1//===-- ChrootChecker.cpp - chroot usage checks ---------------------------===// 2// 3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. 4// See https://llvm.org/LICENSE.txt for license information. 5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception 6// 7//===----------------------------------------------------------------------===// 8// 9// This file defines chroot checker, which checks improper use of chroot. 10// 11//===----------------------------------------------------------------------===// 12 13#include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h" 14#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h" 15#include "clang/StaticAnalyzer/Core/Checker.h" 16#include "clang/StaticAnalyzer/Core/CheckerManager.h" 17#include "clang/StaticAnalyzer/Core/PathSensitive/CallDescription.h" 18#include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h" 19#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h" 20#include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h" 21#include "clang/StaticAnalyzer/Core/PathSensitive/ProgramStateTrait.h" 22#include "clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h" 23 24using namespace clang; 25using namespace ento; 26 27namespace { 28 29// enum value that represent the jail state 30enum Kind { NO_CHROOT, ROOT_CHANGED, JAIL_ENTERED }; 31 32bool isRootChanged(intptr_t k) { return k == ROOT_CHANGED; } 33//bool isJailEntered(intptr_t k) { return k == JAIL_ENTERED; } 34 35// This checker checks improper use of chroot. 36// The state transition: 37// NO_CHROOT ---chroot(path)--> ROOT_CHANGED ---chdir(/) --> JAIL_ENTERED 38// | | 39// ROOT_CHANGED<--chdir(..)-- JAIL_ENTERED<--chdir(..)-- 40// | | 41// bug<--foo()-- JAIL_ENTERED<--foo()-- 42class ChrootChecker : public Checker<eval::Call, check::PreCall> { 43 // This bug refers to possibly break out of a chroot() jail. 44 mutable std::unique_ptr<BuiltinBug> BT_BreakJail; 45 46 const CallDescription Chroot{{"chroot"}, 1}, Chdir{{"chdir"}, 1}; 47 48public: 49 ChrootChecker() {} 50 51 static void *getTag() { 52 static int x; 53 return &x; 54 } 55 56 bool evalCall(const CallEvent &Call, CheckerContext &C) const; 57 void checkPreCall(const CallEvent &Call, CheckerContext &C) const; 58 59private: 60 void evalChroot(const CallEvent &Call, CheckerContext &C) const; 61 void evalChdir(const CallEvent &Call, CheckerContext &C) const; 62}; 63 64} // end anonymous namespace 65 66bool ChrootChecker::evalCall(const CallEvent &Call, CheckerContext &C) const { 67 if (Chroot.matches(Call)) { 68 evalChroot(Call, C); 69 return true; 70 } 71 if (Chdir.matches(Call)) { 72 evalChdir(Call, C); 73 return true; 74 } 75 76 return false; 77} 78 79void ChrootChecker::evalChroot(const CallEvent &Call, CheckerContext &C) const { 80 ProgramStateRef state = C.getState(); 81 ProgramStateManager &Mgr = state->getStateManager(); 82 83 // Once encouter a chroot(), set the enum value ROOT_CHANGED directly in 84 // the GDM. 85 state = Mgr.addGDM(state, ChrootChecker::getTag(), (void*) ROOT_CHANGED); 86 C.addTransition(state); 87} 88 89void ChrootChecker::evalChdir(const CallEvent &Call, CheckerContext &C) const { 90 ProgramStateRef state = C.getState(); 91 ProgramStateManager &Mgr = state->getStateManager(); 92 93 // If there are no jail state in the GDM, just return. 94 const void *k = state->FindGDM(ChrootChecker::getTag()); 95 if (!k) 96 return; 97 98 // After chdir("/"), enter the jail, set the enum value JAIL_ENTERED. 99 const Expr *ArgExpr = Call.getArgExpr(0); 100 SVal ArgVal = C.getSVal(ArgExpr); 101 102 if (const MemRegion *R = ArgVal.getAsRegion()) { 103 R = R->StripCasts(); 104 if (const StringRegion* StrRegion= dyn_cast<StringRegion>(R)) { 105 const StringLiteral* Str = StrRegion->getStringLiteral(); 106 if (Str->getString() == "/") 107 state = Mgr.addGDM(state, ChrootChecker::getTag(), 108 (void*) JAIL_ENTERED); 109 } 110 } 111 112 C.addTransition(state); 113} 114 115// Check the jail state before any function call except chroot and chdir(). 116void ChrootChecker::checkPreCall(const CallEvent &Call, 117 CheckerContext &C) const { 118 // Ignore chroot and chdir. 119 if (matchesAny(Call, Chroot, Chdir)) 120 return; 121 122 // If jail state is ROOT_CHANGED, generate BugReport. 123 void *const* k = C.getState()->FindGDM(ChrootChecker::getTag()); 124 if (k) 125 if (isRootChanged((intptr_t) *k)) 126 if (ExplodedNode *N = C.generateNonFatalErrorNode()) { 127 if (!BT_BreakJail) 128 BT_BreakJail.reset(new BuiltinBug( 129 this, "Break out of jail", "No call of chdir(\"/\") immediately " 130 "after chroot")); 131 C.emitReport(std::make_unique<PathSensitiveBugReport>( 132 *BT_BreakJail, BT_BreakJail->getDescription(), N)); 133 } 134} 135 136void ento::registerChrootChecker(CheckerManager &mgr) { 137 mgr.registerChecker<ChrootChecker>(); 138} 139 140bool ento::shouldRegisterChrootChecker(const CheckerManager &mgr) { 141 return true; 142} 143