIBS"
have_gcrypt=yes
AC_CHECK_LIB([gcrypt], [gcry_md_open], [:], [have_gcrypt=no])
AC_CHECK_HEADER([gcrypt.h], [:], [have_gcrypt=no])
if test "x$have_gcrypt" != "xyes"; then
AC_MSG_ERROR([GNU libgcrypt not found; please install it.])
fi
CPPFLAGS="$save_CPPFLAGS"
LDFLAGS="$save_LDFLAGS"
LIBS="$save_LIBS"
dnl Chroot support.
AC_CHECK_FUNCS([chroot unshare])
AC_CHECK_HEADERS([sched.h sys/param.h sys/mount.h sys/syscall.h \
linux/close_range.h sys/prctl.h])
if test "x$ac_cv_func_chroot" != "xyes"; then
AC_MSG_ERROR(['chroot' function missing, bailing out])
fi
dnl lutimes and lchown: used when canonicalizing store items.
dnl posix_fallocate: used when extracting archives.
dnl vfork: to speed up spawning of helper programs.
dnl `--> now disabled because of unpredictable behavior:
dnl see <http://lists.gnu.org/archive/html/guix-devel/2014-05/msg00036.html>
dnl and Nix commit f794465c (Nov. 2012).
dnl sched_setaffinity: to improve RPC locality.
dnl statvfs: to detect disk-full conditions.
dnl strsignal: for error reporting.
dnl statx: fine-grain 'stat' call, new in glibc 2.28.
AC_CHECK_FUNCS([lutimes lchown posix_fallocate sched_setaffinity \
statvfs nanosleep strsignal statx close_range])
dnl Check for <locale>.
AC_LANG_PUSH(C++)
AC_CHECK_HEADERS([locale])
AC_LANG_POP(C++)
dnl Check whether we have the `personality' syscall, which allows us
dnl to do i686-linux builds on x86_64-linux machines.
AC_CHECK_HEADERS([sys/personality.h])
dnl Determine the appropriate default list of substitute URLs (GnuTLS
dnl is required so we can default to 'https'.)
GUIX_SUBSTITUTE_URLS="https://bordeaux.guix.gnu.org https://ci.guix.gnu.org"
AC_MSG_CHECKING([for default substitute URLs])
AC_MSG_RESULT([$GUIX_SUBSTITUTE_URLS])
AC_SUBST([GUIX_SUBSTITUTE_URLS])
AC_DEFINE_UNQUOTED([GUIX_SUBSTITUTE_URLS], ["$GUIX_SUBSTITUTE_URLS"],
[Default list of substitute URLs used by 'guix-daemon'.])
dnl Check for Guile-SSH, which is required by 'guix offload'.
GUIX_CHECK_GUILE_SSH
case "x$guix_cv_have_recent_guile_ssh" in
xyes)
guix_build_daemon_offload="yes"
AC_DEFINE([HAVE_DAEMON_OFFLOAD_HOOK], [1],
[Define if the daemon's 'offload' build hook is being built (requires Guile-SSH).])
;;
*)
guix_build_daemon_offload="no"
;;
esac
dnl Temporary directory used to store the daemon's data.
GUIX_TEST_ROOT_DIRECTORY
GUIX_TEST_ROOT="$ac_cv_guix_test_root"
AC_SUBST([GUIX_TEST_ROOT])
GUIX_CHECK_LOCALSTATEDIR
case "x$host_os" in
x*linux*)
AC_CHECK_PROG([have_slirp4netns], [slirp4netns], [yes])
if test "x$have_slirp4netns" != "xyes"
then
AC_MSG_WARN([Slirp4netns not found; fixed-output chroot builds won't work without it.])
fi
;;
esac
AC_PATH_PROG([SLIRP4NETNS], [slirp4netns], [slirp4netns])
AC_DEFINE_UNQUOTED([SLIRP4NETNS], ["$SLIRP4NETNS"],
[Path to the slirp4netns program, if any.])
dnl needed for inspecting 64-bit system call arguments in seccomp's Berkeley
dnl Packet Filter VM, which only directly operates on 32-bit words.
AC_C_BIGENDIAN
fi
AM_CONDITIONAL([HAVE_LIBBZ2], [test "x$HAVE_LIBBZ2" = "xyes"])
AM_CONDITIONAL([BUILD_DAEMON], [test "x$guix_build_daemon" = "xyes"])
AM_CONDITIONAL([BUILD_DAEMON_OFFLOAD], \
[test "x$guix_build_daemon" = "xyes" \
&& test "x$guix_build_daemon_offload" = "xyes"])
View git blame Copy permalink