Userland: Add LibSystem and funnel all syscalls through it

This achieves two things:

- Programs can now intentionally perform arbitrary syscalls by calling
  syscall(). This allows us to work on things like syscall fuzzing.

- It restricts the ability of userspace to make syscalls to a single
  4KB page of code. In order to call the kernel directly, an attacker
  must now locate this page and call through it.
This commit is contained in:
Andreas Kling 2021-02-05 12:16:30 +01:00
parent 4df3a34bc2
commit e87eac9273
Notes: sideshowbarker 2024-07-18 22:34:58 +09:00
47 changed files with 164 additions and 47 deletions

View file

@ -140,6 +140,7 @@ add_link_options(--sysroot ${CMAKE_BINARY_DIR}/Root)
include_directories(Userland/Libraries/LibC)
include_directories(Userland/Libraries/LibM)
include_directories(Userland/Libraries/LibSystem)
include_directories(Userland/Services)
include_directories(Userland)
include_directories(${CMAKE_CURRENT_BINARY_DIR})

View file

@ -504,7 +504,6 @@ inline uintptr_t invoke(Function function, T1 arg1, T2 arg2, T3 arg3)
#define __ENUMERATE_SYSCALL(x) using Syscall::SC_##x;
ENUMERATE_SYSCALLS(__ENUMERATE_SYSCALL)
#undef __ENUMERATE_SYSCALL
#define syscall Syscall::invoke
}

View file

@ -32,7 +32,6 @@
#include <AK/Format.h>
#include <AK/LexicalPath.h>
#include <AK/MappedFile.h>
#include <Kernel/API/Syscall.h>
#include <LibELF/AuxiliaryVector.h>
#include <LibELF/Image.h>
#include <LibELF/Validation.h>
@ -53,6 +52,7 @@
#include <sys/stat.h>
#include <sys/time.h>
#include <sys/uio.h>
#include <syscall.h>
#include <termios.h>
#include <unistd.h>

View file

@ -10,11 +10,12 @@ set(ELF_SOURCES ${ELF_SOURCES} ../Libraries/LibELF/Arch/i386/plt_trampoline.S)
file(GLOB LIBC_SOURCES1 "../Libraries/LibC/*.cpp")
file(GLOB LIBC_SOURCES2 "../Libraries/LibC/*/*.cpp")
file(GLOB LIBC_SOURCES3 "../Libraries/LibC/*.S")
file(GLOB LIBSYSTEM_SOURCES "../Libraries/LibSystem/*.cpp")
list(FILTER LIBC_SOURCES1 EXCLUDE REGEX ".+crt0.cpp")
list(FILTER LIBC_SOURCES1 EXCLUDE REGEX ".+crt0.+.cpp")
set(SOURCES ${LOADER_SOURCES} ${AK_SOURCES} ${ELF_SOURCES} ${LIBC_SOURCES1} ${LIBC_SOURCES2} ${LIBC_SOURCES3})
set(SOURCES ${LOADER_SOURCES} ${AK_SOURCES} ${ELF_SOURCES} ${LIBC_SOURCES1} ${LIBC_SOURCES2} ${LIBC_SOURCES3} ${LIBSYSTEM_SOURCES})
set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -fno-rtti -nostdlib -pie -fpic -DNO_TLS")

View file

@ -27,6 +27,7 @@ add_subdirectory(LibProtocol)
add_subdirectory(LibPthread)
add_subdirectory(LibRegex)
add_subdirectory(LibSymbolClient)
add_subdirectory(LibSystem)
add_subdirectory(LibTar)
add_subdirectory(LibTextCodec)
add_subdirectory(LibThread)

View file

@ -81,10 +81,10 @@ add_custom_command(
set(SOURCES ${LIBC_SOURCES} ${AK_SOURCES} ${ELF_SOURCES})
serenity_libc_static(LibCStatic c)
target_link_libraries(LibCStatic crt0 ssp)
add_dependencies(LibCStatic LibM)
target_link_libraries(LibCStatic crt0 ssp system)
add_dependencies(LibCStatic LibM LibSystem)
set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -static-libstdc++")
serenity_libc(LibC c)
target_link_libraries(LibC crt0 ssp)
add_dependencies(LibC LibM)
target_link_libraries(LibC crt0 ssp system)
add_dependencies(LibC LibM LibSystem)

View file

@ -24,12 +24,12 @@
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/
#include <Kernel/API/Syscall.h>
#include <assert.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/internals.h>
#include <syscall.h>
#include <unistd.h>
extern "C" {

View file

@ -26,7 +26,6 @@
#include <AK/Assertions.h>
#include <AK/StdLibExtras.h>
#include <Kernel/API/Syscall.h>
#include <dirent.h>
#include <errno.h>
#include <fcntl.h>
@ -34,6 +33,7 @@
#include <stdlib.h>
#include <string.h>
#include <sys/stat.h>
#include <syscall.h>
#include <unistd.h>
extern "C" {

View file

@ -24,11 +24,11 @@
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/
#include <Kernel/API/Syscall.h>
#include <errno.h>
#include <fcntl.h>
#include <stdarg.h>
#include <string.h>
#include <syscall.h>
extern "C" {

View file

@ -24,11 +24,11 @@
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/
#include <Kernel/API/Syscall.h>
#include <errno.h>
#include <stdarg.h>
#include <stdio.h>
#include <sys/ioctl.h>
#include <syscall.h>
extern "C" {

View file

@ -24,11 +24,11 @@
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/
#include <Kernel/API/Syscall.h>
#include <errno.h>
#include <mman.h>
#include <stdio.h>
#include <string.h>
#include <syscall.h>
extern "C" {

View file

@ -24,10 +24,10 @@
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/
#include <Kernel/API/Syscall.h>
#include <errno.h>
#include <poll.h>
#include <sys/time.h>
#include <syscall.h>
extern "C" {

View file

@ -24,9 +24,9 @@
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/
#include <Kernel/API/Syscall.h>
#include <errno.h>
#include <sched.h>
#include <syscall.h>
extern "C" {

View file

@ -24,10 +24,10 @@
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/
#include <Kernel/API/Syscall.h>
#include <errno.h>
#include <serenity.h>
#include <string.h>
#include <syscall.h>
extern "C" {

View file

@ -106,8 +106,8 @@ int anon_create(size_t size, int options);
int serenity_readlink(const char* path, size_t path_length, char* buffer, size_t buffer_size);
int getkeymap(char* name_buffer, size_t name_buffer_size, u32* map, u32* shift_map, u32* alt_map, u32* altgr_map, u32* shift_altgr_map);
int setkeymap(const char* name, const u32* map, u32* const shift_map, const u32* alt_map, const u32* altgr_map, const u32* shift_altgr_map);
int getkeymap(char* name_buffer, size_t name_buffer_size, uint32_t* map, uint32_t* shift_map, uint32_t* alt_map, uint32_t* altgr_map, uint32_t* shift_altgr_map);
int setkeymap(const char* name, const uint32_t* map, uint32_t* const shift_map, const uint32_t* alt_map, const uint32_t* altgr_map, const uint32_t* shift_altgr_map);
#ifdef __i386__
ALWAYS_INLINE void send_secret_data_to_userspace_emulator(uintptr_t data1, uintptr_t data2, uintptr_t data3)

View file

@ -25,12 +25,12 @@
*/
#include <AK/Format.h>
#include <Kernel/API/Syscall.h>
#include <assert.h>
#include <errno.h>
#include <setjmp.h>
#include <signal.h>
#include <string.h>
#include <syscall.h>
#include <unistd.h>
extern "C" {

View file

@ -24,12 +24,12 @@
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/
#include <Kernel/API/Syscall.h>
#include <assert.h>
#include <errno.h>
#include <stdio.h>
#include <string.h>
#include <sys/stat.h>
#include <syscall.h>
#include <unistd.h>
extern "C" {

View file

@ -30,7 +30,6 @@
#include <AK/ScopedValueRollback.h>
#include <AK/StdLibExtras.h>
#include <AK/kmalloc.h>
#include <Kernel/API/Syscall.h>
#include <assert.h>
#include <errno.h>
#include <fcntl.h>
@ -41,6 +40,7 @@
#include <sys/internals.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <syscall.h>
#include <unistd.h>
struct FILE {

View file

@ -30,7 +30,6 @@
#include <AK/StdLibExtras.h>
#include <AK/Types.h>
#include <AK/Utf8View.h>
#include <Kernel/API/Syscall.h>
#include <LibELF/AuxiliaryVector.h>
#include <alloca.h>
#include <assert.h>
@ -45,6 +44,7 @@
#include <sys/mman.h>
#include <sys/stat.h>
#include <sys/wait.h>
#include <syscall.h>
#include <unistd.h>
static void strtons(const char* str, char** endptr)

View file

@ -24,11 +24,11 @@
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/
#include <Kernel/API/Syscall.h>
#include <errno.h>
#include <stdarg.h>
#include <stdio.h>
#include <sys/prctl.h>
#include <syscall.h>
extern "C" {

View file

@ -25,9 +25,9 @@
*/
#include <AK/LogStream.h>
#include <Kernel/API/Syscall.h>
#include <errno.h>
#include <sys/ptrace.h>
#include <syscall.h>
extern "C" {

View file

@ -24,11 +24,11 @@
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/
#include <Kernel/API/Syscall.h>
#include <errno.h>
#include <stdio.h>
#include <sys/select.h>
#include <sys/time.h>
#include <syscall.h>
extern "C" {

View file

@ -25,12 +25,12 @@
*/
#include <AK/Assertions.h>
#include <Kernel/API/Syscall.h>
#include <errno.h>
#include <stdio.h>
#include <string.h>
#include <sys/socket.h>
#include <sys/uio.h>
#include <syscall.h>
extern "C" {

View file

@ -24,9 +24,9 @@
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/
#include <Kernel/API/Syscall.h>
#include <errno.h>
#include <sys/uio.h>
#include <syscall.h>
extern "C" {

View file

@ -24,9 +24,9 @@
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/
#include <Kernel/API/Syscall.h>
#include <assert.h>
#include <sys/wait.h>
#include <syscall.h>
#include <unistd.h>
extern "C" {

View file

@ -24,7 +24,6 @@
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/
#include <Kernel/API/Syscall.h>
#include <assert.h>
#include <errno.h>
#include <sys/ioctl.h>

View file

@ -27,13 +27,13 @@
#include <AK/String.h>
#include <AK/StringBuilder.h>
#include <AK/Time.h>
#include <Kernel/API/Syscall.h>
#include <assert.h>
#include <errno.h>
#include <stdio.h>
#include <string.h>
#include <sys/time.h>
#include <sys/times.h>
#include <syscall.h>
#include <time.h>
extern "C" {

View file

@ -24,9 +24,9 @@
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/
#include <Kernel/API/Syscall.h>
#include <errno.h>
#include <sys/times.h>
#include <syscall.h>
clock_t times(struct tms* buf)
{

View file

@ -27,7 +27,6 @@
#include <AK/ScopedValueRollback.h>
#include <AK/String.h>
#include <AK/Vector.h>
#include <Kernel/API/Syscall.h>
#include <alloca.h>
#include <assert.h>
#include <errno.h>
@ -42,6 +41,7 @@
#include <sys/ioctl.h>
#include <sys/mman.h>
#include <sys/types.h>
#include <syscall.h>
#include <termios.h>
#include <time.h>
#include <unistd.h>

View file

@ -24,9 +24,9 @@
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/
#include <Kernel/API/Syscall.h>
#include <errno.h>
#include <string.h>
#include <syscall.h>
#include <utime.h>
extern "C" {

View file

@ -24,9 +24,9 @@
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/
#include <Kernel/API/Syscall.h>
#include <errno.h>
#include <sys/utsname.h>
#include <syscall.h>
extern "C" {

View file

@ -33,7 +33,6 @@
#include <sys/mman.h>
#if defined(__serenity__)
# include <Kernel/API/Syscall.h>
# include <serenity.h>
#endif

View file

@ -25,7 +25,6 @@
*/
#ifdef __serenity__
# include <Kernel/API/Syscall.h>
# include <serenity.h>
#endif
#include <AK/ScopeGuard.h>

View file

@ -31,7 +31,6 @@
#include <AK/LexicalPath.h>
#include <AK/LogStream.h>
#include <AK/ScopeGuard.h>
#include <Kernel/API/Syscall.h>
#include <LibC/mman.h>
#include <LibC/stdio.h>
#include <LibC/sys/internals.h>
@ -45,6 +44,7 @@
#include <fcntl.h>
#include <string.h>
#include <sys/types.h>
#include <syscall.h>
namespace ELF {
@ -216,7 +216,7 @@ static NonnullRefPtr<DynamicLoader> commit_elf(const String& name)
auto object = loader->load_stage_3(RTLD_GLOBAL | RTLD_LAZY, g_total_tls_size);
ASSERT(object);
if (name.is_one_of("libc.so", "libpthread.so", "/bin/UserspaceEmulator")) {
if (name == "libsystem.so") {
if (syscall(SC_msyscall, object->base_address().as_ptr())) {
ASSERT_NOT_REACHED();
}

View file

@ -26,7 +26,6 @@
#include "CharacterMap.h"
#include <AK/StringBuilder.h>
#include <Kernel/API/Syscall.h>
#include <LibKeyboard/CharacterMapFile.h>
#ifndef KERNEL

View file

@ -4,5 +4,5 @@ set(SOURCES
)
serenity_libc(LibPthread pthread)
target_link_libraries(LibPthread LibC)
target_link_libraries(LibPthread LibC LibSystem)
target_include_directories(LibPthread PUBLIC ${CMAKE_CURRENT_SOURCE_DIR})

View file

@ -28,7 +28,6 @@
#include <AK/Atomic.h>
#include <AK/Debug.h>
#include <AK/StdLibExtras.h>
#include <Kernel/API/Syscall.h>
#include <limits.h>
#include <pthread.h>
#include <serenity.h>
@ -36,6 +35,7 @@
#include <stdio.h>
#include <string.h>
#include <sys/mman.h>
#include <syscall.h>
#include <time.h>
#include <unistd.h>

View file

@ -0,0 +1,7 @@
set(SOURCES
syscall.cpp
)
set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -nostdlib")
serenity_libc(LibSystem system)
target_include_directories(LibSystem PUBLIC ${CMAKE_CURRENT_SOURCE_DIR})

View file

@ -0,0 +1,51 @@
/*
* Copyright (c) 2021, Andreas Kling <kling@serenityos.org>
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions are met:
*
* 1. Redistributions of source code must retain the above copyright notice, this
* list of conditions and the following disclaimer.
*
* 2. Redistributions in binary form must reproduce the above copyright notice,
* this list of conditions and the following disclaimer in the documentation
* and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
* AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
* DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
* SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
* CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
* OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/
#include <Kernel/API/Syscall.h>
#include <LibSystem/syscall.h>
extern "C" {
uintptr_t syscall0(uintptr_t function)
{
return Syscall::invoke((Syscall::Function)function);
}
uintptr_t syscall1(uintptr_t function, uintptr_t arg0)
{
return Syscall::invoke((Syscall::Function)function, arg0);
}
uintptr_t syscall2(uintptr_t function, uintptr_t arg0, uintptr_t arg1)
{
return Syscall::invoke((Syscall::Function)function, arg0, arg1);
}
uintptr_t syscall3(uintptr_t function, uintptr_t arg0, uintptr_t arg1, uintptr_t arg2)
{
return Syscall::invoke((Syscall::Function)function, arg0, arg1, arg2);
}
}

View file

@ -0,0 +1,62 @@
/*
* Copyright (c) 2021, Andreas Kling <kling@serenityos.org>
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions are met:
*
* 1. Redistributions of source code must retain the above copyright notice, this
* list of conditions and the following disclaimer.
*
* 2. Redistributions in binary form must reproduce the above copyright notice,
* this list of conditions and the following disclaimer in the documentation
* and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
* AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
* DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
* SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
* CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
* OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/
#pragma once
#include <Kernel/API/Syscall.h>
#include <sys/types.h>
extern "C" {
uintptr_t syscall0(uintptr_t function);
uintptr_t syscall1(uintptr_t function, uintptr_t arg0);
uintptr_t syscall2(uintptr_t function, uintptr_t arg0, uintptr_t arg1);
uintptr_t syscall3(uintptr_t function, uintptr_t arg0, uintptr_t arg1, uintptr_t arg2);
}
#ifdef __cplusplus
inline uintptr_t syscall(auto function)
{
return syscall0(function);
}
inline uintptr_t syscall(auto function, auto arg0)
{
return syscall1((uintptr_t)function, (uintptr_t)arg0);
}
inline uintptr_t syscall(auto function, auto arg0, auto arg1)
{
return syscall2((uintptr_t)function, (uintptr_t)arg0, (uintptr_t)arg1);
}
inline uintptr_t syscall(auto function, auto arg0, auto arg1, auto arg2)
{
return syscall3((uintptr_t)function, (uintptr_t)arg0, (uintptr_t)arg1, (uintptr_t)arg2);
}
#endif

View file

@ -25,9 +25,9 @@
*/
#include <AK/Format.h>
#include <Kernel/API/Syscall.h>
#include <errno.h>
#include <stdio.h>
#include <syscall.h>
int main()
{

View file

@ -24,10 +24,10 @@
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/
#include <Kernel/API/Syscall.h>
#include <errno.h>
#include <stdio.h>
#include <sys/stat.h>
#include <syscall.h>
int main()
{

View file

@ -27,13 +27,13 @@
#include <AK/Function.h>
#include <AK/String.h>
#include <Kernel/API/Syscall.h>
#include <Kernel/IO.h>
#include <LibCore/ArgsParser.h>
#include <stdio.h>
#include <stdlib.h>
#include <sys/mman.h>
#include <sys/wait.h>
#include <syscall.h>
#pragma GCC optimize("O0")

View file

@ -32,7 +32,6 @@
#include <AK/NonnullOwnPtr.h>
#include <AK/StringBuilder.h>
#include <AK/kmalloc.h>
#include <Kernel/API/Syscall.h>
#include <LibC/sys/arch/i386/regs.h>
#include <LibCore/ArgsParser.h>
#include <LibCore/File.h>
@ -45,6 +44,7 @@
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <syscall.h>
#include <unistd.h>
static OwnPtr<Debug::DebugSession> g_debug_session;

View file

@ -24,7 +24,6 @@
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/
#include <Kernel/API/Syscall.h>
#include <LibCore/ArgsParser.h>
#include <serenity.h>
#include <stdio.h>

View file

@ -27,7 +27,6 @@
#include <AK/Assertions.h>
#include <AK/LogStream.h>
#include <AK/Types.h>
#include <Kernel/API/Syscall.h>
#include <LibC/sys/arch/i386/regs.h>
#include <LibCore/ArgsParser.h>
#include <LibCore/File.h>
@ -37,6 +36,7 @@
#include <string.h>
#include <sys/ptrace.h>
#include <sys/wait.h>
#include <syscall.h>
#include <unistd.h>
static int g_pid = -1;

View file

@ -24,13 +24,13 @@
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/
#include <Kernel/API/Syscall.h>
#include <errno.h>
#include <getopt.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <syscall.h>
#include <unistd.h>
#if !defined __ENUMERATE_SYSCALL