23 using namespace clang;
29 enum Kind { NO_CHROOT, ROOT_CHANGED, JAIL_ENTERED };
31 bool isRootChanged(
intptr_t k) {
return k == ROOT_CHANGED; }
41 class ChrootChecker :
public Checker<eval::Call, check::PreCall> {
43 mutable std::unique_ptr<BuiltinBug> BT_BreakJail;
50 static void *getTag() {
55 bool evalCall(
const CallEvent &Call, CheckerContext &C)
const;
56 void checkPreCall(
const CallEvent &Call, CheckerContext &C)
const;
59 void evalChroot(
const CallEvent &Call, CheckerContext &C)
const;
60 void evalChdir(
const CallEvent &Call, CheckerContext &C)
const;
65 bool ChrootChecker::evalCall(
const CallEvent &Call, CheckerContext &C)
const {
66 if (Call.isCalled(Chroot)) {
70 if (Call.isCalled(Chdir)) {
78 void ChrootChecker::evalChroot(
const CallEvent &Call, CheckerContext &C)
const {
80 ProgramStateManager &Mgr = state->getStateManager();
84 state = Mgr.addGDM(state, ChrootChecker::getTag(), (
void*) ROOT_CHANGED);
85 C.addTransition(state);
88 void ChrootChecker::evalChdir(
const CallEvent &Call, CheckerContext &C)
const {
90 ProgramStateManager &Mgr = state->getStateManager();
93 const void *k = state->FindGDM(ChrootChecker::getTag());
98 const Expr *ArgExpr = Call.getArgExpr(0);
99 SVal ArgVal = C.getSVal(ArgExpr);
101 if (
const MemRegion *R = ArgVal.getAsRegion()) {
103 if (
const StringRegion* StrRegion= dyn_cast<StringRegion>(R)) {
106 state = Mgr.addGDM(state, ChrootChecker::getTag(),
107 (
void*) JAIL_ENTERED);
111 C.addTransition(state);
115 void ChrootChecker::checkPreCall(
const CallEvent &Call,
116 CheckerContext &C)
const {
118 if (Call.isCalled(Chroot) || Call.isCalled(Chdir))
122 void *
const* k = C.getState()->FindGDM(ChrootChecker::getTag());
125 if (ExplodedNode *N = C.generateNonFatalErrorNode()) {
127 BT_BreakJail.reset(
new BuiltinBug(
128 this,
"Break out of jail",
"No call of chdir(\"/\") immediately " 130 C.emitReport(llvm::make_unique<BugReport>(
131 *BT_BreakJail, BT_BreakJail->getDescription(), N));
135 void ento::registerChrootChecker(CheckerManager &mgr) {
136 mgr.registerChecker<ChrootChecker>();
139 bool ento::shouldRegisterChrootChecker(
const LangOptions &LO) {
IntrusiveRefCntPtr< const ProgramState > ProgramStateRef
Keeps track of the various options that can be enabled, which controls the dialect of C or C++ that i...
i32 captured_struct **param SharedsTy A type which contains references the shared variables *param Shareds Context with the list of shared variables from the p *TaskFunction *param Data Additional data for task generation like final * state
This class represents a description of a function call using the number of arguments and the name of ...
StringRef getString() const
This represents one expression.
__INTPTR_TYPE__ intptr_t
A signed integer type with the property that any valid pointer to void can be converted to this type...
Dataflow Directional Tag Classes.
StringLiteral - This represents a string literal expression, e.g.