1//===-- ChrootChecker.cpp - chroot usage checks ---------------------------===//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8//
9// This file defines chroot checker, which checks improper use of chroot.
10//
11//===----------------------------------------------------------------------===//
12
13#include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
14#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
15#include "clang/StaticAnalyzer/Core/Checker.h"
16#include "clang/StaticAnalyzer/Core/CheckerManager.h"
17#include "clang/StaticAnalyzer/Core/PathSensitive/CallDescription.h"
18#include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
19#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
20#include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h"
21#include "clang/StaticAnalyzer/Core/PathSensitive/ProgramStateTrait.h"
22#include "clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h"
23
24using namespace clang;
25using namespace ento;
26
27namespace {
28
29// enum value that represent the jail state
30enum Kind { NO_CHROOT, ROOT_CHANGED, JAIL_ENTERED };
31
32bool isRootChanged(intptr_t k) { return k == ROOT_CHANGED; }
33//bool isJailEntered(intptr_t k) { return k == JAIL_ENTERED; }
34
35// This checker checks improper use of chroot.
36// The state transition:
37// NO_CHROOT ---chroot(path)--> ROOT_CHANGED ---chdir(/) --> JAIL_ENTERED
38// | |
39// ROOT_CHANGED<--chdir(..)-- JAIL_ENTERED<--chdir(..)--
40// | |
41// bug<--foo()-- JAIL_ENTERED<--foo()--
42class ChrootChecker : public Checker<eval::Call, check::PreCall> {
43 // This bug refers to possibly break out of a chroot() jail.
44 const BugType BT_BreakJail{this, "Break out of jail"};
45
46 const CallDescription Chroot{CDM::CLibrary, {"chroot"}, 1},
47 Chdir{CDM::CLibrary, {"chdir"}, 1};
48
49public:
50 ChrootChecker() {}
51
52 static void *getTag() {
53 static int x;
54 return &x;
55 }
56
57 bool evalCall(const CallEvent &Call, CheckerContext &C) const;
58 void checkPreCall(const CallEvent &Call, CheckerContext &C) const;
59
60private:
61 void evalChroot(const CallEvent &Call, CheckerContext &C) const;
62 void evalChdir(const CallEvent &Call, CheckerContext &C) const;
63};
64
65} // end anonymous namespace
66
67bool ChrootChecker::evalCall(const CallEvent &Call, CheckerContext &C) const {
68 if (Chroot.matches(Call)) {
69 evalChroot(Call, C);
70 return true;
71 }
72 if (Chdir.matches(Call)) {
73 evalChdir(Call, C);
74 return true;
75 }
76
77 return false;
78}
79
80void ChrootChecker::evalChroot(const CallEvent &Call, CheckerContext &C) const {
81 ProgramStateRef state = C.getState();
82 ProgramStateManager &Mgr = state->getStateManager();
83
84 // Once encouter a chroot(), set the enum value ROOT_CHANGED directly in
85 // the GDM.
86 state = Mgr.addGDM(St: state, Key: ChrootChecker::getTag(), Data: (void*) ROOT_CHANGED);
87 C.addTransition(State: state);
88}
89
90void ChrootChecker::evalChdir(const CallEvent &Call, CheckerContext &C) const {
91 ProgramStateRef state = C.getState();
92 ProgramStateManager &Mgr = state->getStateManager();
93
94 // If there are no jail state in the GDM, just return.
95 const void *k = state->FindGDM(K: ChrootChecker::getTag());
96 if (!k)
97 return;
98
99 // After chdir("/"), enter the jail, set the enum value JAIL_ENTERED.
100 const Expr *ArgExpr = Call.getArgExpr(Index: 0);
101 SVal ArgVal = C.getSVal(S: ArgExpr);
102
103 if (const MemRegion *R = ArgVal.getAsRegion()) {
104 R = R->StripCasts();
105 if (const StringRegion* StrRegion= dyn_cast<StringRegion>(Val: R)) {
106 const StringLiteral* Str = StrRegion->getStringLiteral();
107 if (Str->getString() == "/")
108 state = Mgr.addGDM(St: state, Key: ChrootChecker::getTag(),
109 Data: (void*) JAIL_ENTERED);
110 }
111 }
112
113 C.addTransition(State: state);
114}
115
116// Check the jail state before any function call except chroot and chdir().
117void ChrootChecker::checkPreCall(const CallEvent &Call,
118 CheckerContext &C) const {
119 // Ignore chroot and chdir.
120 if (matchesAny(Call, CD1: Chroot, CDs: Chdir))
121 return;
122
123 // If jail state is ROOT_CHANGED, generate BugReport.
124 void *const* k = C.getState()->FindGDM(K: ChrootChecker::getTag());
125 if (k)
126 if (isRootChanged(k: (intptr_t) *k))
127 if (ExplodedNode *N = C.generateNonFatalErrorNode()) {
128 constexpr llvm::StringLiteral Msg =
129 "No call of chdir(\"/\") immediately after chroot";
130 C.emitReport(
131 R: std::make_unique<PathSensitiveBugReport>(args: BT_BreakJail, args: Msg, args&: N));
132 }
133}
134
135void ento::registerChrootChecker(CheckerManager &mgr) {
136 mgr.registerChecker<ChrootChecker>();
137}
138
139bool ento::shouldRegisterChrootChecker(const CheckerManager &mgr) {
140 return true;
141}
142