exile.hpp: do_clone(): free stack memory

README.md

@@ -1,22 +1,137 @@
 # exile.h
-`exile.h` is a header-only library, enabling processes to easily isolate themselves on Linux for exploit mitigation. exile.h wants to make existing technologies, such as Seccomp and Linux Namespaces, easier to use. Those generally
+`exile.h` is a header-only library, enabling processes to easily isolate themselves on Linux for exploit mitigation purposes. exile.h wants to make existing technologies, such as Seccomp and Linux Namespaces, easier to use. Those generally
 require knowledge of details and are not trivial for developers to employ, which prevents a more widespread adoption.
 
-The following section gives small quick examples. Then the motivation is explained in more detail.
+The following section offers small examples. Then the motivation is explained in more detail.
 Proper API documentation will be maintained in other files.
 
 ## Quick demo
-TODO This section will demonstrate the simplicity of the API, but only serves as an overview.
+This section quickly demonstrates the simplicity of the API. It serves as an overview to get
+a first impression.
+
+system() is used to keep the example C code short. It also demonstrates that subprocesses are also subject to restrictions imposed by exile.h.
+
+While the example show different features separately, it is generally possible to combine those.
 
 ### Filesystem isolation
+```c
+#include "exile.h"
+#include <assert.h>
+int main(void)
+{
+	system("echo test > /home/user/testfile");
+	struct exile_policy *policy = exile_init_policy();
+	exile_append_path_policies(policy, EXILE_FS_ALLOW_ALL_READ, "/home/user");
+	exile_append_path_policies(policy, EXILE_FS_ALLOW_ALL_READ | EXILE_FS_ALLOW_ALL_WRITE, "/tmp");
+	int ret = exile_enable_policy(policy);
+	if(ret != 0)
+	{
+		exit(EXIT_FAILURE);
+	}
+	int fd = open("/home/user/test", O_CREAT | O_WRONLY | O_TRUNC, 0600);
+	assert(fd == -1);
+	fd = open("/home/user/testfile", O_RDONLY);
+	//use fd
+	assert(fd != -1);
+	fd = open("/tmp/testfile", O_CREAT | O_WRONLY | O_TRUNC, 0600);
+	//use fd
+	assert(fd != -1);
+	return 0;
+}
+```
 
-
+The assert() calls won't be fired, consistent with the policy.
 
 ### System call policies / vows
+exile.h allows specifying which syscalls are permitted or denied. In the folloing example,
+ls is never executed, as the specificed "vows" do not allow the execve() system call. The
+process will be killed.
 
+```c
+#include "exile.h"
+
+int main(void)
+{
+	struct exile_policy *policy = exile_init_policy();
+	policy->vow_promises = exile_vows_from_str("stdio rpath wpath cpath");
+	exile_enable_policy(policy);
+	printf("Trying to execute...");
+	execlp("/bin/ls", "ls", "/", NULL);
+}
+```
+
+### Isolation from network
+exile offers a quick way to isolate a process from the default network namespace.
+
+```c
+#include "exile.h"
+
+int main(void)
+{
+	struct exile_policy *policy = exile_init_policy();
+	policy->namespace_options |= EXILE_UNSHARE_NETWORK;
+	int ret = exile_enable_policy(policy);
+	if(ret != 0)
+	{
+		exit(EXIT_FAILURE);
+	}
+	system("curl -I https://evil.tld");
+}
+```
+Produces ```curl: (6) Could not resolve host: evil.tld```. For example, this is useful for subprocesses which do not need
+network access, but perform tasks such as parsing user-supplied file formats.
 
 ### Isolation of single functions
-exile_launch() demo
+Currently, work is being done that hopefully will allow isolation of individual function calls in a mostly pain-free manner.
+
+Consider the following C++ code:
+```cpp
+#include <iostream>
+#include <fstream>
+#include "exile.hpp"
+std::string cat(std::string path)
+{
+	std::fstream f1;
+	f1.open(path.c_str(), std::ios::in);
+	std::string content;
+	std::string line;
+	while(getline(f1, line)) {
+		content += line + "\n";
+	}
+	return content;
+}
+
+int main(void)
+{
+	struct exile_policy *policy = exile_init_policy();
+	policy->vow_promises = exile_vows_from_str("stdio rpath");
+
+	std::string content = exile_launch<std::string>(policy, cat, "/etc/hosts");
+	std::cout << content;
+
+	policy = exile_init_policy();
+	policy->vow_promises = exile_vows_from_str("stdio");
+
+	try
+	{
+	content = exile_launch<std::string>(policy, cat, "/etc/hosts");
+	std::cout << content;
+	}
+	catch(std::exception &e)
+	{
+		std::cout << "launch failure: " << e.what() << std::endl;
+	}
+}
+```
+
+We execute "cat()". The first call succeeds. In the second, we get an exception, because
+the subprocess "cat()" was launched in violated the policy (missing "rpath" vow). 
+
+Naturally, there is a performance overhead. Certain challenges remain, such as the fact
+that being executed in a subprocess, we operate on copies, so handling references
+is not something that has been given much thought. There is also the fact
+that clone()ing from threads opens a can of worms. Hence, exile_launch()
+is best avoided in multi-threaded contexts.
 
 ## Status
 No release yet, experimental, API is unstable, builds will break on updates of this library.
@@ -26,7 +141,7 @@ Currently, it's mainly evolving from the needs of my other projects.
 ## Motivation and Background
 exile.h unlocks existing Linux mechanisms to facilite isolation of processes from resources. Limiting the scope of what programs can do helps defending the rest of the system when a process gets under attacker's control (when classic mitigations such as ASLR etc. failed). To this end, OpenBSD has the pledge() and unveil() functions available. Those functions are helpful mitigation mechanisms, but such accessible ways are unfortunately not readily available on Linux. This is where exile.h steps in.
 
-Seccomp allows to restrict system calls available to a process and thus decrease the systems attack surface, but it generally is not easy to use. Requiring BPF filter instructions, you generally just can't make use of it right away. exile.h provides an API inspired by pledge(), building on top of seccomp. It also provides an interface to manually restrict the system calls that can be issued.
+Seccomp allows restricting the system calls available to a process and thus decrease the systems attack surface, but it generally is not easy to use. Requiring BPF filter instructions, you generally just can't make use of it right away. exile.h provides an API inspired by pledge(), building on top of seccomp. It also provides an interface to manually restrict the system calls that can be issued.
 
 Traditional methods employed to restrict file system access, like different uids/gids, chroot, bind-mounts, namespaces etc. may require administrator intervention, are perhaps only suitable
 for daemons and not desktop applications, or are generally rather involved. As a positive example, Landlock since 5.13  is a vast improvement to limit file system access of processes. It also greatly simplifies exile.h' implementation of fs isolation.
@@ -52,9 +167,8 @@ Way more examples can be given, but we can put it in simple words: A general pur
 
 
 ## What it's not
-A way for end users/administrators to restrict processes. In the future, a wrapper binary may be available to achieve this, but it generally aims for developers to bring sandboxing/isolation into their software, like web browsers do. This allows a more fine-grained approach, as the developers
-is more familiar with the software. Applying restrictions with solutions like AppArmor requires
-them to be present on the system and it's easy to break things this way.
+A way for end users/administrators to restrict processes. In the future, a wrapper binary may be available to achieve this, but it generally aims for developers to bring sandboxing/isolation into their software. This allows a more fine-grained approach, as the developers are more familiar with their software. Applying restrictions with solutions like AppArmor requires
+them to be present and installed on the system and it's easy to break things this way.
 
 Therefore, software should ideally be written with sandboxing in mind from the beginning.
 
@@ -77,7 +191,7 @@ TODO:
 ## Requirements
 Kernel >=3.17
 
-While mostly transparent to users of this API, kernel >= 5.13 is required to take advantage of Landlock and furthermore it depends on distro-provided kernels being reasonable and enabling it by default. In practise, this means that Landlock probably won't be used for now, and exile.h will use a combination of namespaces, bind mounts and chroot as fallbacks.
+While mostly transparent to users of this API, kernel >= 5.13 is required to take advantage of Landlock. Furthermore, it depends on distro-provided kernels being reasonable and enabling it by default. In practise, this means that Landlock probably won't be used for now, and exile.h will use a combination of namespaces, bind mounts and chroot as fallbacks.
 
 
 ## FAQ
@@ -87,13 +201,13 @@ While mostly transparent to users of this API, kernel >= 5.13 is required to tak
 
 No.
 
-### It doesn't work on Debian!
-
-You can thank a Debian-specific kernel patch for that. In the future,
-the library may check against that. Execute
+### It doesn't work on my Debian version!
+You can thank a Debian-specific kernel patch for that. Execute
 `echo 1 > /proc/sys/kernel/unprivileged_userns_clone` to disable that patch for now.
 
-### Examples
+Note that newer releases should not cause this problem any longer, as [explained](https://www.debian.org/releases/bullseye/amd64/release-notes/ch-information.en.html#linux-user-namespaces) in the Debian release notes.
+
+### Real-world usage
   - looqs: https://gitea.quitesimple.org/crtxcr/looqs
   - qswiki: https://gitea.quitesimple.org/crtxcr/qswiki
 

exile.c

@@ -274,10 +274,12 @@ static struct syscall_vow_map exile_vow_map[] =
 	{EXILE_SYS(sched_getattr), EXILE_SYSCALL_VOW_SCHED},
 	{EXILE_SYS(renameat2), EXILE_SYSCALL_VOW_CPATH},
 	{EXILE_SYS(getrandom), EXILE_SYSCALL_VOW_STDIO},
+	{EXILE_SYS(memfd_create), EXILE_SYSCALL_VOW_STDIO},
 	{EXILE_SYS(execveat), EXILE_SYSCALL_VOW_EXEC},
 	{EXILE_SYS(mlock2), EXILE_SYSCALL_VOW_STDIO},
 	{EXILE_SYS(copy_file_range), EXILE_SYSCALL_VOW_STDIO},
 	{EXILE_SYS(statx), EXILE_SYSCALL_VOW_RPATH},
+	{EXILE_SYS(rseq), EXILE_SYSCALL_VOW_THREAD},
 	{EXILE_SYS(clone3), EXILE_SYSCALL_VOW_CLONE},
 	{EXILE_SYS(close_range), EXILE_SYSCALL_VOW_STDIO},
 	{EXILE_SYS(openat2), EXILE_SYSCALL_VOW_RPATH|EXILE_SYSCALL_VOW_WPATH},
@@ -430,6 +432,7 @@ int get_vow_argfilter(long syscall, uint64_t vow_promises, struct sock_filter *f
 
 	struct exile_syscall_filter ioctl_filter[] = {
 		EXILE_SYSCALL_FILTER_LOAD_ARG(1),
+		{ EXILE_SYSCALL_VOW_IOCTL, EXILE_BPF_NO_MATCH_SET(TIOCSTI), 1 },
 		{ EXILE_SYSCALL_VOW_IOCTL, EXILE_BPF_RETURN_MATCHING, 1 },
 		{ EXILE_SYSCALL_VOW_STDIO, EXILE_BPF_MATCH(FIONREAD), 1},
 		{ EXILE_SYSCALL_VOW_STDIO, EXILE_BPF_MATCH(FIONBIO), 1},
@@ -643,7 +646,7 @@ int (exile_append_path_policies)(struct exile_policy *exile_policy, unsigned int
 		int fd = open(path, O_PATH);
 		if(fd == -1)
 		{
-			EXILE_LOG_ERROR("Failed to open the specified path: %s\n", strerror(errno));
+			EXILE_LOG_ERROR("Failed to open %s: %s\n", path, strerror(errno));
 			exile_policy->exile_flags |= EXILE_FLAG_ADD_PATH_POLICY_FAIL;
 			return -1;
 		}
@@ -851,7 +854,7 @@ static int create_chroot_dirs(const char *chroot_target_path, struct exile_path_
 		ret = mkpath(path_inside_chroot, 0700, baseisfile);
 		if(ret < 0)
 		{
-			EXILE_LOG_ERROR("Error creating directory structure while mounting paths to chroot. %s\n", strerror(errno));
+			EXILE_LOG_ERROR("Error creating directory structure %s while mounting paths to chroot: %s\n", path_inside_chroot, strerror(errno));
 			free(path_inside_chroot);
 			return ret;
 		}
@@ -1350,7 +1353,7 @@ static int check_policy_sanity(struct exile_policy *policy)
 		{
 			if(path_policy_needs_landlock(path_policy))
 			{
-				EXILE_LOG_ERROR("A path policy needs landlock, but landlock is not available. Fallback not possible\n");
+				EXILE_LOG_ERROR("A path policy (%s) needs landlock, but landlock is not available. Fallback not possible\n", path_policy->path);
 				return -1;
 			}
 			path_policy = path_policy->next;

exile.hpp

@@ -100,6 +100,7 @@ inline int do_clone(int (*clonefn)(void *), void *launcharg)
 	}
 	size_t size = rlimit.rlim_cur;
 	char *stack = (char *) calloc(1, size);
+	char *stackbegin = stack;
 	if(stack == NULL)
 	{
 		EXILE_LOG_ERROR("Failed to allocate stack memory for child\n");
@@ -110,6 +111,7 @@ inline int do_clone(int (*clonefn)(void *), void *launcharg)
 	ret = clone(clonefn, stack, 17 /* SIGCHLD */, launcharg);
 	int status = 0;
 	waitpid(ret, &status, __WALL);
+	free(stackbegin);
 	if(WIFEXITED(status))
 	{
 		return WEXITSTATUS(status);
@@ -119,7 +121,7 @@ inline int do_clone(int (*clonefn)(void *), void *launcharg)
 }
 
 template<typename T, typename U, typename ... Args>
-typename std::enable_if_t<std::is_trivially_copyable_v<T>, T> exile_launch(struct exile_policy *policy, U fn, Args && ... args)
+typename std::enable_if_t<std::is_trivially_copyable_v<T> && !std::is_pointer_v<T>, T> exile_launch(struct exile_policy *policy, U fn, Args && ... args)
 {
 	size_t mapsize = sizeof(T);
 	T * sharedbuf =  (T *) mmap(NULL, mapsize , PROT_READ | PROT_WRITE, MAP_SHARED | MAP_ANON, -1, 0);
@@ -145,7 +147,7 @@ typename std::enable_if_t<std::is_trivially_copyable_v<T>, T> exile_launch(struc
 
 
 template<typename T, typename U, typename ... Args>
-typename std::enable_if_t<!std::is_trivially_copyable_v<T> && std::is_copy_constructible_v<T>, T>
+typename std::enable_if_t<std::is_pointer_v<T> || (!std::is_trivially_copyable_v<T> && std::is_copy_constructible_v<T>), T>
 	exile_launch(struct exile_policy *policy, const std::function<size_t (const T &, char *, size_t)> &serializer, const std::function<T(const char *, size_t)> &deserializer, U fn, Args && ... args)
 {
 	size_t mapsize = EXILE_MMAP_SIZE;