Class: Straycall::Supervisor

Inherits:
Object
  • Object
show all
Includes:
Handlers::Exec, Handlers::Filesystem
Defined in:
lib/straycall/supervisor.rb

Constant Summary collapse

ENDPOINT_SOCKET_DOMAINS = 
[Socket::AF_UNIX, Socket::AF_INET, Socket::AF_INET6].freeze
LOCAL_SOCKET_DOMAINS = 
Socket.const_defined?(:AF_NETLINK, false) ? [Socket.const_get(:AF_NETLINK, false)].freeze : [].freeze
MMSGHDR_SIZE = 
64
MAX_MMSG = 
1024
REPORT_INTERVAL = 
0.1

Instance Attribute Summary collapse

Instance Method Summary collapse

Methods included from Handlers::Exec

#handle_exec

Methods included from Handlers::Filesystem

#handle_fd_mutation, #handle_mmap, #handle_openat, #handle_openat2, #handle_path_mutation, #handle_rename

Constructor Details

#initialize(config, reporter: nil, console: Report::Console.new, prompt: Prompt.new) ⇒ Supervisor

Returns a new instance of Supervisor.



26
27
28
29
30
31
32
33
34
35
 
# File 'lib/straycall/supervisor.rb', line 26

def initialize(config, reporter: nil, console: Report::Console.new, prompt: Prompt.new)
  @config = config
  @reporter = reporter
  @console = console
  @violations = []
  @mutex = Mutex.new
  @reported_locations = {}
  @bound_sockets = {}
  @prompt = prompt
end

Instance Attribute Details

#violations ⇒ Object (readonly)

Returns the value of attribute violations.



24
25
26
 
# File 'lib/straycall/supervisor.rb', line 24

def violations
  @violations
end

Instance Method Details

#flush_report ⇒ Object 



111
112
113
 
# File 'lib/straycall/supervisor.rb', line 111

def flush_report
  write_report(force: true)
end

#register(supervisor) ⇒ Object 



61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
 
# File 'lib/straycall/supervisor.rb', line 61

def register(supervisor)
  supervisor.on(:socket) { |request| handle_socket(request) }
  supervisor.on(:connect) { |request| handle_address(request, 1, 2) }
  supervisor.on(:bind) { |request| handle_bind(request) }
  supervisor.on(:listen) { |request| handle_listen(request) }
  supervisor.on(:sendto) { |request| handle_address(request, 4, 5) }
  supervisor.on(:sendmsg) { |request| handle_sendmsg(request) }
  supervisor.on(:sendmmsg) { |request| handle_sendmmsg(request) }
  names = Policy.notification_names(@config)
  cwd = Policy::Filesystem::AT_FDCWD
  supervisor.on(:openat) { |request| handle_openat(request) } if names.include?(:openat)
  supervisor.on(:openat2) { |request| handle_openat2(request) } if names.include?(:openat2)
  supervisor.on(:unlinkat) { |request| handle_path_mutation(request, request.args[0], request.args[1]) } if names.include?(:unlinkat)
  supervisor.on(:mkdirat) { |request| handle_path_mutation(request, request.args[0], request.args[1]) } if names.include?(:mkdirat)
  supervisor.on(:symlinkat) { |request| handle_path_mutation(request, request.args[1], request.args[2]) } if names.include?(:symlinkat)
  supervisor.on(:renameat) { |request| handle_rename(request, *request.args.values_at(0, 1, 2, 3)) } if names.include?(:renameat)
  supervisor.on(:renameat2) { |request| handle_rename(request, *request.args.values_at(0, 1, 2, 3)) } if names.include?(:renameat2)
  supervisor.on(:linkat) { |request| handle_rename(request, *request.args.values_at(0, 1, 2, 3)) } if names.include?(:linkat)
  supervisor.on(:truncate) { |request| handle_path_mutation(request, cwd, request.args[0]) } if names.include?(:truncate)
  supervisor.on(:ftruncate) { |request| handle_fd_mutation(request, request.args[0]) } if names.include?(:ftruncate)
  supervisor.on(:fchmodat) { |request| handle_path_mutation(request, request.args[0], request.args[1]) } if names.include?(:fchmodat)
  supervisor.on(:fchmodat2) { |request| handle_path_mutation(request, request.args[0], request.args[1]) } if names.include?(:fchmodat2)
  supervisor.on(:fchownat) { |request| handle_path_mutation(request, request.args[0], request.args[1]) } if names.include?(:fchownat)
  supervisor.on(:utimensat) { |request| handle_path_mutation(request, request.args[0], request.args[1]) } if names.include?(:utimensat)
  supervisor.on(:copy_file_range) { |request| handle_fd_mutation(request, request.args[2]) } if names.include?(:copy_file_range)
  supervisor.on(:mmap) { |request| handle_mmap(request) } if names.include?(:mmap)
  supervisor.on(:open) { |request| handle_open(request, cwd, request.args[0], request.args[1]) } if names.include?(:open)
  if names.include?(:creat)
    supervisor.on(:creat) do |request|
      flags = Fcntl::O_WRONLY | Fcntl::O_CREAT | Fcntl::O_TRUNC
      handle_open(request, cwd, request.args[0], flags)
    end
  end
  supervisor.on(:unlink) { |request| handle_path_mutation(request, cwd, request.args[0]) } if names.include?(:unlink)
  supervisor.on(:mkdir) { |request| handle_path_mutation(request, cwd, request.args[0]) } if names.include?(:mkdir)
  supervisor.on(:rmdir) { |request| handle_path_mutation(request, cwd, request.args[0]) } if names.include?(:rmdir)
  supervisor.on(:symlink) { |request| handle_path_mutation(request, cwd, request.args[1]) } if names.include?(:symlink)
  %i[chmod chown lchown].each do |name|
    supervisor.on(name) { |request| handle_path_mutation(request, cwd, request.args[0]) } if names.include?(name)
  end
  %i[fchmod fchown].each do |name|
    supervisor.on(name) { |request| handle_fd_mutation(request, request.args[0]) } if names.include?(name)
  end
  supervisor.on(:rename) { |request| handle_rename(request, cwd, request.args[0], cwd, request.args[1]) } if names.include?(:rename)
  supervisor.on(:link) { |request| handle_rename(request, cwd, request.args[0], cwd, request.args[1]) } if names.include?(:link)
  supervisor.on(:execve) { |request| handle_exec(request, nil, 0) } if names.include?(:execve)
  supervisor.on(:execveat) { |request| handle_exec(request, 0, 1) } if names.include?(:execveat)
  supervisor
end

#run(command) ⇒ Object 



37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
 
# File 'lib/straycall/supervisor.rb', line 37

def run(command)
  supervisor_socket, target_socket = UNIXSocket.pair
  target_socket.close_on_exec = false
  supervisor = Seccomp::Notify.spawn(Policy.seccomp(@config), concurrency: 8) do
    supervisor_socket.close
    environment, argv = command.first.is_a?(Hash) ? [command.first.dup, command.drop(1)] : [{}, command]
    reporter = File.expand_path("target", __dir__)
    inherited_rubyopt = environment.key?("RUBYOPT") ? environment["RUBYOPT"] : ENV["RUBYOPT"]
    environment["STRAYCALL_REPORT_FD"] = target_socket.fileno.to_s
    environment["STRAYCALL_REPORT_PID"] = Process.pid.to_s
    environment["RUBYOPT"] = [Shellwords.escape("-r#{reporter}"), inherited_rubyopt].compact.join(" ")
    exec(environment, *argv)
  end
  target_socket.close
  @reporter = Reporter::Client.new(supervisor_socket)
  register(supervisor)
  status = supervisor.run
  flush_report
  [status, violations]
ensure
  target_socket&.close unless target_socket&.closed?
  @reporter&.close
end