1 //===- Chrootchecker.cpp -------- Basic security checks ----------*- C++ -*-==// 2 // 3 // The LLVM Compiler Infrastructure 4 // 5 // This file is distributed under the University of Illinois Open Source 6 // License. See LICENSE.TXT for details. 7 // 8 //===----------------------------------------------------------------------===// 9 // 10 // This file defines chroot checker, which checks improper use of chroot. 11 // 12 //===----------------------------------------------------------------------===// 13 14 #include "ExprEngineExperimentalChecks.h" 15 #include "clang/StaticAnalyzer/BugReporter/BugType.h" 16 #include "clang/StaticAnalyzer/PathSensitive/CheckerVisitor.h" 17 #include "clang/StaticAnalyzer/PathSensitive/GRState.h" 18 #include "clang/StaticAnalyzer/PathSensitive/GRStateTrait.h" 19 #include "clang/StaticAnalyzer/PathSensitive/SymbolManager.h" 20 #include "llvm/ADT/ImmutableMap.h" 21 using namespace clang; 22 using namespace ento; 23 24 namespace { 25 26 // enum value that represent the jail state 27 enum Kind { NO_CHROOT, ROOT_CHANGED, JAIL_ENTERED }; 28 29 bool isRootChanged(intptr_t k) { return k == ROOT_CHANGED; } 30 //bool isJailEntered(intptr_t k) { return k == JAIL_ENTERED; } 31 32 // This checker checks improper use of chroot. 33 // The state transition: 34 // NO_CHROOT ---chroot(path)--> ROOT_CHANGED ---chdir(/) --> JAIL_ENTERED 35 // | | 36 // ROOT_CHANGED<--chdir(..)-- JAIL_ENTERED<--chdir(..)-- 37 // | | 38 // bug<--foo()-- JAIL_ENTERED<--foo()-- 39 class ChrootChecker : public CheckerVisitor<ChrootChecker> { 40 IdentifierInfo *II_chroot, *II_chdir; 41 // This bug refers to possibly break out of a chroot() jail. 42 BuiltinBug *BT_BreakJail; 43 44 public: 45 ChrootChecker() : II_chroot(0), II_chdir(0), BT_BreakJail(0) {} 46 47 static void *getTag() { 48 static int x; 49 return &x; 50 } 51 52 virtual bool evalCallExpr(CheckerContext &C, const CallExpr *CE); 53 virtual void PreVisitCallExpr(CheckerContext &C, const CallExpr *CE); 54 55 private: 56 void Chroot(CheckerContext &C, const CallExpr *CE); 57 void Chdir(CheckerContext &C, const CallExpr *CE); 58 }; 59 60 } // end anonymous namespace 61 62 void ento::RegisterChrootChecker(ExprEngine &Eng) { 63 Eng.registerCheck(new ChrootChecker()); 64 } 65 66 bool ChrootChecker::evalCallExpr(CheckerContext &C, const CallExpr *CE) { 67 const GRState *state = C.getState(); 68 const Expr *Callee = CE->getCallee(); 69 SVal L = state->getSVal(Callee); 70 const FunctionDecl *FD = L.getAsFunctionDecl(); 71 if (!FD) 72 return false; 73 74 ASTContext &Ctx = C.getASTContext(); 75 if (!II_chroot) 76 II_chroot = &Ctx.Idents.get("chroot"); 77 if (!II_chdir) 78 II_chdir = &Ctx.Idents.get("chdir"); 79 80 if (FD->getIdentifier() == II_chroot) { 81 Chroot(C, CE); 82 return true; 83 } 84 if (FD->getIdentifier() == II_chdir) { 85 Chdir(C, CE); 86 return true; 87 } 88 89 return false; 90 } 91 92 void ChrootChecker::Chroot(CheckerContext &C, const CallExpr *CE) { 93 const GRState *state = C.getState(); 94 GRStateManager &Mgr = state->getStateManager(); 95 96 // Once encouter a chroot(), set the enum value ROOT_CHANGED directly in 97 // the GDM. 98 state = Mgr.addGDM(state, ChrootChecker::getTag(), (void*) ROOT_CHANGED); 99 C.addTransition(state); 100 } 101 102 void ChrootChecker::Chdir(CheckerContext &C, const CallExpr *CE) { 103 const GRState *state = C.getState(); 104 GRStateManager &Mgr = state->getStateManager(); 105 106 // If there are no jail state in the GDM, just return. 107 const void* k = state->FindGDM(ChrootChecker::getTag()); 108 if (!k) 109 return; 110 111 // After chdir("/"), enter the jail, set the enum value JAIL_ENTERED. 112 const Expr *ArgExpr = CE->getArg(0); 113 SVal ArgVal = state->getSVal(ArgExpr); 114 115 if (const MemRegion *R = ArgVal.getAsRegion()) { 116 R = R->StripCasts(); 117 if (const StringRegion* StrRegion= dyn_cast<StringRegion>(R)) { 118 const StringLiteral* Str = StrRegion->getStringLiteral(); 119 if (Str->getString() == "/") 120 state = Mgr.addGDM(state, ChrootChecker::getTag(), 121 (void*) JAIL_ENTERED); 122 } 123 } 124 125 C.addTransition(state); 126 } 127 128 // Check the jail state before any function call except chroot and chdir(). 129 void ChrootChecker::PreVisitCallExpr(CheckerContext &C, const CallExpr *CE) { 130 const GRState *state = C.getState(); 131 const Expr *Callee = CE->getCallee(); 132 SVal L = state->getSVal(Callee); 133 const FunctionDecl *FD = L.getAsFunctionDecl(); 134 if (!FD) 135 return; 136 137 ASTContext &Ctx = C.getASTContext(); 138 if (!II_chroot) 139 II_chroot = &Ctx.Idents.get("chroot"); 140 if (!II_chdir) 141 II_chdir = &Ctx.Idents.get("chdir"); 142 143 // Ingnore chroot and chdir. 144 if (FD->getIdentifier() == II_chroot || FD->getIdentifier() == II_chdir) 145 return; 146 147 // If jail state is ROOT_CHANGED, generate BugReport. 148 void* const* k = state->FindGDM(ChrootChecker::getTag()); 149 if (k) 150 if (isRootChanged((intptr_t) *k)) 151 if (ExplodedNode *N = C.generateNode()) { 152 if (!BT_BreakJail) 153 BT_BreakJail = new BuiltinBug("Break out of jail", 154 "No call of chdir(\"/\") immediately " 155 "after chroot"); 156 BugReport *R = new BugReport(*BT_BreakJail, 157 BT_BreakJail->getDescription(), N); 158 C.EmitReport(R); 159 } 160 161 return; 162 } 163