clang  6.0.0svn
ChrootChecker.cpp
Go to the documentation of this file.
1 //===- Chrootchecker.cpp -------- Basic security checks ---------*- C++ -*-===//
2 //
3 // The LLVM Compiler Infrastructure
4 //
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
7 //
8 //===----------------------------------------------------------------------===//
9 //
10 // This file defines chroot checker, which checks improper use of chroot.
11 //
12 //===----------------------------------------------------------------------===//
13 
14 #include "ClangSACheckers.h"
22 
23 using namespace clang;
24 using namespace ento;
25 
26 namespace {
27 
28 // enum value that represent the jail state
29 enum Kind { NO_CHROOT, ROOT_CHANGED, JAIL_ENTERED };
30 
31 bool isRootChanged(intptr_t k) { return k == ROOT_CHANGED; }
32 //bool isJailEntered(intptr_t k) { return k == JAIL_ENTERED; }
33 
34 // This checker checks improper use of chroot.
35 // The state transition:
36 // NO_CHROOT ---chroot(path)--> ROOT_CHANGED ---chdir(/) --> JAIL_ENTERED
37 // | |
38 // ROOT_CHANGED<--chdir(..)-- JAIL_ENTERED<--chdir(..)--
39 // | |
40 // bug<--foo()-- JAIL_ENTERED<--foo()--
41 class ChrootChecker : public Checker<eval::Call, check::PreStmt<CallExpr> > {
42  mutable IdentifierInfo *II_chroot, *II_chdir;
43  // This bug refers to possibly break out of a chroot() jail.
44  mutable std::unique_ptr<BuiltinBug> BT_BreakJail;
45 
46 public:
47  ChrootChecker() : II_chroot(nullptr), II_chdir(nullptr) {}
48 
49  static void *getTag() {
50  static int x;
51  return &x;
52  }
53 
54  bool evalCall(const CallExpr *CE, CheckerContext &C) const;
55  void checkPreStmt(const CallExpr *CE, CheckerContext &C) const;
56 
57 private:
58  void Chroot(CheckerContext &C, const CallExpr *CE) const;
59  void Chdir(CheckerContext &C, const CallExpr *CE) const;
60 };
61 
62 } // end anonymous namespace
63 
64 bool ChrootChecker::evalCall(const CallExpr *CE, CheckerContext &C) const {
65  const FunctionDecl *FD = C.getCalleeDecl(CE);
66  if (!FD)
67  return false;
68 
69  ASTContext &Ctx = C.getASTContext();
70  if (!II_chroot)
71  II_chroot = &Ctx.Idents.get("chroot");
72  if (!II_chdir)
73  II_chdir = &Ctx.Idents.get("chdir");
74 
75  if (FD->getIdentifier() == II_chroot) {
76  Chroot(C, CE);
77  return true;
78  }
79  if (FD->getIdentifier() == II_chdir) {
80  Chdir(C, CE);
81  return true;
82  }
83 
84  return false;
85 }
86 
87 void ChrootChecker::Chroot(CheckerContext &C, const CallExpr *CE) const {
89  ProgramStateManager &Mgr = state->getStateManager();
90 
91  // Once encouter a chroot(), set the enum value ROOT_CHANGED directly in
92  // the GDM.
93  state = Mgr.addGDM(state, ChrootChecker::getTag(), (void*) ROOT_CHANGED);
94  C.addTransition(state);
95 }
96 
97 void ChrootChecker::Chdir(CheckerContext &C, const CallExpr *CE) const {
99  ProgramStateManager &Mgr = state->getStateManager();
100 
101  // If there are no jail state in the GDM, just return.
102  const void *k = state->FindGDM(ChrootChecker::getTag());
103  if (!k)
104  return;
105 
106  // After chdir("/"), enter the jail, set the enum value JAIL_ENTERED.
107  const Expr *ArgExpr = CE->getArg(0);
108  SVal ArgVal = state->getSVal(ArgExpr, C.getLocationContext());
109 
110  if (const MemRegion *R = ArgVal.getAsRegion()) {
111  R = R->StripCasts();
112  if (const StringRegion* StrRegion= dyn_cast<StringRegion>(R)) {
113  const StringLiteral* Str = StrRegion->getStringLiteral();
114  if (Str->getString() == "/")
115  state = Mgr.addGDM(state, ChrootChecker::getTag(),
116  (void*) JAIL_ENTERED);
117  }
118  }
119 
120  C.addTransition(state);
121 }
122 
123 // Check the jail state before any function call except chroot and chdir().
124 void ChrootChecker::checkPreStmt(const CallExpr *CE, CheckerContext &C) const {
125  const FunctionDecl *FD = C.getCalleeDecl(CE);
126  if (!FD)
127  return;
128 
129  ASTContext &Ctx = C.getASTContext();
130  if (!II_chroot)
131  II_chroot = &Ctx.Idents.get("chroot");
132  if (!II_chdir)
133  II_chdir = &Ctx.Idents.get("chdir");
134 
135  // Ingnore chroot and chdir.
136  if (FD->getIdentifier() == II_chroot || FD->getIdentifier() == II_chdir)
137  return;
138 
139  // If jail state is ROOT_CHANGED, generate BugReport.
140  void *const* k = C.getState()->FindGDM(ChrootChecker::getTag());
141  if (k)
142  if (isRootChanged((intptr_t) *k))
144  if (!BT_BreakJail)
145  BT_BreakJail.reset(new BuiltinBug(
146  this, "Break out of jail", "No call of chdir(\"/\") immediately "
147  "after chroot"));
148  C.emitReport(llvm::make_unique<BugReport>(
149  *BT_BreakJail, BT_BreakJail->getDescription(), N));
150  }
151 }
152 
153 void ento::registerChrootChecker(CheckerManager &mgr) {
154  mgr.registerChecker<ChrootChecker>();
155 }
ProgramStateRef addGDM(ProgramStateRef St, void *Key, void *Data)
FunctionDecl - An instance of this class is created to represent a function declaration or definition...
Definition: Decl.h:1698
MemRegion - The root abstract class for all memory regions.
Definition: MemRegion.h:79
Expr * getArg(unsigned Arg)
getArg - Return the specified argument.
Definition: Expr.h:2278
ExplodedNode * addTransition(ProgramStateRef State=nullptr, const ProgramPointTag *Tag=nullptr)
Generates a new transition in the program state graph (ExplodedGraph).
const FunctionDecl * getCalleeDecl(const CallExpr *CE) const
Get the declaration of the called function (path-sensitive).
IdentifierInfo * getIdentifier() const
getIdentifier - Get the identifier that names this declaration, if there is one.
Definition: Decl.h:265
One of these records is kept for each identifier that is lexed.
Holds long-lived AST nodes (such as types and decls) that can be referred to throughout the semantic ...
Definition: ASTContext.h:149
i32 captured_struct **param SharedsTy A type which contains references the shared variables *param Shareds Context with the list of shared variables from the p *TaskFunction *param Data Additional data for task generation like final * state
IdentifierTable & Idents
Definition: ASTContext.h:537
__INTPTR_TYPE__ intptr_t
A signed integer type with the property that any valid pointer to void can be converted to this type...
Definition: opencl-c.h:75
StringRef getString() const
Definition: Expr.h:1557
Expr - This represents one expression.
Definition: Expr.h:106
ExplodedNode * generateNonFatalErrorNode(ProgramStateRef State=nullptr, const ProgramPointTag *Tag=nullptr)
Generate a transition to a node that will be used to report an error.
void emitReport(std::unique_ptr< BugReport > R)
Emit the diagnostics report.
Kind
CHECKER * registerChecker()
Used to register checkers.
IdentifierInfo & get(StringRef Name)
Return the identifier token info for the specified named identifier.
const MemRegion * getAsRegion() const
Definition: SVals.cpp:140
SVal - This represents a symbolic expression, which can be either an L-value or an R-value...
Definition: SVals.h:63
Dataflow Directional Tag Classes.
const ProgramStateRef & getState() const
StringLiteral - This represents a string literal expression, e.g.
Definition: Expr.h:1509
CallExpr - Represents a function call (C99 6.5.2.2, C++ [expr.call]).
Definition: Expr.h:2209
StringRegion - Region associated with a StringLiteral.
Definition: MemRegion.h:779
const LocationContext * getLocationContext() const