PLEDGE: New strace parser (#4225)

* PLEDGE: New strace parser
- This parser saves every path in a line and lets us pick and choose which
- Statistics are accurate now
  ones to use

* PLEDGE: Small fixes and now we wrap stat()
- Moved from perm to keys in the enforce() function, more name changes
  to come
- Fixed some comments
- Wrapped stat()

* PLEDGE: Better relative path handling for fstatat()

Author: arctangerines

devel/pledge/README.md

@@ -46,7 +46,6 @@ The most important file here is the contract file, if we `cat` it we get:
 ```
 action        path          count
 R             </usr/bin/cat> 1
-SR            </home/user/dummy> 33
 S             </usr/lib/debug> 1
 R             </etc/ld.so.cache> 2
 +             </usr/lib/aarch64-linux-gnu/libc.so.6> 4

devel/pledge/TODO

@@ -1,3 +1,4 @@
 * Enforcer should allow paths that have a Stat permission lead to other calls without issues
 * We need to trace failed calls (we should start with ENOENT)
-* Implement new tracer for creation, deletion, metadata and list operations
+* Dependency graph of our own?
+* mprotect

devel/pledge/src/enforcer.c

@@ -257,7 +257,7 @@ deinit_enforce()
 /// @param pathname: This is the pathname to check for enforcing
 /// @param perm: This is the permission that this path should have
 bool enforce(const char *pathname,
-		const uint8_t perm)
+		const uint8_t keys)
 {
 	// WHITELIST check
 	for (size_t i = 0; WHITELIST[i] != NULL; i++) {
@@ -294,7 +294,7 @@ bool enforce(const char *pathname,
 		return true;
 	}
 	// Order matters a lot for these operations
-	if (a->delete && (perm & DELETE_ACCESS)) {
+	if (a->delete && (keys & DELETE_ACCESS)) {
 		flag2letter(a, a_perm, a_perm_len);
 		PRINT_GREEN();
 		fprintf(stderr,
@@ -306,7 +306,7 @@ bool enforce(const char *pathname,
 		PRINT_RESET_TERM_C();
 		return true;
 	}
-	if (a->list && (perm & LIST_ACCESS)) {
+	if (a->list && (keys & LIST_ACCESS)) {
 		flag2letter(a, a_perm, a_perm_len);
 		PRINT_GREEN();
 		fprintf(stderr,
@@ -330,7 +330,7 @@ bool enforce(const char *pathname,
 	// An interesting thing is that an O_CREAT flag on open does not guarantee
 	// that the OS will return the file descriptor with the permission that was requested
 	// if the file is created, the fd might be open with READ and WRITE permissions
-	if (a->create && (perm & CREATE_ACCESS)) {
+	if (a->create && (keys & CREATE_ACCESS)) {
 		flag2letter(a, a_perm, a_perm_len);
 		PRINT_GREEN();
 		fprintf(stderr,
@@ -343,7 +343,7 @@ bool enforce(const char *pathname,
 	}
 
 	// We are not trying to create or delete, so it doesnt matter
-	if ((a->read && a->write) && (perm & READ_ACCESS || perm & WRITE_ACCESS)) {
+	if ((a->read && a->write) && (keys & READ_ACCESS || keys & WRITE_ACCESS)) {
 		flag2letter(a, a_perm, a_perm_len);
 		PRINT_GREEN();
 		fprintf(stderr,
@@ -354,7 +354,7 @@ bool enforce(const char *pathname,
 				a_perm);
 		PRINT_RESET_TERM_C();
 		return true;
-	} else if ((a->read && (perm & READ_ACCESS)) || (a->write && (perm & WRITE_ACCESS))) {
+	} else if ((a->read && (keys & READ_ACCESS)) || (a->write && (keys & WRITE_ACCESS))) {
 		flag2letter(a, a_perm, a_perm_len);
 		PRINT_GREEN();
 		fprintf(stderr,
@@ -365,7 +365,7 @@ bool enforce(const char *pathname,
 				a_perm);
 		PRINT_RESET_TERM_C();
 		return true;
-	} else if (a->stat && (perm & STAT_ACCESS)) {
+	} else if (a->stat && (keys & STAT_ACCESS)) {
 		flag2letter(a, a_perm, a_perm_len);
 		PRINT_GREEN();
 		fprintf(stderr,
@@ -382,7 +382,7 @@ bool enforce(const char *pathname,
 		fprintf(stderr,
 				"[BLOCKED]: "
 				"Permission [0x%x] for path [%s] does not match contract, expected [%s]\n",
-				perm,
+				keys,
 				a->pathname,
 				a_perm);
 		PRINT_RESET_TERM_C();
@@ -560,6 +560,35 @@ fopen(const char *restrict pathname,
 	return real_fopen(pathname, mode);
 }
 
+int stat(const char *restrict pathname,
+		struct stat *restrict statbuf)
+{
+	PRINT_YELLOW();
+	fprintf(stderr, "[STAT]: Caught path [%s]\n", pathname);
+	PRINT_RESET_TERM_C();
+
+	size_t path_len = strlen(pathname);
+	if (path_len < 1) {
+		// TODO: Better error handling
+		return -1;
+	}
+
+	// 1. If pathname is relative then we make it absolute basing ourselves
+	// 2. If the path is absolute, we just use that path to verify
+	// In theory this is fine because rel2abspath leaves absolute paths as is
+	char full_path[MAXPATHLEN];
+	if (rel2abspath(full_path, pathname, MAXPATHLEN) == NULL) {
+		// Couldn't convert so we fallback to pathname
+		strncpy(full_path, pathname, MAXPATHLEN);
+	}
+	enforce(full_path, STAT_ACCESS);
+
+	int (*real_stat)(const char *restrict pathname, struct stat *restrict statbuf);
+	real_stat = dlsym(RTLD_NEXT, "stat");
+
+	return real_stat(pathname, statbuf);
+}
+
 int fstatat(int dirfd,
 		const char *restrict pathname,
 		struct stat *restrict statbuf,
@@ -601,7 +630,14 @@ int fstatat(int dirfd,
 		char solved_path[MAXPATHLEN];
 		size_t solved_path_len = readlink(fd_link, solved_path, MAXPATHLEN);
 		solved_path[solved_path_len] = '\0';
-		strcat(solved_path, pathname); // XXX: strncat()?
+		// XXX: strncat()?
+		if (path_len > 2) {
+			if (pathname[0] == '.' && pathname[1] == '/') {
+				strcat(solved_path, pathname + 2);
+			}
+		} else {
+			strcat(solved_path, pathname);
+		}
 		enforce(solved_path, STAT_ACCESS);
 	}
 

devel/pledge/src/list_util.c

@@ -137,7 +137,7 @@ void generate_contract_from_list(FILE *f, struct list *r)
 		if (a->delete)
 			strcat(perms, "D");
 
-		/// XXX: We should rewrite the enforcer wrapper functions to
+		/// TODO: We should rewrite the enforcer wrapper functions to
 		/// use 2 separate letters for RW permission and not +
 		if (a->read && a->write)
 			strcat(perms, "+");

devel/pledge/src/list_util.h

@@ -27,11 +27,13 @@
 // because otherwise we might not be able to do much
 // Now the real question is, do we LABEL an open call as whatever flag it carries
 // (aside from creat obviously)
-/// Singly linked list containing our paths with their permission
+/// Struct containing our paths with their permission
 /// TODO: Change name
 struct path_access {
 	/// How many times the file has been accessed
 	uint32_t count;
+	/// XXX: For statistics and summarization, if there was an ENOENT on a certain path
+	/// it should be saved
 	/// Pathname in absolute form, ideally it should never be relative
 	char *pathname;
 	/// Flag for read