1 //===- Chrootchecker.cpp -------- Basic security checks ----------*- C++ -*-==// 2 // 3 // The LLVM Compiler Infrastructure 4 // 5 // This file is distributed under the University of Illinois Open Source 6 // License. See LICENSE.TXT for details. 7 // 8 //===----------------------------------------------------------------------===// 9 // 10 // This file defines chroot checker, which checks improper use of chroot. 11 // 12 //===----------------------------------------------------------------------===// 13 14 #include "ClangSACheckers.h" 15 #include "clang/StaticAnalyzer/Core/CheckerManager.h" 16 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h" 17 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerVisitor.h" 18 #include "clang/StaticAnalyzer/Core/PathSensitive/GRState.h" 19 #include "clang/StaticAnalyzer/Core/PathSensitive/GRStateTrait.h" 20 #include "clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h" 21 #include "llvm/ADT/ImmutableMap.h" 22 using namespace clang; 23 using namespace ento; 24 25 namespace { 26 27 // enum value that represent the jail state 28 enum Kind { NO_CHROOT, ROOT_CHANGED, JAIL_ENTERED }; 29 30 bool isRootChanged(intptr_t k) { return k == ROOT_CHANGED; } 31 //bool isJailEntered(intptr_t k) { return k == JAIL_ENTERED; } 32 33 // This checker checks improper use of chroot. 34 // The state transition: 35 // NO_CHROOT ---chroot(path)--> ROOT_CHANGED ---chdir(/) --> JAIL_ENTERED 36 // | | 37 // ROOT_CHANGED<--chdir(..)-- JAIL_ENTERED<--chdir(..)-- 38 // | | 39 // bug<--foo()-- JAIL_ENTERED<--foo()-- 40 class ChrootChecker : public CheckerVisitor<ChrootChecker> { 41 IdentifierInfo *II_chroot, *II_chdir; 42 // This bug refers to possibly break out of a chroot() jail. 43 BuiltinBug *BT_BreakJail; 44 45 public: 46 ChrootChecker() : II_chroot(0), II_chdir(0), BT_BreakJail(0) {} 47 48 static void *getTag() { 49 static int x; 50 return &x; 51 } 52 53 virtual bool evalCallExpr(CheckerContext &C, const CallExpr *CE); 54 virtual void PreVisitCallExpr(CheckerContext &C, const CallExpr *CE); 55 56 private: 57 void Chroot(CheckerContext &C, const CallExpr *CE); 58 void Chdir(CheckerContext &C, const CallExpr *CE); 59 }; 60 61 } // end anonymous namespace 62 63 static void RegisterChrootChecker(ExprEngine &Eng) { 64 Eng.registerCheck(new ChrootChecker()); 65 } 66 67 void ento::registerChrootChecker(CheckerManager &mgr) { 68 mgr.addCheckerRegisterFunction(RegisterChrootChecker); 69 } 70 71 bool ChrootChecker::evalCallExpr(CheckerContext &C, const CallExpr *CE) { 72 const GRState *state = C.getState(); 73 const Expr *Callee = CE->getCallee(); 74 SVal L = state->getSVal(Callee); 75 const FunctionDecl *FD = L.getAsFunctionDecl(); 76 if (!FD) 77 return false; 78 79 ASTContext &Ctx = C.getASTContext(); 80 if (!II_chroot) 81 II_chroot = &Ctx.Idents.get("chroot"); 82 if (!II_chdir) 83 II_chdir = &Ctx.Idents.get("chdir"); 84 85 if (FD->getIdentifier() == II_chroot) { 86 Chroot(C, CE); 87 return true; 88 } 89 if (FD->getIdentifier() == II_chdir) { 90 Chdir(C, CE); 91 return true; 92 } 93 94 return false; 95 } 96 97 void ChrootChecker::Chroot(CheckerContext &C, const CallExpr *CE) { 98 const GRState *state = C.getState(); 99 GRStateManager &Mgr = state->getStateManager(); 100 101 // Once encouter a chroot(), set the enum value ROOT_CHANGED directly in 102 // the GDM. 103 state = Mgr.addGDM(state, ChrootChecker::getTag(), (void*) ROOT_CHANGED); 104 C.addTransition(state); 105 } 106 107 void ChrootChecker::Chdir(CheckerContext &C, const CallExpr *CE) { 108 const GRState *state = C.getState(); 109 GRStateManager &Mgr = state->getStateManager(); 110 111 // If there are no jail state in the GDM, just return. 112 const void* k = state->FindGDM(ChrootChecker::getTag()); 113 if (!k) 114 return; 115 116 // After chdir("/"), enter the jail, set the enum value JAIL_ENTERED. 117 const Expr *ArgExpr = CE->getArg(0); 118 SVal ArgVal = state->getSVal(ArgExpr); 119 120 if (const MemRegion *R = ArgVal.getAsRegion()) { 121 R = R->StripCasts(); 122 if (const StringRegion* StrRegion= dyn_cast<StringRegion>(R)) { 123 const StringLiteral* Str = StrRegion->getStringLiteral(); 124 if (Str->getString() == "/") 125 state = Mgr.addGDM(state, ChrootChecker::getTag(), 126 (void*) JAIL_ENTERED); 127 } 128 } 129 130 C.addTransition(state); 131 } 132 133 // Check the jail state before any function call except chroot and chdir(). 134 void ChrootChecker::PreVisitCallExpr(CheckerContext &C, const CallExpr *CE) { 135 const GRState *state = C.getState(); 136 const Expr *Callee = CE->getCallee(); 137 SVal L = state->getSVal(Callee); 138 const FunctionDecl *FD = L.getAsFunctionDecl(); 139 if (!FD) 140 return; 141 142 ASTContext &Ctx = C.getASTContext(); 143 if (!II_chroot) 144 II_chroot = &Ctx.Idents.get("chroot"); 145 if (!II_chdir) 146 II_chdir = &Ctx.Idents.get("chdir"); 147 148 // Ingnore chroot and chdir. 149 if (FD->getIdentifier() == II_chroot || FD->getIdentifier() == II_chdir) 150 return; 151 152 // If jail state is ROOT_CHANGED, generate BugReport. 153 void* const* k = state->FindGDM(ChrootChecker::getTag()); 154 if (k) 155 if (isRootChanged((intptr_t) *k)) 156 if (ExplodedNode *N = C.generateNode()) { 157 if (!BT_BreakJail) 158 BT_BreakJail = new BuiltinBug("Break out of jail", 159 "No call of chdir(\"/\") immediately " 160 "after chroot"); 161 BugReport *R = new BugReport(*BT_BreakJail, 162 BT_BreakJail->getDescription(), N); 163 C.EmitReport(R); 164 } 165 166 return; 167 } 168