plsyssec / rlbox

RLBox sandboxing framework

RLBox

RLBox sandboxing framework. This code has been tested on 64-bit versions of Linux, Mac OSX, and Windows.

Reporting security bugs

If you find a security bug, please do not create a public issue. Instead, file a security bug on bugzilla using the following template link.

Using this library

RLBox is a general purpose sandboxing API that can be used to interact with library sandboxed with different backends --- WebAssembly, Native Client, OS processess, etc. Support for each backend is provided by a separate plugin that must also be downloaded separately.

See the online docs for more details.

The RLBox library is a header only library, so you can directly download this repo and use include the contents of code/include/ in your application. On Linux/Mac machines, you can optionally install the headers as well with make install.

Support for cmake's find_package API is also included (see this example).

Running the tests

1. Setup a build folder and then build.

   cmake -S . -B ./build -DCMAKE_BUILD_TYPE=Release

   You can build with cmake:

   cmake --build ./build --config Release --parallel

   or make:

   cd build && make -j

2. To test:

   With cmake:

   cd build && ctest -V

   or with make (on Linux/Mac):

   cd build && make test

   When running with ASAN and UBSAN:

   cd build && cmake -E env LSAN_OPTIONS=suppressions=../leak_suppressions.txt UBSAN_OPTIONS=suppressions=../ub_suppressions.txt ctest -V

Currently RLBox has been tested and should work with gcc-7 or later and clang-5, Visual Studio 2019 (possibly previous versions as well) or later. If you are using other compilers/compiler versions (like mingw), these may also be supported. Simply run the test suite and check that everything passes.

If you want to disable building tests, you can add -DBUILD_TESTING=OFF when invoking cmake the first time. This will also remove the Catch2 dependency.

cmake -S . -B ./build -DCMAKE_BUILD_TYPE=Release -DBUILD_TESTING=OFF

Install the library (Linux/Mac only)

The recommended use of RLBox is to make a copy of this library in your source tree. However, if you want to install the library, you can do so by following the below steps.

Configure the build with cmake in the same way that previous paragraph. Then simply run:

cd build
make install

Contributing Code

1. To contribute code, it is recommended you install clang-tidy which the build uses if available. Install using:

   On Ubuntu:

   sudo apt install clang-tidy

   On Arch Linux:

   sudo pacman -S clang-tidy

2. It is recommended you use the dev mode for building during development. This treat warnings as errors, enables clang-tidy checks, runs address sanitizer etc. Also, you probably want to use the debug build. To do this, adjust your build settings as shown below

   cmake -DCMAKE_BUILD_TYPE=Debug -DDEV=ON -S . -B ./build
   cd build
   make

3. After making changes to the source, add any new required tests and run all tests (as described earlier).

4. If you don't already have clang-format installed, install it:

   On Ubuntu:

   sudo apt install clang-format

   On Arch Linux:

   sudo pacman -S clang-format

5. Format code with the format-source target:

   cmake --build ./build --target format-source

6. Submit the pull request!

rlbox's Issues

Clean up sandbox_function_address to just return a tainted function pointer.

Add support for RLBox tainted_freezable types, to help prevent double fetch bugs

don't unregister callbacks automatically

In prio, we ran into a really awkward thing to debug:

tainted_prio<PrioNSSCtx*> nss = sandbox.malloc_in_sandbox<PrioNSSCtx>()
...
nss->NSS_IsInitialized = sandbox.register_callback(t_NSS_IsInitialized);  

eneded up getting unregister at the end of the function call.

We probably want to just manually do the unregistering and have a separate type for automatically unregistering callbacks.

Implement auto conversion of wrapper types to opaque

Do a pass with ubsan to check for safety issues, possibly in glue tests.

Pass to eliminate reinterpret_cast where possible

cmake format-source not a target in release build

dev build has lots of warnings; we should probably allow formatting source in resease builds too

Improve error message when sandbox argument to sandbox_invoke is missing

memcpy and malloc_in_sandbox documentation

It would be useful to document this a bit better.

For memcpy: the last parameter the number of elements, right? The type makes it seem like that is indeed the case; since this is different from POSIX memcpy which takes the number of bytes, we should be clear about this.

For malloc: it's again the length of elements not bytes, right? (no argument = 1?)

I can update docs on ACK.

Do a warnings cleanup pass on code when compiling for Arch Linux

expose sandbox created?

For prio, it would be useful to check if the sandbox has been created and create it if not. I know that we can only expose a sandbox.is_created() that may have concurrency concerns, but maybe that's still better than nothing? Maybe not though and the right things is to just keep track of this outside rlbox. WDYT?

comparing integers of different signs

In Prio, I"m getting a warning about int vs. size_t comparison here:

https://github.com/PLSysSec/rlbox_sandboxing_api/blob/master/code/include/rlbox_stdlib.hpp#L152-L154

In general we probably want to avoid this

example should guard against null string pointer

I was trying out the "hello world" example in rlbox, and wanted to confirm that it guards against the library returning garbage. When I changed call_cb() in mylib.c to invoke cb(NULL), running hello crashed with a segfault.

As far as I can tell, the example doesn't seem to properly guard against the library function call_cb passing a null string to the cb() callback, in the verifier that hello_cb() passes to copy_and_verify_string.

It would be good if the example showed what kinds of library mis-behavior the validators guard against (maybe I'm confused about NULL being a misbehavior that rlbox is guarding against?), and/or guard against the library returning a null string pointer.

Make test optional

This will remove catch2 dependency. This could be done by adding a symbol -DNO_TEST for example.

I can do it if you want.

Cannot build against glibc 2.34 with _DYNAMIC_STACK_SIZE_SOURCE

As of glibc 2.34, MINSIGSTKSZ is mapped to a sysconf(_SC_SIGSTKSZ) i.e. it's a dynamic value. This fails the constexpr guards in catch2.

/usr/bin/c++  -I/rlbox_sandboxing_api/code/tests/rlbox_glue -I/rlbox_sandboxing_api/_build/_deps/catch2-src/single_include -I/rlbox_sandboxing_api/code/include -I/rlbox_sandboxing_api/code/tests/rlbox_glue/lib -std=c++17 -MD -MT CMakeFiles/test_rlbox_glue.dir/code/tests/test_main.cpp.o -MF CMakeFiles/test_rlbox_glue.dir/code/tests/test_main.cpp.o.d -o CMakeFiles/test_rlbox_glue.dir/code/tests/test_main.cpp.o -c /rlbox_sandboxing_api/code/tests/test_main.cpp
In file included from /usr/include/signal.h:328,
                 from /rlbox_sandboxing_api/_build/_deps/catch2-src/single_include/catch2/catch.hpp:7644,
                 from /rlbox_sandboxing_api/code/tests/test_main.cpp:2:
/rlbox_sandboxing_api/_build/_deps/catch2-src/single_include/catch2/catch.hpp:10376:58: error: call to non-'constexpr' function 'long int sysconf(int)'
10376 |     constexpr static std::size_t sigStackSize = 32768 >= MINSIGSTKSZ ? 32768 : MINSIGSTKSZ;
      |                                                          ^~~~~~~~~~~
In file included from /usr/include/bits/sigstksz.h:24,
                 from /usr/include/signal.h:328,
                 from /rlbox_sandboxing_api/_build/_deps/catch2-src/single_include/catch2/catch.hpp:7644,
                 from /rlbox_sandboxing_api/code/tests/test_main.cpp:2:
/usr/include/unistd.h:640:17: note: 'long int sysconf(int)' declared here
  640 | extern long int sysconf (int __name) __THROW;
      |                 ^~~~~~~

I suppose this is an upstream bug, but wanted to report it here in case anyone else had the same issue.

Add support for double fetch detection mode

Add support for standard int types (uint32_t, size_t etc.) for appropriate conversion

Provide useful error message/add support when invoke variadic function calls

This is currently unsupported as there are tricky ABI issues for plugins that are not noop sandbox. Provide a helpful error message for this/add support for this

Add testing and swizzling of function pointers without context

Try compacting signature of convert_base_types_t_helper by passing parameters as a struct

Make the test suite compile error testing more robust by using a custom exception type

Broken link to documentation

This repo's README.md contains the sentence

See the online docs for more details.

with a link to https://docs.rlbox.dev/. This link points to a site that doesn't exist (404).

Steps to reproduce:

1. Click on the link from the README.

Expected results:
A website with documentation for this project opens.

Actual results:

404 – There isn't a GitHub Pages site here.

Steps required for Windows support?

Can we track windows support here?

Remove function casting used in callbacks to support tainted_opaque callback parameters

rlbox_noop_sandbox should be self sufficient

Add support for threading

Add support for RLBox helper types like stack_arr or heap_arr

copy_and_verify_string of unsigned char*

Can we add a copy_and_verify_string for unsigned char*?

Implement the implicit type conversions for wrapper types, such as tainted<foo*> converts to tainted<void*> etc

Minor cleanup

After reading some part of the library, I noticed some minor change with ABI break.

1. unverified_safe_because is template<size_t N> but N is never used.

Another declaration could be:

inline auto unverified_safe_because(const char *reason)

2. const -> static constexpr

The library is explicitly c++17. There is lots of const int CompileErrorCode = 42; that could be replaced by static constexpr int CompileErrorCode = 42;

3. in #define helper_create_converted_field, isFrozen is unused

So new declaration could be:

#define helper_create_converted_field(fieldType, fieldName)

4. Finally a question: the library is explicitly not thread-safe.

So why there is a std::mutex callback_lock, RLBOX_SHARED_LOCK, RLBOX_ACQUIRE_SHARED_GUARD and RLBOX_ACQUIRE_UNIQUE_GUARD? Is this a try to make a thread-safe library?

Thanks,

PS: If you're fine with these changes, I can implement them.

Create non const operators such as pre,post increment (++, --), arithmetic assignment (+=, -= etc) for tainted numerics and pointers

Website URL has been squatted?

Tried going to https://rlbox.dev/ and it has an SSL error or shows a squatted page.

RLBox v2: Include method to call function pointer

Wasm plugin checks the indirect function table to check type and pointer validity. NaCl plugin is a NoOp

! operator on tainted bool automatically unwraps it

rlbox/code/include/rlbox.hpp

Lines 464 to 467 in 2ffb438

	else if_constexpr_named(cond2, std::is_same_v<std::remove_cv_t<T>, bool>)
	{
	return impl() == false;
	}

This should return a tainted bool.