ArchiveSandbox.hpp File Reference

Go to the source code of this file.

Classes
struct	SandboxExecResult

Functions
SandboxExecResult	run_archive_worker_bwrap (const std::string &worker_path, const std::string &input_path, int timeout_seconds)
ArchiveInspectionResult	analyze_archive_in_sandbox (const std::string &worker_path, const std::string &input_path, int timeout_seconds)

Function Documentation

analyze_archive_in_sandbox()

ArchiveInspectionResult analyze_archive_in_sandbox	(	const std::string &	worker_path,
		const std::string &	input_path,
		int	timeout_seconds )

Definition at line 390 of file ArchiveSandbox.cpp.

{
    ArchiveInspectionResult r;
 
    const auto exec = run_archive_worker_bwrap(worker_path, input_path, timeout_seconds);
 
    if (!exec.launched) {
        r.success = false;
        r.sandbox_failed = true;
        r.reason_code = "ARCHIVE_SANDBOX_LAUNCH_FAILED";
        r.detail = exec.stderr_text;
        return r;
    }
 
    if (exec.output_truncated) {
        r.success = false;
        r.sandbox_failed = true;
        r.reason_code = "ARCHIVE_SANDBOX_OUTPUT_LIMIT";
        r.detail = "archive worker exceeded output limit";
        return r;
    }
 
    if (exec.timed_out) {
        r.success = false;
        r.sandbox_timeout = true;
        r.reason_code = "ARCHIVE_SANDBOX_TIMEOUT";
        r.detail = "archive worker timeout";
        r.raw_json = exec.stdout_text;
        return r;
    }
 
    if (!exec.exited || exec.exit_code != 0) {
        r.success = false;
        r.sandbox_failed = true;
        r.reason_code = "ARCHIVE_SANDBOX_ANALYSIS_FAILED";
        r.detail = exec.stderr_text.empty() ? "archive worker failed" : exec.stderr_text;
        r.raw_json = exec.stdout_text;
        return r;
    }
 
    r.success = true;
    r.raw_json = exec.stdout_text;
    r.is_zip = json_has_true(exec.stdout_text, "is_zip");
    r.stored_size_mismatch = json_has_true(exec.stdout_text, "stored_size_mismatch");
    r.header_mismatch = json_has_true(exec.stdout_text, "header_mismatch");
    r.invalid_offset = json_has_true(exec.stdout_text, "invalid_offset");
    r.overlapping_entries = json_has_true(exec.stdout_text, "overlapping_entries");
    r.nested_archive = json_has_true(exec.stdout_text, "nested_archive");
    r.risk_score = json_read_int(exec.stdout_text, "risk_score", 0);
    r.reason_code = json_read_string(exec.stdout_text, "reason_code");
    r.detail = json_read_string(exec.stdout_text, "detail");
 
    const std::string risk = json_read_string(exec.stdout_text, "risk");
    if (risk == "EVASIVE") {
        r.risk = ArchiveRisk::EVASIVE;
    } else if (risk == "MALFORMED") {
        r.risk = ArchiveRisk::MALFORMED;
    } else if (risk == "SUSPICIOUS") {
        r.risk = ArchiveRisk::SUSPICIOUS;
    } else {
        r.risk = ArchiveRisk::CLEAN;
    }
 
    return r;
}

References analyze_archive_in_sandbox(), CLEAN, EVASIVE, anonymous_namespace{ArchiveSandbox.cpp}::json_has_true(), anonymous_namespace{ArchiveSandbox.cpp}::json_read_int(), anonymous_namespace{ArchiveSandbox.cpp}::json_read_string(), MALFORMED, run_archive_worker_bwrap(), and SUSPICIOUS.

Referenced by analyze_archive_in_sandbox(), and ArchiveInspector::inspect().

run_archive_worker_bwrap()

SandboxExecResult run_archive_worker_bwrap	(	const std::string &	worker_path,
		const std::string &	input_path,
		int	timeout_seconds )

Definition at line 171 of file ArchiveSandbox.cpp.

{
    SandboxExecResult result;
 
    if (!fs::exists(worker_path) || !fs::is_regular_file(worker_path)) {
        result.stderr_text = "invalid worker_path";
        return result;
    }
 
    if (!fs::exists(input_path) || !fs::is_regular_file(input_path)) {
        result.stderr_text = "invalid input_path";
        return result;
    }
 
    char tmp_template[] = "/tmp/bastionguard-archive-XXXXXX";
    char* tmp_dir = ::mkdtemp(tmp_template);
    if (!tmp_dir) {
        result.stderr_text = "mkdtemp failed";
        return result;
    }
 
    const fs::path sandbox_root(tmp_dir);
    const fs::path work_dir = sandbox_root / "work";
    std::error_code ec;
    fs::create_directories(work_dir, ec);
    if (ec) {
        result.stderr_text = "create_directories failed";
        fs::remove_all(sandbox_root, ec);
        return result;
    }
 
    int out_pipe[2] = {-1, -1};
    int err_pipe[2] = {-1, -1};
 
    if (::pipe(out_pipe) != 0 || ::pipe(err_pipe) != 0) {
        result.stderr_text = "pipe failed";
        for (int fd : {out_pipe[0], out_pipe[1], err_pipe[0], err_pipe[1]}) {
            if (fd >= 0) ::close(fd);
        }
        fs::remove_all(sandbox_root, ec);
        return result;
    }
 
    const pid_t pid = ::fork();
    if (pid < 0) {
        result.stderr_text = "fork failed";
        ::close(out_pipe[0]);
        ::close(out_pipe[1]);
        ::close(err_pipe[0]);
        ::close(err_pipe[1]);
        fs::remove_all(sandbox_root, ec);
        return result;
    }
 
    if (pid == 0) {
        ::close(out_pipe[0]);
        ::close(err_pipe[0]);
 
        ::dup2(out_pipe[1], STDOUT_FILENO);
        ::dup2(err_pipe[1], STDERR_FILENO);
 
        ::close(out_pipe[1]);
        ::close(err_pipe[1]);
 
        set_worker_rlimits();
 
        std::vector<std::string> args = {
        "bwrap",
        "--die-with-parent",
        "--new-session",
        "--unshare-ipc",
        "--unshare-pid",
        "--unshare-uts",
        "--unshare-cgroup-try",
        "--proc", "/proc",
        "--dev", "/dev",
        "--ro-bind", "/usr", "/usr",
        "--ro-bind", "/bin", "/bin",
        "--ro-bind", "/lib", "/lib",
        "--ro-bind", "/lib64", "/lib64",
        "--tmpfs", "/tmp",
        "--dir", "/work",
        "--ro-bind", input_path, "/work/input.zip",
        "--ro-bind", worker_path, "/worker",
        "--chdir", "/work",
        "--setenv", "HOME", "/tmp",
        "--setenv", "TMPDIR", "/tmp",
        "/worker",
        "/work/input.zip"
    };
 
        std::vector<char*> argv;
        argv.reserve(args.size() + 1);
        for (auto& s : args) {
            argv.push_back(s.data());
        }
        argv.push_back(nullptr);
 
        ::execvp("bwrap", argv.data());
        _exit(127);
    }
 
    result.launched = true;
 
    ::close(out_pipe[1]);
    ::close(err_pipe[1]);
 
    // Mettiamo entrambe le pipe in non-blocking così possiamo drenarle
    // mentre il child sta ancora girando. Se non lo facessimo, un child
    // che scrive più di PIPE_BUF si bloccherebbe su write() e non uscirebbe
    // mai -> deadlock fino al timeout.
    set_nonblocking(out_pipe[0]);
    set_nonblocking(err_pipe[0]);
 
    const auto start = std::chrono::steady_clock::now();
    bool child_done = false;
    int status = 0;
 
    bool out_eof = false;
    bool err_eof = false;
 
    const int effective_timeout = std::max(1, timeout_seconds);
    while (true) {
        // Se il child è già uscito E entrambe le pipe sono in EOF,
        // abbiamo finito.
        if (!child_done) {
            const pid_t w = ::waitpid(pid, &status, WNOHANG);
            if (w == pid) {
                child_done = true;
            } else if (w < 0 && errno != EINTR) {
                result.stderr_text = "waitpid failed";
                // Do not exit leaving an untracked child behind.
                ::kill(pid, SIGKILL);
                ::waitpid(pid, &status, 0);
                break;
            }
        }
 
        // Timeout: SIGKILL e reap sincrono.
        const auto now = std::chrono::steady_clock::now();
        const auto elapsed =
            std::chrono::duration_cast<std::chrono::seconds>(now - start).count();
        if (elapsed >= effective_timeout && (!child_done || !out_eof || !err_eof)) {
            // A forked grandchild may still own an output pipe after its
            // direct parent exits. Bound the entire operation, not only waitpid.
            result.timed_out = true;
            if (!child_done) {
                ::kill(pid, SIGKILL);
                ::waitpid(pid, &status, 0);
                child_done = true;
            }
            break;
        }
 
        // Drena le pipe disponibili (non-blocking).
        struct pollfd fds[2];
        int nfds = 0;
        if (!out_eof) { fds[nfds].fd = out_pipe[0]; fds[nfds].events = POLLIN; ++nfds; }
        if (!err_eof) { fds[nfds].fd = err_pipe[0]; fds[nfds].events = POLLIN; ++nfds; }
 
        if (nfds > 0) {
            // Poll breve: se il child non è ancora morto, controlliamo poi
            // waitpid al prossimo giro; se è morto, drenaiamo finché non c'è
            // più nulla da leggere.
            const int poll_timeout_ms = child_done ? 100 : 50;
            const int pr = ::poll(fds, nfds, poll_timeout_ms);
 
            if (pr > 0) {
                for (int i = 0; i < nfds; ++i) {
                    if (!(fds[i].revents & (POLLIN | POLLHUP | POLLERR))) continue;
 
                    bool eof_here = false;
                    if (fds[i].fd == out_pipe[0]) {
                        drain_fd_nonblocking(out_pipe[0], result.stdout_text, eof_here, result.output_truncated);
                        if (eof_here) out_eof = true;
                    } else if (fds[i].fd == err_pipe[0]) {
                        drain_fd_nonblocking(err_pipe[0], result.stderr_text, eof_here, result.output_truncated);
                        if (eof_here) err_eof = true;
                    }
                }
            }
            // pr == 0 (timeout poll) o pr < 0 con EINTR: proseguiamo il loop.
        }
 
        // Condizione di uscita: child morto e nessun ulteriore dato in arrivo.
        if (child_done && (out_eof || nfds == 0) && (err_eof || nfds == 0)) {
            break;
        }
 
        // Sanity: se non c'è più nulla da drenare ma il child non è morto,
        // aspettiamo un pochino per non bruciare CPU.
        if (!child_done && nfds == 0) {
            std::this_thread::sleep_for(std::chrono::milliseconds(50));
        }
    }
 
    // Drena residui (le EOF dovrebbero essere già arrivate, ma per sicurezza).
    if (!out_eof) { bool e; drain_fd_nonblocking(out_pipe[0], result.stdout_text, e, result.output_truncated); }
    if (!err_eof) { bool e; drain_fd_nonblocking(err_pipe[0], result.stderr_text, e, result.output_truncated); }
 
    ::close(out_pipe[0]);
    ::close(err_pipe[0]);
 
    if (child_done) {
        result.exited = true;
        if (WIFEXITED(status)) {
            result.exit_code = WEXITSTATUS(status);
        } else if (WIFSIGNALED(status)) {
            result.exit_code = 128 + WTERMSIG(status);
        }
    }
 
    fs::remove_all(sandbox_root, ec);
    return result;
}

References anonymous_namespace{ArchiveSandbox.cpp}::drain_fd_nonblocking(), SandboxExecResult::exit_code, SandboxExecResult::exited, SandboxExecResult::launched, SandboxExecResult::output_truncated, run_archive_worker_bwrap(), anonymous_namespace{ArchiveSandbox.cpp}::set_nonblocking(), anonymous_namespace{ArchiveSandbox.cpp}::set_worker_rlimits(), SandboxExecResult::stderr_text, SandboxExecResult::stdout_text, and SandboxExecResult::timed_out.

Referenced by analyze_archive_in_sandbox(), and run_archive_worker_bwrap().