Skip to content

Commit ba44105

Browse files
marcoSantimarcoSanti
authored
Bugfixes on forbidden paths (#169)
Added check for forbidden path in is_capio_path --------- Co-authored-by: Marco Edoardo Santimaria <marcoedoardo.santimaria@unito.it>
1 parent 09f6ba8 commit ba44105

13 files changed

Lines changed: 52 additions & 50 deletions

File tree

‎capio-common/capio/constants.hpp‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -14,9 +14,9 @@ typedef unsigned long long int capio_off64_t;
1414
constexpr size_t CAPIO_DEFAULT_DIR_INITIAL_SIZE = 1024L * 1024 * 1024;
1515
constexpr off64_t CAPIO_DEFAULT_FILE_INITIAL_SIZE = 1024L * 1024 * 1024 * 4;
1616
[[maybe_unused]] constexpr std::array CAPIO_DIR_FORBIDDEN_PATHS = {
17-
std::string_view{"/proc/"}, std::string_view{"/sys/"}, std::string_view{"/boot/"},
18-
std::string_view{"/dev/"}, std::string_view{"/var/"}, std::string_view{"/run/"},
19-
std::string_view("/spack/")};
17+
std::string_view{"/proc/"}, std::string_view{"/sys/"}, std::string_view{"/boot/"},
18+
std::string_view{"/dev/"}, std::string_view{"/var/"}, std::string_view{"/run/"},
19+
std::string_view("/spack/"), std::string_view{"/usr/bin/"}};
2020

2121
// CAPIO default values for shared memory
2222
constexpr char CAPIO_DEFAULT_WORKFLOW_NAME[] = "CAPIO";

‎capio-common/capio/filesystem.hpp‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -73,7 +73,8 @@ inline bool is_capio_path(const std::filesystem::path &path_to_check) {
7373
START_LOG(capio_syscall(SYS_gettid), "call(path_to_check=%s)", path_to_check.c_str());
7474

7575
// check if path_to_check begins with CAPIO_DIR
76-
const auto res = is_prefix(get_capio_dir(), path_to_check);
76+
const auto res =
77+
is_prefix(get_capio_dir(), path_to_check) && !is_forbidden_path(path_to_check.string());
7778
LOG("is_capio_path:%s", res ? "yes" : "no");
7879
return res;
7980
}

‎capio-posix/handlers/access.hpp‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ int access_handler(long arg0, long arg1, long arg2, long arg3, long arg4, long a
99
const std::string_view pathname(reinterpret_cast<const char *>(arg0));
1010
auto tid = static_cast<pid_t>(syscall_no_intercept(SYS_gettid));
1111
START_LOG(tid, "call()");
12-
if (is_forbidden_path(pathname) || !is_capio_path(pathname)) {
12+
if (!is_capio_path(pathname)) {
1313
LOG("Path %s is forbidden: skip", pathname.data());
1414
return CAPIO_POSIX_SYSCALL_REQUEST_SKIP;
1515
}
@@ -32,7 +32,7 @@ int faccessat_handler(long arg0, long arg1, long arg2, long arg3, long arg4, lon
3232
auto tid = static_cast<pid_t>(syscall_no_intercept(SYS_gettid));
3333
START_LOG(tid, "call()");
3434

35-
if (is_forbidden_path(pathname) || !is_capio_path(pathname)) {
35+
if (!is_capio_path(pathname)) {
3636
LOG("Path %s is forbidden or is not a capio path: skip", pathname.data());
3737
return CAPIO_POSIX_SYSCALL_REQUEST_SKIP;
3838
}

‎capio-posix/handlers/chdir.hpp‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ int chdir_handler(long arg0, long arg1, long arg2, long arg3, long arg4, long ar
1313
START_LOG(tid, "call(path=%s)", pathname.data());
1414

1515
syscall_no_intercept_flag = true;
16-
if (is_forbidden_path(pathname) || !is_capio_path(pathname)) {
16+
if (!is_capio_path(pathname)) {
1717
LOG("Path %s is forbidden: skip", pathname.data());
1818
syscall_no_intercept_flag = false;
1919
return CAPIO_POSIX_SYSCALL_SKIP;

‎capio-posix/handlers/dup.hpp‎

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -19,8 +19,7 @@ int dup_handler(long arg0, long arg1, long arg2, long arg3, long arg4, long arg5
1919
}
2020
dup_capio_fd(tid, fd, res, false);
2121

22-
*result = res;
23-
return CAPIO_POSIX_SYSCALL_SUCCESS;
22+
return posix_return_value(res, result);
2423
}
2524
return CAPIO_POSIX_SYSCALL_SKIP;
2625
}
@@ -43,8 +42,8 @@ int dup2_handler(long arg0, long arg1, long arg2, long arg3, long arg4, long arg
4342
if (fd != res) {
4443
dup_capio_fd(tid, fd, res, false);
4544
}
46-
*result = res;
47-
return CAPIO_POSIX_SYSCALL_SUCCESS;
45+
46+
return posix_return_value(res, result);
4847
}
4948
return CAPIO_POSIX_SYSCALL_SKIP;
5049
}
@@ -75,8 +74,7 @@ int dup3_handler(long arg0, long arg1, long arg2, long arg3, long arg4, long arg
7574
bool is_cloexec = (flags & O_CLOEXEC) == O_CLOEXEC;
7675
dup_capio_fd(tid, fd, res, is_cloexec);
7776

78-
*result = res;
79-
return CAPIO_POSIX_SYSCALL_SUCCESS;
77+
return posix_return_value(res, result);
8078
}
8179
return CAPIO_POSIX_SYSCALL_SKIP;
8280
}

‎capio-posix/handlers/fork.hpp‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -14,14 +14,13 @@ int fork_handler(long arg0, long arg1, long arg2, long arg3, long arg4, long arg
1414

1515
if (pid == 0) {
1616
// child
17-
auto child_tid = static_cast<pid_t>(syscall_no_intercept(SYS_gettid));
17+
const auto child_tid = static_cast<pid_t>(syscall_no_intercept(SYS_gettid));
1818
init_process(child_tid);
1919
*result = 0;
20-
} else {
21-
*result = pid;
20+
return posix_return_value(0, result);
2221
}
2322

24-
return CAPIO_POSIX_SYSCALL_SUCCESS;
23+
return posix_return_value(pid, result);
2524
}
2625

2726
#endif // SYS_fork

‎capio-posix/handlers/mkdir.hpp‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@
77
inline off64_t capio_mkdirat(int dirfd, const std::string_view &pathname, mode_t mode, pid_t tid) {
88
START_LOG(tid, "call(dirfd=%d, pathname=%s, mode=%o)", dirfd, pathname.data(), mode);
99

10-
if (is_forbidden_path(pathname)) {
10+
if (!is_capio_path(pathname)) {
1111
LOG("Path %s is forbidden: skip", pathname.data());
1212
return CAPIO_POSIX_SYSCALL_REQUEST_SKIP;
1313
}

‎capio-posix/handlers/open.hpp‎

Lines changed: 19 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,7 @@ int creat_handler(long arg0, long arg1, long arg2, long arg3, long arg4, long ar
4040
mode_t mode = static_cast<int>(arg2);
4141
START_LOG(tid, "call(path=%s, flags=%d, mode=%d)", pathname.data(), flags, mode);
4242

43-
if (is_forbidden_path(pathname)) {
43+
if (!is_capio_path(pathname)) {
4444
LOG("Path %s is forbidden: skip", pathname.data());
4545
return CAPIO_POSIX_SYSCALL_REQUEST_SKIP;
4646
}
@@ -52,7 +52,12 @@ int creat_handler(long arg0, long arg1, long arg2, long arg3, long arg4, long ar
5252
LOG("Create request sent");
5353
}
5454

55-
int fd = static_cast<int>(syscall_no_intercept(SYS_creat, arg0, arg1, arg2, arg3, arg4, arg5));
55+
const int fd =
56+
static_cast<int>(syscall_no_intercept(SYS_creat, arg0, arg1, arg2, arg3, arg4, arg5));
57+
58+
if (fd < 0) {
59+
return CAPIO_POSIX_SYSCALL_ERRNO;
60+
}
5661

5762
LOG("fd=%d", fd);
5863

@@ -61,8 +66,7 @@ int creat_handler(long arg0, long arg1, long arg2, long arg3, long arg4, long ar
6166
add_capio_fd(tid, path, fd, 0, (flags & O_CLOEXEC) == O_CLOEXEC);
6267
}
6368

64-
*result = fd;
65-
return CAPIO_POSIX_SYSCALL_SUCCESS;
69+
return posix_return_value(fd, result);
6670
}
6771
#endif // SYS_creat
6872

@@ -76,7 +80,7 @@ int open_handler(long arg0, long arg1, long arg2, long arg3, long arg4, long arg
7680

7781
std::string path = compute_abs_path(pathname.data(), -1);
7882

79-
if (is_forbidden_path(pathname) || !is_capio_path(path)) {
83+
if (!is_capio_path(pathname)) {
8084
LOG("Path %s is not a capio path: skip", pathname.data());
8185
return CAPIO_POSIX_SYSCALL_REQUEST_SKIP;
8286
}
@@ -95,13 +99,15 @@ int open_handler(long arg0, long arg1, long arg2, long arg3, long arg4, long arg
9599

96100
const int fd =
97101
static_cast<int>(syscall_no_intercept(SYS_open, arg0, arg1, arg2, arg3, arg4, arg5));
102+
if (fd < 0) {
103+
return CAPIO_POSIX_SYSCALL_ERRNO;
104+
}
98105

99106
LOG("Adding capio path");
100107
add_capio_fd(tid, resolved_path, fd, 0, (flags & O_CLOEXEC) == O_CLOEXEC);
101108
LOG("fd=%d", fd);
102109

103-
*result = fd;
104-
return CAPIO_POSIX_SYSCALL_SUCCESS;
110+
return posix_return_value(fd, result);
105111
}
106112
#endif // SYS_open
107113

@@ -116,7 +122,7 @@ int openat_handler(long arg0, long arg1, long arg2, long arg3, long arg4, long a
116122
mode);
117123

118124
std::string path = compute_abs_path(pathname.data(), dirfd);
119-
if (is_forbidden_path(pathname) || !is_capio_path(path)) {
125+
if (!is_capio_path(pathname)) {
120126
LOG("Path %s is not a capio path: skip", pathname.data());
121127
return CAPIO_POSIX_SYSCALL_REQUEST_SKIP;
122128
}
@@ -138,11 +144,14 @@ int openat_handler(long arg0, long arg1, long arg2, long arg3, long arg4, long a
138144
static_cast<int>(syscall_no_intercept(SYS_openat, arg0, arg1, arg2, arg3, arg4, arg5));
139145
LOG("fd=%d", fd);
140146

147+
if (fd < 0) {
148+
return CAPIO_POSIX_SYSCALL_ERRNO;
149+
}
150+
141151
LOG("Adding resolved capio path (%s)", resolved_path.c_str());
142152
add_capio_fd(tid, resolved_path, fd, 0, (flags & O_CLOEXEC) == O_CLOEXEC);
143153

144-
*result = fd;
145-
return CAPIO_POSIX_SYSCALL_SUCCESS;
154+
return posix_return_value(fd, result);
146155
}
147156
#endif // SYS_openat
148157

‎capio-posix/handlers/posix_readdir.hpp‎

Lines changed: 0 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -179,14 +179,6 @@ inline struct dirent64 *capio_internal_readdir(DIR *dirp, long pid) {
179179
DIR *opendir(const char *name) {
180180
START_LOG(capio_syscall(SYS_gettid), "call(path=%s)", name);
181181

182-
if (is_forbidden_path(name)) {
183-
LOG("Path %s is forbidden: skip", name);
184-
syscall_no_intercept_flag = true;
185-
auto res = real_opendir(name);
186-
syscall_no_intercept_flag = false;
187-
return res;
188-
}
189-
190182
auto absolute_path = capio_absolute(name);
191183

192184
LOG("Resolved absolute path = %s", absolute_path.c_str());

‎capio-posix/handlers/read.hpp‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -19,14 +19,14 @@ inline off64_t capio_read_fs(int fd, size_t count, pid_t tid) {
1919
inline off64_t capio_read_mem(int fd, size_t count, void *buffer, long *result) {
2020
START_LOG(capio_syscall(SYS_gettid), "call(fd=%d, count=%ld)", fd, count);
2121
if (exists_capio_fd(fd)) {
22-
auto computed_offset = get_capio_fd_offset(fd) + count;
22+
const auto computed_offset = get_capio_fd_offset(fd) + count;
2323

2424
LOG("Handling read on file %s up to byte %ld", get_capio_fd_path(fd).c_str(),
2525
computed_offset);
2626

27-
*result = read_request_cache_mem->read(fd, buffer, count);
28-
LOG("Result of read is %lu", *result);
29-
return CAPIO_POSIX_SYSCALL_SUCCESS;
27+
const auto res = read_request_cache_mem->read(fd, buffer, count);
28+
LOG("Result of read is %lu", res);
29+
return posix_return_value(res, result);
3030
}
3131
return CAPIO_POSIX_SYSCALL_REQUEST_SKIP;
3232
}

0 commit comments

Comments
 (0)