Add OpenBSD/pledge/unveil
This commit is contained in:
parent
9e67dcebd6
commit
7174643ec4
80
openbsd-pledge-unveil/coreutils-true.c
Normal file
80
openbsd-pledge-unveil/coreutils-true.c
Normal file
@ -0,0 +1,80 @@
|
||||
/* Exit with a status code indicating success.
|
||||
Copyright (C) 1999-2025 Free Software Foundation, Inc.
|
||||
|
||||
This program is free software: you can redistribute it and/or modify
|
||||
it under the terms of the GNU General Public License as published by
|
||||
the Free Software Foundation, either version 3 of the License, or
|
||||
(at your option) any later version.
|
||||
|
||||
This program is distributed in the hope that it will be useful,
|
||||
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
GNU General Public License for more details.
|
||||
|
||||
You should have received a copy of the GNU General Public License
|
||||
along with this program. If not, see <https://www.gnu.org/licenses/>. */
|
||||
|
||||
#include <config.h>
|
||||
#include <stdio.h>
|
||||
#include <sys/types.h>
|
||||
#include "system.h"
|
||||
|
||||
/* Act like "true" by default; false.c overrides this. */
|
||||
#ifndef EXIT_STATUS
|
||||
# define EXIT_STATUS EXIT_SUCCESS
|
||||
#endif
|
||||
|
||||
#if EXIT_STATUS == EXIT_SUCCESS
|
||||
# define PROGRAM_NAME "true"
|
||||
#else
|
||||
# define PROGRAM_NAME "false"
|
||||
#endif
|
||||
|
||||
#define AUTHORS proper_name ("Jim Meyering")
|
||||
|
||||
void
|
||||
usage (int status)
|
||||
{
|
||||
printf (_("\
|
||||
Usage: %s [ignored command line arguments]\n\
|
||||
or: %s OPTION\n\
|
||||
"),
|
||||
program_name, program_name);
|
||||
printf ("%s\n\n",
|
||||
_(EXIT_STATUS == EXIT_SUCCESS
|
||||
? N_("Exit with a status code indicating success.")
|
||||
: N_("Exit with a status code indicating failure.")));
|
||||
fputs (HELP_OPTION_DESCRIPTION, stdout);
|
||||
fputs (VERSION_OPTION_DESCRIPTION, stdout);
|
||||
printf (USAGE_BUILTIN_WARNING, PROGRAM_NAME);
|
||||
emit_ancillary_info (PROGRAM_NAME);
|
||||
exit (status);
|
||||
}
|
||||
|
||||
int
|
||||
main (int argc, char **argv)
|
||||
{
|
||||
/* Recognize --help or --version only if it's the only command-line
|
||||
argument. */
|
||||
if (argc == 2)
|
||||
{
|
||||
initialize_main (&argc, &argv);
|
||||
set_program_name (argv[0]);
|
||||
setlocale (LC_ALL, "");
|
||||
bindtextdomain (PACKAGE, LOCALEDIR);
|
||||
textdomain (PACKAGE);
|
||||
|
||||
/* Note true(1) will return EXIT_FAILURE in the
|
||||
edge case where writes fail with GNU specific options. */
|
||||
atexit (close_stdout);
|
||||
|
||||
if (STREQ (argv[1], "--help"))
|
||||
usage (EXIT_STATUS);
|
||||
|
||||
if (STREQ (argv[1], "--version"))
|
||||
version_etc (stdout, PROGRAM_NAME, PACKAGE_NAME, Version, AUTHORS,
|
||||
(char *) nullptr);
|
||||
}
|
||||
|
||||
return EXIT_STATUS;
|
||||
}
|
||||
498
openbsd-pledge-unveil/doas.c
Normal file
498
openbsd-pledge-unveil/doas.c
Normal file
@ -0,0 +1,498 @@
|
||||
/* $OpenBSD: doas.c,v 1.99 2024/02/15 18:57:58 tedu Exp $ */
|
||||
/*
|
||||
* Copyright (c) 2015 Ted Unangst <tedu@openbsd.org>
|
||||
*
|
||||
* Permission to use, copy, modify, and distribute this software for any
|
||||
* purpose with or without fee is hereby granted, provided that the above
|
||||
* copyright notice and this permission notice appear in all copies.
|
||||
*
|
||||
* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
|
||||
* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
|
||||
* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
|
||||
* ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
|
||||
* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
|
||||
* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
|
||||
* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
|
||||
*/
|
||||
|
||||
#include <sys/types.h>
|
||||
#include <sys/stat.h>
|
||||
#include <sys/ioctl.h>
|
||||
|
||||
#include <limits.h>
|
||||
#include <login_cap.h>
|
||||
#include <bsd_auth.h>
|
||||
#include <readpassphrase.h>
|
||||
#include <string.h>
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <err.h>
|
||||
#include <unistd.h>
|
||||
#include <pwd.h>
|
||||
#include <grp.h>
|
||||
#include <syslog.h>
|
||||
#include <errno.h>
|
||||
#include <fcntl.h>
|
||||
|
||||
#include "doas.h"
|
||||
|
||||
static void __dead
|
||||
usage(void)
|
||||
{
|
||||
fprintf(stderr, "usage: doas [-Lns] [-a style] [-C config] [-u user]"
|
||||
" command [arg ...]\n");
|
||||
exit(1);
|
||||
}
|
||||
|
||||
static int
|
||||
parseuid(const char *s, uid_t *uid)
|
||||
{
|
||||
struct passwd *pw;
|
||||
const char *errstr;
|
||||
|
||||
if ((pw = getpwnam(s)) != NULL) {
|
||||
*uid = pw->pw_uid;
|
||||
if (*uid == UID_MAX)
|
||||
return -1;
|
||||
return 0;
|
||||
}
|
||||
*uid = strtonum(s, 0, UID_MAX - 1, &errstr);
|
||||
if (errstr)
|
||||
return -1;
|
||||
return 0;
|
||||
}
|
||||
|
||||
static int
|
||||
uidcheck(const char *s, uid_t desired)
|
||||
{
|
||||
uid_t uid;
|
||||
|
||||
if (parseuid(s, &uid) != 0)
|
||||
return -1;
|
||||
if (uid != desired)
|
||||
return -1;
|
||||
return 0;
|
||||
}
|
||||
|
||||
static int
|
||||
parsegid(const char *s, gid_t *gid)
|
||||
{
|
||||
struct group *gr;
|
||||
const char *errstr;
|
||||
|
||||
if ((gr = getgrnam(s)) != NULL) {
|
||||
*gid = gr->gr_gid;
|
||||
if (*gid == GID_MAX)
|
||||
return -1;
|
||||
return 0;
|
||||
}
|
||||
*gid = strtonum(s, 0, GID_MAX - 1, &errstr);
|
||||
if (errstr)
|
||||
return -1;
|
||||
return 0;
|
||||
}
|
||||
|
||||
static int
|
||||
match(uid_t uid, gid_t *groups, int ngroups, uid_t target, const char *cmd,
|
||||
const char **cmdargs, struct rule *r)
|
||||
{
|
||||
int i;
|
||||
|
||||
if (r->ident[0] == ':') {
|
||||
gid_t rgid;
|
||||
if (parsegid(r->ident + 1, &rgid) == -1)
|
||||
return 0;
|
||||
for (i = 0; i < ngroups; i++) {
|
||||
if (rgid == groups[i])
|
||||
break;
|
||||
}
|
||||
if (i == ngroups)
|
||||
return 0;
|
||||
} else {
|
||||
if (uidcheck(r->ident, uid) != 0)
|
||||
return 0;
|
||||
}
|
||||
if (r->target && uidcheck(r->target, target) != 0)
|
||||
return 0;
|
||||
if (r->cmd) {
|
||||
if (strcmp(r->cmd, cmd))
|
||||
return 0;
|
||||
if (r->cmdargs) {
|
||||
/* if arguments were given, they should match explicitly */
|
||||
for (i = 0; r->cmdargs[i]; i++) {
|
||||
if (!cmdargs[i])
|
||||
return 0;
|
||||
if (strcmp(r->cmdargs[i], cmdargs[i]))
|
||||
return 0;
|
||||
}
|
||||
if (cmdargs[i])
|
||||
return 0;
|
||||
}
|
||||
}
|
||||
return 1;
|
||||
}
|
||||
|
||||
static int
|
||||
permit(uid_t uid, gid_t *groups, int ngroups, const struct rule **lastr,
|
||||
uid_t target, const char *cmd, const char **cmdargs)
|
||||
{
|
||||
size_t i;
|
||||
|
||||
*lastr = NULL;
|
||||
for (i = 0; i < nrules; i++) {
|
||||
if (match(uid, groups, ngroups, target, cmd,
|
||||
cmdargs, rules[i]))
|
||||
*lastr = rules[i];
|
||||
}
|
||||
if (!*lastr)
|
||||
return -1;
|
||||
if ((*lastr)->action == PERMIT)
|
||||
return 0;
|
||||
return -1;
|
||||
}
|
||||
|
||||
static void
|
||||
parseconfig(const char *filename, int checkperms)
|
||||
{
|
||||
extern FILE *yyfp;
|
||||
extern int yyparse(void);
|
||||
struct stat sb;
|
||||
|
||||
yyfp = fopen(filename, "r");
|
||||
if (!yyfp)
|
||||
err(1, checkperms ? "doas is not enabled, %s" :
|
||||
"could not open config file %s", filename);
|
||||
|
||||
if (checkperms) {
|
||||
if (fstat(fileno(yyfp), &sb) != 0)
|
||||
err(1, "fstat(\"%s\")", filename);
|
||||
if ((sb.st_mode & (S_IWGRP|S_IWOTH)) != 0)
|
||||
errx(1, "%s is writable by group or other", filename);
|
||||
if (sb.st_uid != 0)
|
||||
errx(1, "%s is not owned by root", filename);
|
||||
}
|
||||
|
||||
yyparse();
|
||||
fclose(yyfp);
|
||||
if (parse_error)
|
||||
exit(1);
|
||||
}
|
||||
|
||||
static void __dead
|
||||
checkconfig(const char *confpath, int argc, char **argv,
|
||||
uid_t uid, gid_t *groups, int ngroups, uid_t target)
|
||||
{
|
||||
const struct rule *rule;
|
||||
int rv;
|
||||
|
||||
setresuid(uid, uid, uid);
|
||||
if (pledge("stdio rpath getpw", NULL) == -1)
|
||||
err(1, "pledge");
|
||||
parseconfig(confpath, 0);
|
||||
if (!argc)
|
||||
exit(0);
|
||||
rv = permit(uid, groups, ngroups, &rule, target, argv[0],
|
||||
(const char **)argv + 1);
|
||||
if (rv == 0) {
|
||||
printf("permit%s\n", (rule->options & NOPASS) ? " nopass" : "");
|
||||
exit(0);
|
||||
} else {
|
||||
printf("deny\n");
|
||||
exit(1);
|
||||
}
|
||||
}
|
||||
|
||||
static int
|
||||
authuser_checkpass(char *myname, char *login_style)
|
||||
{
|
||||
char *challenge = NULL, *response, rbuf[1024], cbuf[128];
|
||||
auth_session_t *as;
|
||||
|
||||
if (!(as = auth_userchallenge(myname, login_style, "auth-doas",
|
||||
&challenge))) {
|
||||
warnx("Authentication failed");
|
||||
return AUTH_FAILED;
|
||||
}
|
||||
if (!challenge) {
|
||||
char host[HOST_NAME_MAX + 1];
|
||||
|
||||
if (gethostname(host, sizeof(host)))
|
||||
snprintf(host, sizeof(host), "?");
|
||||
snprintf(cbuf, sizeof(cbuf),
|
||||
"\rdoas (%.32s@%.32s) password: ", myname, host);
|
||||
challenge = cbuf;
|
||||
}
|
||||
response = readpassphrase(challenge, rbuf, sizeof(rbuf),
|
||||
RPP_REQUIRE_TTY);
|
||||
if (response == NULL && errno == ENOTTY) {
|
||||
syslog(LOG_AUTHPRIV | LOG_NOTICE,
|
||||
"tty required for %s", myname);
|
||||
errx(1, "a tty is required");
|
||||
}
|
||||
if (!auth_userresponse(as, response, 0)) {
|
||||
explicit_bzero(rbuf, sizeof(rbuf));
|
||||
syslog(LOG_AUTHPRIV | LOG_NOTICE,
|
||||
"failed auth for %s", myname);
|
||||
warnx("Authentication failed");
|
||||
return AUTH_FAILED;
|
||||
}
|
||||
explicit_bzero(rbuf, sizeof(rbuf));
|
||||
return AUTH_OK;
|
||||
}
|
||||
|
||||
static void
|
||||
authuser(char *myname, char *login_style, int persist)
|
||||
{
|
||||
int i, fd = -1;
|
||||
|
||||
if (persist)
|
||||
fd = open("/dev/tty", O_RDWR);
|
||||
if (fd != -1) {
|
||||
if (ioctl(fd, TIOCCHKVERAUTH) == 0)
|
||||
goto good;
|
||||
}
|
||||
for (i = 0; i < AUTH_RETRIES; i++) {
|
||||
if (authuser_checkpass(myname, login_style) == AUTH_OK)
|
||||
goto good;
|
||||
}
|
||||
exit(1);
|
||||
good:
|
||||
if (fd != -1) {
|
||||
int secs = 5 * 60;
|
||||
ioctl(fd, TIOCSETVERAUTH, &secs);
|
||||
close(fd);
|
||||
}
|
||||
}
|
||||
|
||||
int
|
||||
unveilcommands(const char *ipath, const char *cmd)
|
||||
{
|
||||
char *path = NULL, *p;
|
||||
int unveils = 0;
|
||||
|
||||
if (strchr(cmd, '/') != NULL) {
|
||||
if (unveil(cmd, "x") != -1)
|
||||
unveils++;
|
||||
goto done;
|
||||
}
|
||||
|
||||
if (!ipath) {
|
||||
errno = ENOENT;
|
||||
goto done;
|
||||
}
|
||||
path = strdup(ipath);
|
||||
if (!path) {
|
||||
errno = ENOENT;
|
||||
goto done;
|
||||
}
|
||||
for (p = path; p && *p; ) {
|
||||
char buf[PATH_MAX];
|
||||
char *cp = strsep(&p, ":");
|
||||
|
||||
if (cp) {
|
||||
int r = snprintf(buf, sizeof buf, "%s/%s", cp, cmd);
|
||||
if (r >= 0 && r < sizeof buf) {
|
||||
if (unveil(buf, "x") != -1)
|
||||
unveils++;
|
||||
}
|
||||
}
|
||||
}
|
||||
done:
|
||||
free(path);
|
||||
return (unveils);
|
||||
}
|
||||
|
||||
int
|
||||
main(int argc, char **argv)
|
||||
{
|
||||
const char *safepath = "/bin:/sbin:/usr/bin:/usr/sbin:"
|
||||
"/usr/local/bin:/usr/local/sbin";
|
||||
const char *confpath = NULL;
|
||||
char *shargv[] = { NULL, NULL };
|
||||
char *sh;
|
||||
const char *p;
|
||||
const char *cmd;
|
||||
char cmdline[LINE_MAX];
|
||||
char mypwbuf[_PW_BUF_LEN], targpwbuf[_PW_BUF_LEN];
|
||||
struct passwd mypwstore, targpwstore;
|
||||
struct passwd *mypw, *targpw;
|
||||
const struct rule *rule;
|
||||
uid_t uid;
|
||||
uid_t target = 0;
|
||||
gid_t groups[NGROUPS_MAX + 1];
|
||||
int ngroups;
|
||||
int i, ch, rv;
|
||||
int sflag = 0;
|
||||
int nflag = 0;
|
||||
char cwdpath[PATH_MAX];
|
||||
const char *cwd;
|
||||
char *login_style = NULL;
|
||||
char **envp;
|
||||
|
||||
setprogname("doas");
|
||||
|
||||
closefrom(STDERR_FILENO + 1);
|
||||
|
||||
uid = getuid();
|
||||
|
||||
while ((ch = getopt(argc, argv, "a:C:Lnsu:")) != -1) {
|
||||
switch (ch) {
|
||||
case 'a':
|
||||
login_style = optarg;
|
||||
break;
|
||||
case 'C':
|
||||
confpath = optarg;
|
||||
break;
|
||||
case 'L':
|
||||
i = open("/dev/tty", O_RDWR);
|
||||
if (i != -1)
|
||||
ioctl(i, TIOCCLRVERAUTH);
|
||||
exit(i == -1);
|
||||
case 'u':
|
||||
if (parseuid(optarg, &target) != 0)
|
||||
errx(1, "unknown user");
|
||||
break;
|
||||
case 'n':
|
||||
nflag = 1;
|
||||
break;
|
||||
case 's':
|
||||
sflag = 1;
|
||||
break;
|
||||
default:
|
||||
usage();
|
||||
break;
|
||||
}
|
||||
}
|
||||
argv += optind;
|
||||
argc -= optind;
|
||||
|
||||
if (confpath) {
|
||||
if (sflag)
|
||||
usage();
|
||||
} else if ((!sflag && !argc) || (sflag && argc))
|
||||
usage();
|
||||
|
||||
rv = getpwuid_r(uid, &mypwstore, mypwbuf, sizeof(mypwbuf), &mypw);
|
||||
if (rv != 0)
|
||||
err(1, "getpwuid_r failed");
|
||||
if (mypw == NULL)
|
||||
errx(1, "no passwd entry for self");
|
||||
ngroups = getgroups(NGROUPS_MAX, groups);
|
||||
if (ngroups == -1)
|
||||
err(1, "can't get groups");
|
||||
groups[ngroups++] = getgid();
|
||||
|
||||
if (sflag) {
|
||||
sh = getenv("SHELL");
|
||||
if (sh == NULL || *sh == '\0') {
|
||||
shargv[0] = mypw->pw_shell;
|
||||
} else
|
||||
shargv[0] = sh;
|
||||
argv = shargv;
|
||||
argc = 1;
|
||||
}
|
||||
|
||||
if (confpath) {
|
||||
if (pledge("stdio rpath getpw id", NULL) == -1)
|
||||
err(1, "pledge");
|
||||
checkconfig(confpath, argc, argv, uid, groups, ngroups,
|
||||
target);
|
||||
exit(1); /* fail safe */
|
||||
}
|
||||
|
||||
if (geteuid())
|
||||
errx(1, "not installed setuid");
|
||||
|
||||
parseconfig("/etc/doas.conf", 1);
|
||||
|
||||
/* cmdline is used only for logging, no need to abort on truncate */
|
||||
(void)strlcpy(cmdline, argv[0], sizeof(cmdline));
|
||||
for (i = 1; i < argc; i++) {
|
||||
if (strlcat(cmdline, " ", sizeof(cmdline)) >= sizeof(cmdline))
|
||||
break;
|
||||
if (strlcat(cmdline, argv[i], sizeof(cmdline)) >= sizeof(cmdline))
|
||||
break;
|
||||
}
|
||||
|
||||
cmd = argv[0];
|
||||
rv = permit(uid, groups, ngroups, &rule, target, cmd,
|
||||
(const char **)argv + 1);
|
||||
if (rv != 0) {
|
||||
syslog(LOG_AUTHPRIV | LOG_NOTICE,
|
||||
"command not permitted for %s: %s", mypw->pw_name, cmdline);
|
||||
errc(1, EPERM, NULL);
|
||||
}
|
||||
|
||||
if (!(rule->options & NOPASS)) {
|
||||
if (nflag)
|
||||
errx(1, "Authentication required");
|
||||
|
||||
authuser(mypw->pw_name, login_style, rule->options & PERSIST);
|
||||
}
|
||||
|
||||
if ((p = getenv("PATH")) != NULL)
|
||||
formerpath = strdup(p);
|
||||
if (formerpath == NULL)
|
||||
formerpath = "";
|
||||
|
||||
if (unveil(_PATH_LOGIN_CONF, "r") == -1)
|
||||
err(1, "unveil %s", _PATH_LOGIN_CONF);
|
||||
if (unveil(_PATH_LOGIN_CONF ".db", "r") == -1)
|
||||
err(1, "unveil %s.db", _PATH_LOGIN_CONF);
|
||||
if (unveil(_PATH_LOGIN_CONF_D, "r") == -1)
|
||||
err(1, "unveil %s", _PATH_LOGIN_CONF_D);
|
||||
if (rule->cmd) {
|
||||
if (setenv("PATH", safepath, 1) == -1)
|
||||
err(1, "failed to set PATH '%s'", safepath);
|
||||
}
|
||||
if (unveilcommands(getenv("PATH"), cmd) == 0)
|
||||
goto fail;
|
||||
|
||||
if (pledge("stdio rpath getpw exec id", NULL) == -1)
|
||||
err(1, "pledge");
|
||||
|
||||
rv = getpwuid_r(target, &targpwstore, targpwbuf, sizeof(targpwbuf), &targpw);
|
||||
if (rv != 0)
|
||||
err(1, "getpwuid_r failed");
|
||||
if (targpw == NULL)
|
||||
errx(1, "no passwd entry for target");
|
||||
|
||||
if (setusercontext(NULL, targpw, target, LOGIN_SETGROUP |
|
||||
LOGIN_SETPATH |
|
||||
LOGIN_SETPRIORITY | LOGIN_SETRESOURCES | LOGIN_SETUMASK |
|
||||
LOGIN_SETUSER | LOGIN_SETENV | LOGIN_SETRTABLE) != 0)
|
||||
errx(1, "failed to set user context for target");
|
||||
|
||||
if (pledge("stdio rpath exec", NULL) == -1)
|
||||
err(1, "pledge");
|
||||
|
||||
if (getcwd(cwdpath, sizeof(cwdpath)) == NULL)
|
||||
cwd = "(failed)";
|
||||
else
|
||||
cwd = cwdpath;
|
||||
|
||||
if (pledge("stdio exec", NULL) == -1)
|
||||
err(1, "pledge");
|
||||
|
||||
if (!(rule->options & NOLOG)) {
|
||||
syslog(LOG_AUTHPRIV | LOG_INFO,
|
||||
"%s ran command %s as %s from %s",
|
||||
mypw->pw_name, cmdline, targpw->pw_name, cwd);
|
||||
}
|
||||
|
||||
envp = prepenv(rule, mypw, targpw);
|
||||
|
||||
/* setusercontext set path for the next process, so reset it for us */
|
||||
if (rule->cmd) {
|
||||
if (setenv("PATH", safepath, 1) == -1)
|
||||
err(1, "failed to set PATH '%s'", safepath);
|
||||
} else {
|
||||
if (setenv("PATH", formerpath, 1) == -1)
|
||||
err(1, "failed to set PATH '%s'", formerpath);
|
||||
}
|
||||
execvpe(cmd, argv, envp);
|
||||
fail:
|
||||
if (errno == ENOENT)
|
||||
errx(1, "%s: command not found", cmd);
|
||||
err(1, "%s", cmd);
|
||||
}
|
||||
BIN
openbsd-pledge-unveil/openbsd-7.6.jpg
Normal file
BIN
openbsd-pledge-unveil/openbsd-7.6.jpg
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 5.1 MiB |
389
openbsd-pledge-unveil/openbsd-pledge-unveil.md
Executable file
389
openbsd-pledge-unveil/openbsd-pledge-unveil.md
Executable file
@ -0,0 +1,389 @@
|
||||
#!/bin/env slides
|
||||
|
||||
# OpenBSD, pledge(), and unveil()
|
||||
|
||||
_By Bruce Hill_
|
||||
|
||||
```
|
||||
_.-|-/\-._
|
||||
\-' '-.
|
||||
/ /\ /\ \/ _____ ____ _____ _____
|
||||
\/ < . > ./. \/ / ___ \ | _ \ / ____| __ \
|
||||
_ / < > /___\ |. / / / /___ ___ ____ | |_) | (___ | | | |
|
||||
.< \ / < /\ > ( #) |#) / / / / __ \/ _ \/ __ \| _ < \___ \| | | |
|
||||
| | < /\ -. __\ / /__/ / /_/ / __/ / / /| |_) |____) | |__| |
|
||||
\ < < V > )./_._(\ \_____/ .___/\___/_/ /_/ |____/|_____/|_____/
|
||||
.)/\ < < .- / \_'_) )-.. /_/
|
||||
\ < ./ / > > /._./
|
||||
/\ < '-' > > /
|
||||
'-._ < v > _.-'
|
||||
/ '-.______.-' \
|
||||
\/
|
||||
```
|
||||
|
||||
(Puffy the OpenBSD mascot)
|
||||
|
||||
---------------------------------
|
||||
|
||||
# OpenBSD
|
||||
|
||||
- BSD = Berkeley Software Distribution
|
||||
- Also known as "Berkeley Unix"
|
||||
- MacOS is based on BSD
|
||||
|
||||
```demo
|
||||
sxiv -sf -f os-family-tree.png
|
||||
```
|
||||
|
||||
- Kinda like Linux, but cooler!
|
||||
- Better security
|
||||
- Simpler design
|
||||
- ...but maybe worse for personal computing
|
||||
- But great for web servers!
|
||||
- My website runs on OpenBSD!
|
||||
|
||||
----------------------------------
|
||||
|
||||
# Linux Analogy
|
||||
|
||||
The BSD Family:
|
||||
|
||||
- **FreeBSD:** the _Ubuntu_ of the BSD family
|
||||
- Relatively user-friendly
|
||||
- Good for desktops
|
||||
- **NetBSD:** the _Linux Mint_ of the BSD family
|
||||
- Very portable
|
||||
- Good for low-resource machines
|
||||
- **OpenBSD:** the _Arch/Qubes_ of the BSD family
|
||||
- Great documentation (manpages)
|
||||
- **High emphasis on security**
|
||||
|
||||
--------------------------------------
|
||||
|
||||
# OpenBSD
|
||||
|
||||
- Probably more secure than any OS you've ever used
|
||||
- Maybe Qubes is a contender? Debatable.
|
||||
- Really excellent code quality
|
||||
- Great learning resource
|
||||
- Ports collection for package management
|
||||
- Very cool, but out of scope for today
|
||||
- Numerous security improvements exported to other platforms:
|
||||
- OpenSSH
|
||||
- `strlcpy()`
|
||||
- `arc4random()`
|
||||
- Some security improvements that **should** be exported:
|
||||
- `unveil()`
|
||||
- `pledge()`
|
||||
|
||||
-------------------------------------
|
||||
|
||||
# Tangent: Release Artwork
|
||||
|
||||
|
||||
|
||||
-------------------------------------
|
||||
|
||||
# Tangent: Release Artwork
|
||||
|
||||
[Every OS release has artwork and music made by the community](https://www.openbsd.org/artwork.html)
|
||||
|
||||
Every six months since 1996!
|
||||
|
||||
-------------------------------------
|
||||
|
||||
# Defense in Depth
|
||||
|
||||
OpenBSD operates on the assumption that users
|
||||
**will** write and run software with bugs.
|
||||
|
||||
**What happens next will amaze you!**
|
||||
|
||||
When a program starts, it has some idea of what the
|
||||
expected behavior will be.
|
||||
|
||||
- Which files or directories it needs to access
|
||||
- Which system calls will be needed
|
||||
- What _kind of thing_ the program is doing
|
||||
|
||||
The idea is to **pre-commit** to only doing those things.
|
||||
|
||||
If a program has a bug that allows for unintended behavior,
|
||||
**OpenBSD will limit the fallout of that bug.**
|
||||
|
||||
----------------------------------
|
||||
|
||||
# Unveil
|
||||
|
||||
```c
|
||||
int unveil(const char *path, const char *permissions)
|
||||
```
|
||||
|
||||
When a program starts, it can restrict itself
|
||||
to certain parts of the filesystem with `unveil()`
|
||||
|
||||
- Limit which files and directories the program can see
|
||||
- Change whether the program has read/write/execute permissions on files
|
||||
|
||||
This is **enforced by the OS** and it will cause
|
||||
system calls like `open()` to return error values as
|
||||
if those files didn't exist or didn't have those
|
||||
permissions.
|
||||
|
||||
Unveil is **additive** so once you call it, it
|
||||
closes off access to all files on the filesystem
|
||||
except the ones you _add_ access to.
|
||||
|
||||
```demo
|
||||
less unveil.txt
|
||||
```
|
||||
|
||||
----------------------------------
|
||||
|
||||
# Chroot Jail Comparison
|
||||
|
||||
`unveil()` is similar to `chroot`, but much, much
|
||||
easier to use.
|
||||
|
||||
**Chroot:**
|
||||
|
||||
- Run a program in a fake (restricted) filesystem
|
||||
- Only include copies of stuff you want
|
||||
- Run your program so it thinks that is the whole filesystem
|
||||
- Annoying to set up
|
||||
- Requires copying files
|
||||
|
||||
**Unveil:**
|
||||
|
||||
- Selectively mask off parts of the existing filesystem
|
||||
- Easy to add a few function calls or wrap a program
|
||||
- Don't need to copy any files
|
||||
- Can easily do read-only or write-only access
|
||||
|
||||
----------------------------------
|
||||
|
||||
# Using unveil()
|
||||
|
||||
`unveil()` is a drop-in security measure that can make
|
||||
a program more secure _without invasive changes._
|
||||
|
||||
You _just_ have to add a call to `unveil()` to the
|
||||
top of your program and any program that correctly
|
||||
handles non-existent files works as you would hope.
|
||||
|
||||
```python
|
||||
def buggy_write_to_tempfile(filename: str, contents: str):
|
||||
with open("/tmp/" + filename, "w") as f:
|
||||
f.write(contents)
|
||||
|
||||
# Uh oh!
|
||||
buggy_write_to_tempfile("../etc/passwd", "Oh no")
|
||||
```
|
||||
|
||||
Let's make it secure:
|
||||
|
||||
```python
|
||||
import openbsd
|
||||
openbsd.unveil("/tmp", "rw")
|
||||
|
||||
# Now this is safe(r)!
|
||||
buggy_write_to_tempfile("../etc/passwd", "Oh no")
|
||||
```
|
||||
|
||||
Now we can't read or write any file outside of `/tmp`!
|
||||
|
||||
----------------------------------
|
||||
|
||||
# Pledge
|
||||
|
||||
```c
|
||||
int pledge(const char *promises, const char *execpromises)
|
||||
```
|
||||
|
||||
`pledge()` lets you restrict which **system calls**
|
||||
the current program is allowed to make (and which
|
||||
ones any child processes can make).
|
||||
|
||||
Some interesting permissions:
|
||||
|
||||
- `stdio`: do standard I/O operations like reading `stdin` and printing to `stdout`
|
||||
- `rpath`: perform **read-only** operations on the filesystem (e.g. `cat`)
|
||||
- `wpath`: perform **write-only** operations on the filesystem (e.g. a logger)
|
||||
- `inet`: do networking stuff like access the internet
|
||||
- `exec`: execute other programs
|
||||
- `unveil`: call `unveil()` to allow access to more files **(!!!)**
|
||||
|
||||
```demo
|
||||
less pledge.txt
|
||||
```
|
||||
|
||||
----------------------------------
|
||||
|
||||
# Pledge Case Study: Echo
|
||||
|
||||
The `echo` program in the OpenBSD codebase
|
||||
(slightly modified)
|
||||
|
||||
```c
|
||||
int main(int argc, char *argv[]) {
|
||||
if (pledge("stdio", NULL) == -1)
|
||||
err(1, "pledge");
|
||||
|
||||
while (*argv) {
|
||||
(void)fputs(*argv, stdout);
|
||||
if (*++argv)
|
||||
putchar(' ');
|
||||
}
|
||||
putchar('\n');
|
||||
|
||||
return 0;
|
||||
}
|
||||
```
|
||||
|
||||
Even if there were a bug in this program, it is
|
||||
_near impossible_ for the program to do anything other
|
||||
than read `stdin` and print to `stdout`!
|
||||
|
||||
----------------------------------
|
||||
|
||||
# Pledge Narrowing: cat
|
||||
|
||||
Another useful technique is to start with maximum
|
||||
permissions and gradually drop permissions as you go.
|
||||
|
||||
Here's a [simplified](https://github.com/openbsd/src/blob/master/bin/cat/cat.c) version of `cat`:
|
||||
|
||||
```c
|
||||
int main(int argc, char *argv[]) {
|
||||
pledge("stdio rpath", NULL);
|
||||
|
||||
FILE *f = argc == 1 ? stdout : fopen(argv[1], "r");
|
||||
|
||||
// Don't need FS read permissions anymore
|
||||
pledge("stdio", NULL);
|
||||
|
||||
char buf[100];
|
||||
size_t just_read;
|
||||
while ((just_read=fread(buf, 1, sizeof(buf), f)) > 0)
|
||||
fwrite(buf, 1, just_read, stdout);
|
||||
|
||||
fclose(f);
|
||||
return 0;
|
||||
}
|
||||
```
|
||||
|
||||
**💀 BAD PRACTICE: not checking return values 💀**
|
||||
|
||||
----------------------------------
|
||||
|
||||
# Combined pledge/unveil Example
|
||||
|
||||
From `fsck.c`, which checks the filesystem:
|
||||
|
||||
```c
|
||||
if (unveil("/dev", "rw") == -1)
|
||||
err(1, "unveil /dev");
|
||||
if (unveil("/etc/fstab", "r") == -1)
|
||||
err(1, "unveil %s", _PATH_FSTAB);
|
||||
if (unveil("/sbin", "x") == -1)
|
||||
err(1, "unveil /sbin");
|
||||
if (pledge("stdio rpath wpath disklabel proc exec", NULL) == -1)
|
||||
err(1, "pledge");
|
||||
```
|
||||
|
||||
It can:
|
||||
|
||||
1. Read and write to `/dev`
|
||||
2. Read `/etc/fstab`
|
||||
3. Run programs in `/sbin`
|
||||
4. Do I/O, filesystem stuff, and run programs from `/sbin`
|
||||
|
||||
It cannot:
|
||||
|
||||
1. Access password files
|
||||
2. Read from user's home directory
|
||||
3. Write files anywhere besides `/dev`
|
||||
4. Connect to the internet
|
||||
5. Kill other processes
|
||||
6. **Change my `pledge()`/`unveil()` permissions further (!!!)**
|
||||
|
||||
----------------------------------
|
||||
# Case Study: Firefox
|
||||
|
||||
>Firefox on OpenBSD is secured with pledge(2) and unveil(2)
|
||||
>to limit the system calls and filesystem access that each
|
||||
>of Firefox's process types (main, content, remote data decoder,
|
||||
>audio decoder, socket and GPU) is permitted.
|
||||
>**By default, only ~/Downloads and /tmp can be written to**
|
||||
>when downloading files, or when viewing local files
|
||||
>as file:// URLs.
|
||||
|
||||
Even if there are bugs in a massive program like Firefox,
|
||||
the scope of the damage an attacker could do is limited!
|
||||
|
||||
----------------------------------
|
||||
|
||||
# Conclusion
|
||||
|
||||
I hope you think these security tools are as cool as I do!
|
||||
|
||||
OpenBSD is a really great OS to run on a web server where
|
||||
you care a lot about security!
|
||||
|
||||
Most of the built-in software that ships with the OS makes
|
||||
good use of `pledge()` and `unveil()` to give you better
|
||||
security!
|
||||
|
||||
Try it yourself sometime! It's mostly familiar to Mac/Linux
|
||||
users, but with a few galaxy brain ideas.
|
||||
|
||||
----------------------------------
|
||||
|
||||
# The End
|
||||
|
||||
_Thanks for your time!_
|
||||
|
||||
----------------------------------
|
||||
|
||||
# Footnote 1: Code Quality
|
||||
|
||||
Compare OpenBSD's implementation of `true`:
|
||||
|
||||
|
||||
|
||||
With the GNU Coure Utilities implementation used in Linux:
|
||||
|
||||
|
||||
|
||||
----------------------------------
|
||||
|
||||
# Footnote 2: Code Quality
|
||||
|
||||
OpenBSD comes with `doas`, which is under 500 lines of code:
|
||||
|
||||
```
|
||||
*******************************************************************************
|
||||
Language files blank comment code
|
||||
*******************************************************************************
|
||||
C 1 55 19 424
|
||||
*******************************************************************************
|
||||
```
|
||||
|
||||
The `sudo` that comes with Linux is nearly a quarter million lines of code!
|
||||
|
||||
```
|
||||
*******************************************************************************
|
||||
Language files blank comment code
|
||||
*******************************************************************************
|
||||
C 468 18,038 28,119 132,203
|
||||
PO File 74 30,350 48,907 78,866
|
||||
Bourne Shell 94 8,868 6,387 51,341
|
||||
m4 24 1336 607 14,761
|
||||
...
|
||||
*******************************************************************************
|
||||
SUM: 717 59,673 85,426 284,387
|
||||
*******************************************************************************
|
||||
```
|
||||
|
||||
[More lines of code = more risk of vulnerabilities](https://www.alibabacloud.com/help/en/ecs/vulnerability-announcement-or-linux-sudo-permission-vulnerability)
|
||||
|
||||
9
openbsd-pledge-unveil/openbsd-true.c
Normal file
9
openbsd-pledge-unveil/openbsd-true.c
Normal file
@ -0,0 +1,9 @@
|
||||
/* $OpenBSD: true.c,v 1.1 2015/11/11 19:05:28 deraadt Exp $ */
|
||||
|
||||
/* Public domain - Theo de Raadt */
|
||||
|
||||
int
|
||||
main(int argc, char *argv[])
|
||||
{
|
||||
return (0);
|
||||
}
|
||||
BIN
openbsd-pledge-unveil/os-family-tree.png
Normal file
BIN
openbsd-pledge-unveil/os-family-tree.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 29 KiB |
300
openbsd-pledge-unveil/pledge.txt
Normal file
300
openbsd-pledge-unveil/pledge.txt
Normal file
@ -0,0 +1,300 @@
|
||||
PLEDGE(2) System Calls Manual PLEDGE(2)
|
||||
|
||||
NNAAMMEE
|
||||
pplleeddggee - restrict system operations
|
||||
|
||||
SSYYNNOOPPSSIISS
|
||||
##iinncclluuddee <<uunniissttdd..hh>>
|
||||
|
||||
_i_n_t
|
||||
pplleeddggee(_c_o_n_s_t _c_h_a_r _*_p_r_o_m_i_s_e_s, _c_o_n_s_t _c_h_a_r _*_e_x_e_c_p_r_o_m_i_s_e_s);
|
||||
|
||||
DDEESSCCRRIIPPTTIIOONN
|
||||
The pplleeddggee() system call forces the current process into a restricted-
|
||||
service operating mode. A few subsets are available, roughly described
|
||||
as computation, memory management, read-write operations on file
|
||||
descriptors, opening of files, networking (and notably separate, DNS
|
||||
resolution). In general, these modes were selected by studying the
|
||||
operation of many programs using libc and other such interfaces, and
|
||||
setting _p_r_o_m_i_s_e_s or _e_x_e_c_p_r_o_m_i_s_e_s.
|
||||
|
||||
Use of pplleeddggee() in an application will require at least some study and
|
||||
understanding of the interfaces called. Subsequent calls to pplleeddggee() can
|
||||
reduce the abilities further, but abilities can never be regained.
|
||||
|
||||
A process which attempts a restricted operation is killed with an
|
||||
uncatchable SIGABRT, delivering a core file if possible. A process
|
||||
currently running with pledge has state `p' in ps(1) output; a process
|
||||
that was terminated due to a pledge violation is accounted by lastcomm(1)
|
||||
with the `P' flag.
|
||||
|
||||
A _p_r_o_m_i_s_e_s value of "" restricts the process to the _exit(2) system call.
|
||||
This can be used for pure computation operating on memory shared with
|
||||
another process.
|
||||
|
||||
Passing NULL to _p_r_o_m_i_s_e_s or _e_x_e_c_p_r_o_m_i_s_e_s specifies to not change the
|
||||
current value.
|
||||
|
||||
Some system calls, when allowed, have restrictions applied to them:
|
||||
|
||||
access(2):
|
||||
May check for existence of _/_e_t_c_/_l_o_c_a_l_t_i_m_e.
|
||||
|
||||
adjtime(2):
|
||||
Read-only, for ntpd(8).
|
||||
|
||||
chmod(2), fchmod(2), fchmodat(2), chown(2), lchown(2), fchown(2),
|
||||
fchownat(2), mkfifo(2), and mknod(2):
|
||||
Setuid/setgid/sticky bits are ignored. The user or group cannot be
|
||||
changed on a file.
|
||||
|
||||
ioctl(2):
|
||||
Only the FIONREAD, FIONBIO, FIOCLEX, and FIONCLEX operations are
|
||||
allowed by default. Various ioctl requests are allowed against
|
||||
specific file descriptors based upon the requests aauuddiioo, bbppff,
|
||||
ddiisskkllaabbeell, ddrrmm, iinneett, ppff, rroouuttee, wwrroouuttee, ttaappee, ttttyy, vviiddeeoo, and vvmmmm.
|
||||
|
||||
mmap(2) and mprotect(2):
|
||||
PROT_EXEC isn't allowed.
|
||||
|
||||
open(2):
|
||||
May open _/_e_t_c_/_l_o_c_a_l_t_i_m_e and any files below _/_u_s_r_/_s_h_a_r_e_/_z_o_n_e_i_n_f_o.
|
||||
|
||||
profil(2):
|
||||
Can only disable profiling.
|
||||
|
||||
pplleeddggee():
|
||||
Can only reduce permissions for _p_r_o_m_i_s_e_s and _e_x_e_c_p_r_o_m_i_s_e_s.
|
||||
|
||||
sysctl(2):
|
||||
A small set of read-only operations are allowed, sufficient to
|
||||
support: getdomainname(3), gethostname(3), getifaddrs(3), uname(3),
|
||||
and system sensor readings.
|
||||
|
||||
The _p_r_o_m_i_s_e_s argument is specified as a string, with space separated
|
||||
keywords:
|
||||
|
||||
ssttddiioo The following system calls are permitted. sendto(2) is
|
||||
only permitted if its destination socket address is
|
||||
NULL. As a result, all the expected functionalities of
|
||||
libc stdio work.
|
||||
|
||||
clock_getres(2), clock_gettime(2), close(2),
|
||||
closefrom(2), dup(2), dup2(2), dup3(2), fchdir(2),
|
||||
fcntl(2), fstat(2), fsync(2), ftruncate(2),
|
||||
getdtablecount(2), getegid(2), getentropy(2),
|
||||
geteuid(2), getgid(2), getgroups(2), getitimer(2),
|
||||
getlogin(2), getpgid(2), getpgrp(2), getpid(2),
|
||||
getppid(2), getresgid(2), getresuid(2), getrlimit(2),
|
||||
getrtable(2), getsid(2), getthrid(2), gettimeofday(2),
|
||||
getuid(2), issetugid(2), kevent(2), kqueue(2),
|
||||
kqueue1(2), lseek(2), madvise(2), minherit(2), mmap(2),
|
||||
mprotect(2), mquery(2), munmap(2), nanosleep(2),
|
||||
pipe(2), pipe2(2), poll(2), pread(2), preadv(2),
|
||||
profil(2), pwrite(2), pwritev(2), read(2), readv(2),
|
||||
recvfrom(2), recvmsg(2), select(2), sendmsg(2),
|
||||
sendsyslog(2), sendto(2), setitimer(2), shutdown(2),
|
||||
sigaction(2), sigprocmask(2), sigreturn(2),
|
||||
socketpair(2), umask(2), wait4(2), waitid(2), write(2),
|
||||
writev(2)
|
||||
|
||||
rrppaatthh A number of system calls are allowed if they only cause
|
||||
read-only effects on the filesystem, or expose filenames
|
||||
to programs:
|
||||
|
||||
chdir(2), getcwd(3), getdents(2), openat(2), fstatat(2),
|
||||
faccessat(2), readlinkat(2), lstat(2), chmod(2),
|
||||
fchmod(2), fchmodat(2), chflags(2), chflagsat(2),
|
||||
chown(2), fchown(2), fchownat(2), fstat(2), getfsstat(2)
|
||||
|
||||
wwppaatthh A number of system calls are allowed and may cause
|
||||
write-effects on the filesystem:
|
||||
|
||||
getcwd(3), openat(2), fstatat(2), faccessat(2),
|
||||
readlinkat(2), lstat(2), chmod(2), fchmod(2),
|
||||
fchmodat(2), chflags(2), chflagsat(2), chown(2),
|
||||
fchown(2), fchownat(2), fstat(2)
|
||||
|
||||
ccppaatthh A number of system calls and sub-modes are allowed,
|
||||
which may create new files or directories in the
|
||||
filesystem:
|
||||
|
||||
rename(2), renameat(2), link(2), linkat(2), symlink(2),
|
||||
symlinkat(2), unlink(2), unlinkat(2), mkdir(2),
|
||||
mkdirat(2), rmdir(2)
|
||||
|
||||
ddppaatthh A number of system calls are allowed to create special
|
||||
files:
|
||||
|
||||
mkfifo(2), mknod(2)
|
||||
|
||||
ttmmppppaatthh A number of system calls are allowed to do operations in
|
||||
the _/_t_m_p directory, including create, read, or write:
|
||||
|
||||
lstat(2), chmod(2), chflags(2), chown(2), unlink(2),
|
||||
fstat(2)
|
||||
|
||||
iinneett The following system calls are allowed to operate in the
|
||||
AF_INET and AF_INET6 domains (though setsockopt(2) has
|
||||
been substantially reduced in functionality):
|
||||
|
||||
socket(2), listen(2), bind(2), connect(2), accept4(2),
|
||||
accept(2), getpeername(2), getsockname(2),
|
||||
setsockopt(2), getsockopt(2)
|
||||
|
||||
mmccaasstt In combination with iinneett give back functionality to
|
||||
setsockopt(2) for operating on multicast sockets.
|
||||
|
||||
ffaattttrr The following system calls are allowed to make explicit
|
||||
changes to fields in _s_t_r_u_c_t _s_t_a_t relating to a file:
|
||||
|
||||
utimes(2), futimes(2), utimensat(2), futimens(2),
|
||||
chmod(2), fchmod(2), fchmodat(2), chflags(2),
|
||||
chflagsat(2), chown(2), fchownat(2), lchown(2),
|
||||
fchown(2), utimes(2)
|
||||
|
||||
cchhoowwnn The chown(2) family is allowed to change the user or
|
||||
group on a file.
|
||||
|
||||
fflloocckk File locking via fcntl(2), flock(2), lockf(3), and
|
||||
open(2) is allowed. No distinction is made between
|
||||
shared and exclusive locks. This promise is required
|
||||
for unlock as well as lock.
|
||||
|
||||
uunniixx The following system calls are allowed to operate in the
|
||||
AF_UNIX domain:
|
||||
|
||||
socket(2), listen(2), bind(2), connect(2), accept4(2),
|
||||
accept(2), getpeername(2), getsockname(2),
|
||||
setsockopt(2), getsockopt(2)
|
||||
|
||||
ddnnss Subsequent to a successful open(2) of _/_e_t_c_/_r_e_s_o_l_v_._c_o_n_f,
|
||||
a few system calls become able to allow DNS network
|
||||
transactions:
|
||||
|
||||
sendto(2), recvfrom(2), socket(2), connect(2)
|
||||
|
||||
ggeettppww This allows read-only opening of files in _/_e_t_c for the
|
||||
getpwnam(3), getgrnam(3), getgrouplist(3), and
|
||||
initgroups(3) family of functions, including lookups via
|
||||
the yp(8) protocol for YP and LDAP databases.
|
||||
|
||||
sseennddffdd Allows sending of file descriptors using sendmsg(2).
|
||||
File descriptors referring to directories may not be
|
||||
passed.
|
||||
|
||||
rreeccvvffdd Allows receiving of file descriptors using recvmsg(2).
|
||||
File descriptors referring to directories may not be
|
||||
passed.
|
||||
|
||||
ttaappee Allow MTIOCGET and MTIOCTOP operations against tape
|
||||
drives.
|
||||
|
||||
ttttyy In addition to allowing read-write operations on
|
||||
_/_d_e_v_/_t_t_y, this opens up a variety of ioctl(2) requests
|
||||
used by tty devices. If ttttyy is accompanied with rrppaatthh,
|
||||
revoke(2) is permitted. Otherwise only the following
|
||||
ioctl(2) requests are permitted:
|
||||
|
||||
TIOCSPGRP, TIOCGETA, TIOCGPGRP, TIOCGWINSZ, TIOCSWINSZ,
|
||||
TIOCSBRK, TIOCCDTR, TIOCSETA, TIOCSETAW, TIOCSETAF,
|
||||
TIOCUCNTL
|
||||
|
||||
pprroocc Allows the following process relationship operations:
|
||||
|
||||
fork(2), vfork(2), kill(2), getpriority(2),
|
||||
setpriority(2), setrlimit(2), setpgid(2), setsid(2)
|
||||
|
||||
eexxeecc Allows a process to call execve(2). Coupled with the
|
||||
pprroocc promise, this allows a process to fork and execute
|
||||
another program. If _e_x_e_c_p_r_o_m_i_s_e_s has been previously
|
||||
set the new program begins with those promises, unless
|
||||
setuid/setgid bits are set in which case execution is
|
||||
blocked with EACCES. Otherwise the new program starts
|
||||
running without pledge active, and hopefully makes a new
|
||||
pledge soon.
|
||||
|
||||
pprroott__eexxeecc Allows the use of PROT_EXEC with mmap(2) and
|
||||
mprotect(2).
|
||||
|
||||
sseettttiimmee Allows the setting of system time, via the
|
||||
settimeofday(2), adjtime(2), and adjfreq(2) system
|
||||
calls.
|
||||
|
||||
ppss Allows enough sysctl(2) interfaces to allow inspection
|
||||
of processes operating on the system using programs like
|
||||
ps(1).
|
||||
|
||||
vvmmiinnffoo Allows enough sysctl(2) interfaces to allow inspection
|
||||
of the system's virtual memory by programs like top(1)
|
||||
and vmstat(8).
|
||||
|
||||
iidd Allows the following system calls which can change the
|
||||
rights of a process:
|
||||
|
||||
setuid(2), seteuid(2), setreuid(2), setresuid(2),
|
||||
setgid(2), setegid(2), setregid(2), setresgid(2),
|
||||
setgroups(2), setlogin(2), setrlimit(2), getpriority(2),
|
||||
setpriority(2), setrtable(2)
|
||||
|
||||
ppff Allows a subset of ioctl(2) operations on the pf(4)
|
||||
device:
|
||||
|
||||
DIOCADDRULE, DIOCGETSTATUS, DIOCNATLOOK, DIOCRADDTABLES,
|
||||
DIOCRCLRADDRS, DIOCRCLRTABLES, DIOCRCLRTSTATS,
|
||||
DIOCRGETTSTATS, DIOCRSETADDRS, DIOCXBEGIN, DIOCXCOMMIT
|
||||
|
||||
rroouuttee Allow inspection of the routing table.
|
||||
|
||||
wwrroouuttee Allow changes to the routing table.
|
||||
|
||||
aauuddiioo Allows a subset of ioctl(2) operations on audio(4)
|
||||
devices (see sio_open(3) for more information):
|
||||
|
||||
AUDIO_GETPOS, AUDIO_GETPAR, AUDIO_SETPAR, AUDIO_START,
|
||||
AUDIO_STOP, AUDIO_MIXER_DEVINFO, AUDIO_MIXER_READ,
|
||||
AUDIO_MIXER_WRITE
|
||||
|
||||
vviiddeeoo Allows a subset of ioctl(2) operations on video(4)
|
||||
devices:
|
||||
|
||||
VIDIOC_DQBUF, VIDIOC_ENUM_FMT,
|
||||
VIDIOC_ENUM_FRAMEINTERVALS, VIDIOC_ENUM_FRAMESIZES,
|
||||
VIDIOC_G_CTRL, VIDIOC_G_PARM, VIDIOC_QBUF,
|
||||
VIDIOC_QUERYBUF, VIDIOC_QUERYCAP, VIDIOC_QUERYCTRL,
|
||||
VIDIOC_S_CTRL, VIDIOC_S_FMT, VIDIOC_S_PARM,
|
||||
VIDIOC_STREAMOFF, VIDIOC_STREAMON, VIDIOC_TRY_FMT,
|
||||
VIDIOC_REQBUFS
|
||||
|
||||
bbppff Allow BIOCGSTATS operation for statistics collection
|
||||
from a bpf(4) device.
|
||||
|
||||
uunnvveeiill Allow unveil(2) to be called.
|
||||
|
||||
eerrrroorr Rather than killing the process upon violation, indicate
|
||||
error with ENOSYS.
|
||||
|
||||
Also when pplleeddggee() is called with higher _p_r_o_m_i_s_e_s or
|
||||
_e_x_e_c_p_r_o_m_i_s_e_s, those changes will be ignored and return
|
||||
success. This is useful when a parent enforces
|
||||
_e_x_e_c_p_r_o_m_i_s_e_s but an execve'd child has a different idea.
|
||||
|
||||
RREETTUURRNN VVAALLUUEESS
|
||||
Upon successful completion, the value 0 is returned; otherwise the
|
||||
value -1 is returned and the global variable _e_r_r_n_o is set to indicate the
|
||||
error.
|
||||
|
||||
EERRRROORRSS
|
||||
pplleeddggee() will fail if:
|
||||
|
||||
[EFAULT] _p_r_o_m_i_s_e_s or _e_x_e_c_p_r_o_m_i_s_e_s points outside the process's
|
||||
allocated address space.
|
||||
|
||||
[EINVAL] _p_r_o_m_i_s_e_s is malformed or contains invalid keywords.
|
||||
|
||||
[EPERM] This process is attempting to increase permissions.
|
||||
|
||||
HHIISSTTOORRYY
|
||||
The pplleeddggee() system call first appeared in OpenBSD 5.9.
|
||||
|
||||
OpenBSD 7.6 September 17, 2024 OpenBSD 7.6
|
||||
81
openbsd-pledge-unveil/unveil.txt
Normal file
81
openbsd-pledge-unveil/unveil.txt
Normal file
@ -0,0 +1,81 @@
|
||||
UNVEIL(2) System Calls Manual UNVEIL(2)
|
||||
|
||||
NNAAMMEE
|
||||
uunnvveeiill - unveil parts of a restricted filesystem view
|
||||
|
||||
SSYYNNOOPPSSIISS
|
||||
##iinncclluuddee <<uunniissttdd..hh>>
|
||||
|
||||
_i_n_t
|
||||
uunnvveeiill(_c_o_n_s_t _c_h_a_r _*_p_a_t_h, _c_o_n_s_t _c_h_a_r _*_p_e_r_m_i_s_s_i_o_n_s);
|
||||
|
||||
DDEESSCCRRIIPPTTIIOONN
|
||||
The first call to uunnvveeiill() that specifies a _p_a_t_h removes visibility of
|
||||
the entire filesystem from all other filesystem-related system calls
|
||||
(such as open(2), chmod(2) and rename(2)), except for the specified _p_a_t_h
|
||||
and _p_e_r_m_i_s_s_i_o_n_s.
|
||||
|
||||
The uunnvveeiill() system call remains capable of traversing to any _p_a_t_h in the
|
||||
filesystem, so additional calls can set permissions at other points in
|
||||
the filesystem hierarchy.
|
||||
|
||||
After establishing a collection of _p_a_t_h and _p_e_r_m_i_s_s_i_o_n_s rules, future
|
||||
calls to uunnvveeiill() can be disabled by passing two NULL arguments.
|
||||
Alternatively, pledge(2) may be used to remove the "unveil" promise.
|
||||
|
||||
The _p_e_r_m_i_s_s_i_o_n_s argument points to a string consisting of zero or more of
|
||||
the following characters:
|
||||
|
||||
rr Make _p_a_t_h available for read operations, corresponding to the
|
||||
pledge(2) promise "rpath".
|
||||
ww Make _p_a_t_h available for write operations, corresponding to
|
||||
the pledge(2) promise "wpath".
|
||||
xx Make _p_a_t_h available for execute operations, corresponding to
|
||||
the pledge(2) promise "exec".
|
||||
cc Allow _p_a_t_h to be created and removed, corresponding to the
|
||||
pledge(2) promise "cpath".
|
||||
|
||||
A _p_a_t_h that is a directory will enable all filesystem access underneath
|
||||
_p_a_t_h using _p_e_r_m_i_s_s_i_o_n_s if and only if no more specific matching uunnvveeiill()
|
||||
exists at a lower level. Directories are remembered at the time of a
|
||||
call to uunnvveeiill(). This means that a directory that is removed and
|
||||
recreated after a call to uunnvveeiill() will appear to not exist.
|
||||
|
||||
Non-directory paths are remembered by name within their containing
|
||||
directory, and so may be created, removed, or re-created after a call to
|
||||
uunnvveeiill() and still appear to exist.
|
||||
|
||||
Attempts to access paths not allowed by uunnvveeiill() will result in an error
|
||||
of EACCES when the _p_e_r_m_i_s_s_i_o_n_s argument does not match the attempted
|
||||
operation. ENOENT is returned for paths for which no uunnvveeiill()
|
||||
permissions qualify. After a process has terminated, lastcomm(1) will
|
||||
mark it with the `U' flag if file access was prevented by uunnvveeiill().
|
||||
|
||||
uunnvveeiill() use can be tricky because programs misbehave badly when their
|
||||
files unexpectedly disappear. In many cases it is easier to unveil the
|
||||
directories in which an application makes use of files.
|
||||
|
||||
RREETTUURRNN VVAALLUUEESS
|
||||
Upon successful completion, the value 0 is returned; otherwise the
|
||||
value -1 is returned and the global variable _e_r_r_n_o is set to indicate the
|
||||
error.
|
||||
|
||||
EERRRROORRSS
|
||||
[E2BIG] The addition of _p_a_t_h would exceed the per-process
|
||||
limit for unveiled paths.
|
||||
|
||||
[EFAULT] _p_a_t_h or _p_e_r_m_i_s_s_i_o_n_s points outside the process's
|
||||
allocated address space.
|
||||
|
||||
[ENOENT] A directory in _p_a_t_h did not exist.
|
||||
|
||||
[EINVAL] An invalid value of _p_e_r_m_i_s_s_i_o_n_s was used.
|
||||
|
||||
[EPERM] An attempt to increase permissions was made, or the
|
||||
_p_a_t_h was not accessible, or uunnvveeiill() was called after
|
||||
locking.
|
||||
|
||||
HHIISSTTOORRYY
|
||||
The uunnvveeiill() system call first appeared in OpenBSD 6.4.
|
||||
|
||||
OpenBSD 7.6 September 6, 2021 OpenBSD 7.6
|
||||
Loading…
Reference in New Issue
Block a user