setpgid-across-sessions-without-leader.cpp 9.7 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296
  1. /*
  2. * Copyright (c) 2020, Ben Wiederhake <BenWiederhake.GitHub@gmx.de>
  3. * All rights reserved.
  4. *
  5. * Redistribution and use in source and binary forms, with or without
  6. * modification, are permitted provided that the following conditions are met:
  7. *
  8. * 1. Redistributions of source code must retain the above copyright notice, this
  9. * list of conditions and the following disclaimer.
  10. *
  11. * 2. Redistributions in binary form must reproduce the above copyright notice,
  12. * this list of conditions and the following disclaimer in the documentation
  13. * and/or other materials provided with the distribution.
  14. *
  15. * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
  16. * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  17. * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
  18. * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
  19. * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  20. * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
  21. * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
  22. * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
  23. * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  24. * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  25. */
  26. #include <AK/Assertions.h>
  27. #include <AK/LogStream.h>
  28. #include <fcntl.h>
  29. #include <serenity.h>
  30. #include <stdio.h>
  31. #include <unistd.h>
  32. /*
  33. * Bug:
  34. * A process can join a process group across sessions if both process groups
  35. * do not have a leader (anymore). This can be used to join a session
  36. * illegitimately. (Or, more harmlessly, to change the own PGID to an unused
  37. * but arbitrary one, for example the PGID 0xDEADBEEF or the one that's going
  38. * to be your program's session ID in the short-term future.)
  39. *
  40. * So what needs to happen:
  41. * - There is session SA
  42. * - There is session SB
  43. * - There is a Process Group PGA in SA
  44. * - There is a Process Group PGB in SB
  45. * - PGA does not have a leader
  46. * - PGB does not have a leader
  47. * - There is a Process PA2 in PGA
  48. * - There is a Process PB2 in PGB
  49. * - PA2 calls setpgid(0, PGB)
  50. * - Now PA2 and PB2 are in the same processgroup, but not in the same session. WHAAAAT! :^)
  51. *
  52. * Here's how to demonstrate the bug:
  53. * - Time 0: PX forks into PA1
  54. * - Time 1: PA1 creates a new session (SA) and pgrp (PGA)
  55. * - Time 2: PA1 forks into PA2
  56. * - Time 3: PA1 dies (PGA now has no leader)
  57. * Note: PA2 never dies. Too much hassle.
  58. * - Time 4: PX forks into PB1
  59. * - Time 5: PB1 creates a new session (SB) and pgrp (PGB)
  60. * - Time 6: PB1 forks into PB2
  61. * - Time 7: PB1 dies (PGB now has no leader)
  62. * - Time 8: PB2 calls pgrp(0, PGA)
  63. * Note: PB2 writes "1" (exploit successful) or "0" (bug is fixed) to a pipe
  64. * - Time 9: If PX hasn't received any message yet through the pipe, it declares the test as failed (for lack of knowledge). Otherwise, it outputs accordingly.
  65. */
  66. static constexpr useconds_t STEP_SIZE = 1100000;
  67. static void fork_into(void (*fn)(void*), void* arg)
  68. {
  69. const pid_t rc = fork();
  70. if (rc < 0) {
  71. perror("fork");
  72. exit(1);
  73. }
  74. if (rc > 0) {
  75. const int disown_rc = disown(rc);
  76. if (disown_rc < 0) {
  77. perror("disown");
  78. dbg() << "This might cause PA1 to remain in the Zombie state, "
  79. "and thus in the process list, meaning the leader is "
  80. "still 'alive' for the purpose of lookup.";
  81. }
  82. return;
  83. }
  84. fn(arg);
  85. dbg() << "child finished (?)";
  86. exit(1);
  87. }
  88. static void sleep_steps(useconds_t steps)
  89. {
  90. const int rc = usleep(steps * STEP_SIZE);
  91. if (rc < 0) {
  92. perror("usleep");
  93. ASSERT_NOT_REACHED();
  94. }
  95. }
  96. static void run_pa1(void*);
  97. static void run_pa2(void*);
  98. static void run_pb1(void*);
  99. static void run_pb2(void*);
  100. int main(int, char**)
  101. {
  102. // This entire function is the entirety of process PX.
  103. // Time 0: PX forks into PA1
  104. int fds[2];
  105. // Serenity doesn't support O_NONBLOCK for pipes yet, so
  106. // sadly the test will hang if something goes wrong.
  107. if (pipe2(fds, 0) < 0) {
  108. perror("pipe");
  109. exit(1);
  110. }
  111. dbg() << "PX starts with SID=" << getsid(0) << ", PGID=" << getpgid(0) << ", PID=" << getpid() << ".";
  112. dbg() << "PX forks into PA1";
  113. fork_into(run_pa1, nullptr);
  114. sleep_steps(4);
  115. // Time 4: PX forks into PB1
  116. dbg() << "PX forks into PB1";
  117. fork_into(run_pb1, &(fds[1]));
  118. sleep_steps(5);
  119. // Time 9: If PX hasn't received any message yet through the pipe, it declares
  120. // the test as failed (for lack of knowledge). Otherwise, it outputs accordingly.
  121. dbg() << "PX reads from pipe";
  122. unsigned char buf = 42;
  123. ssize_t rc = read(fds[0], &buf, 1);
  124. if (rc == 0) {
  125. // In fact, we only reach this branch when *all* processes have died,
  126. // including this one. So … should be unreachable.
  127. printf("DOUBLE FAIL: pipe is closed, but we still have it open.\n"
  128. "See debug log, some process probably crashed.\n");
  129. exit(1);
  130. }
  131. if (rc < 0) {
  132. if (errno == EAGAIN) {
  133. printf("FAIL: pipe has no data. See debug log, some process os probably hanging.\n");
  134. } else {
  135. perror("read (unknown)");
  136. }
  137. exit(1);
  138. }
  139. ASSERT(rc == 1);
  140. if (buf == 0) {
  141. printf("PASS\n");
  142. return 0;
  143. }
  144. if (buf == 1) {
  145. printf("FAIL (exploit successful)\n");
  146. return 1;
  147. }
  148. printf("FAIL, for some reason %c\n", buf);
  149. return 1;
  150. }
  151. static void run_pa1(void*)
  152. {
  153. // Time 0: PX forks into PA1
  154. sleep_steps(1);
  155. // Time 1: PA1 creates a new session (SA) and pgrp (PGA)
  156. dbg() << "PA1 starts with SID=" << getsid(0) << ", PGID=" << getpgid(0) << ", PID=" << getpid() << ".";
  157. dbg() << "PA1 calls setsid()";
  158. int rc = setsid();
  159. if (rc < 0) {
  160. perror("setsid (PA)");
  161. ASSERT_NOT_REACHED();
  162. }
  163. dbg() << "PA1 did setsid() -> PGA=" << rc << ", SA=" << getsid(0) << ", yay!";
  164. sleep_steps(1);
  165. // Time 2: PA1 forks into PA2
  166. dbg() << "PA1 forks into PA2";
  167. fork_into(run_pa2, nullptr);
  168. sleep_steps(1);
  169. // Time 3: PA1 dies (PGA now has no leader)
  170. dbg() << "PA1 dies. You should see a 'Reaped unparented process' "
  171. "message with my ID next, OR THIS TEST IS MEANINGLESS "
  172. "(see fork_into()).";
  173. exit(0);
  174. }
  175. static void run_pa2(void*)
  176. {
  177. // Time 2: PA1 forks into PA2
  178. dbg() << "PA2 starts with SID=" << getsid(0) << ", PGID=" << getpgid(0) << ", PID=" << getpid() << ".";
  179. sleep_steps(18);
  180. // pa_2 never *does* anything.
  181. dbg() << "PA2 dies from boredom.";
  182. exit(1);
  183. }
  184. static void run_pb1(void* pipe_fd_ptr)
  185. {
  186. // Time 4: PX forks into PB1
  187. sleep_steps(1);
  188. // Time 5: PB1 creates a new session (SB) and pgrp (PGB)
  189. dbg() << "PB1 starts with SID=" << getsid(0) << ", PGID=" << getpgid(0) << ", PID=" << getpid() << ".";
  190. dbg() << "PB1 calls setsid()";
  191. int rc = setsid();
  192. if (rc < 0) {
  193. perror("setsid (PB)");
  194. ASSERT_NOT_REACHED();
  195. }
  196. dbg() << "PB1 did setsid() -> PGB=" << rc << ", SB=" << getsid(0) << ", yay!";
  197. sleep_steps(1);
  198. // Time 6: PB1 forks into PB2
  199. dbg() << "PB1 forks into PB2";
  200. fork_into(run_pb2, pipe_fd_ptr);
  201. sleep_steps(1);
  202. // Time 7: PB1 dies (PGB now has no leader)
  203. dbg() << "PB1 dies. You should see a 'Reaped unparented process' "
  204. "message with my ID next, OR THIS TEST IS MEANINGLESS "
  205. "(see fork_into()).";
  206. exit(0);
  207. }
  208. static void simulate_sid_from_pgid(pid_t pgid)
  209. {
  210. pid_t rc = getpgid(pgid); // Same confusion as in the Kernel
  211. int saved_errno = errno;
  212. if (rc < 0 && saved_errno == ESRCH) {
  213. dbg() << "The old get_sid_from_pgid(" << pgid << ") would return -1";
  214. } else if (rc >= 0) {
  215. dbg() << "FAIL: Process " << pgid << " still exists?! PGID is " << rc << ".";
  216. } else {
  217. perror("pgid (probably fail)");
  218. }
  219. }
  220. static void run_pb2(void* pipe_fd_ptr)
  221. {
  222. // Time 6: PB1 forks into PB2
  223. sleep_steps(2);
  224. // Time 8: PB2 calls pgrp(0, PGA)
  225. // Note: PB2 writes "1" (exploit successful) or "0" (bug is fixed) to a pipe
  226. dbg() << "PB2 starts with SID=" << getsid(0) << ", PGID=" << getpgid(0) << ", PID=" << getpid() << ".";
  227. dbg() << "PB2 calls pgrp(0, PGA)";
  228. int pga = getpid() - 3;
  229. dbg() << "PB2: Actually, what is PGA? I guess it's " << pga << "?";
  230. simulate_sid_from_pgid(pga);
  231. int rc = setpgid(0, pga);
  232. unsigned char to_write = 123;
  233. if (rc == 0) {
  234. dbg() << "PB2: setgpid SUCCESSFUL! CHANGED PGROUP!";
  235. to_write = 1;
  236. } else {
  237. ASSERT(rc == -1);
  238. switch (errno) {
  239. case EACCES:
  240. dbg() << "PB2: Failed with EACCES. Huh?!";
  241. to_write = 101;
  242. break;
  243. case EINVAL:
  244. dbg() << "PB2: Failed with EINVAL. Huh?!";
  245. to_write = 102;
  246. break;
  247. case ESRCH:
  248. dbg() << "PB2: Failed with ESRCH. Huh?!";
  249. to_write = 103;
  250. break;
  251. case EPERM:
  252. dbg() << "PB2: Failed with EPERM. Aww, no exploit today :^)";
  253. to_write = 0;
  254. break;
  255. default:
  256. dbg() << "PB2: Failed with errno=" << errno << "?!";
  257. perror("setpgid");
  258. to_write = 104;
  259. break;
  260. }
  261. }
  262. dbg() << "PB2 ends with SID=" << getsid(0) << ", PGID=" << getpgid(0) << ", PID=" << getpid() << ".";
  263. int* pipe_fd = static_cast<int*>(pipe_fd_ptr);
  264. ASSERT(*pipe_fd);
  265. rc = write(*pipe_fd, &to_write, 1);
  266. if (rc != 1) {
  267. dbg() << "Wrote only " << rc << " bytes instead of 1?!";
  268. exit(1);
  269. }
  270. exit(0);
  271. }