Case studies of sandboxing base system with Capsicum - Mariusz Zaborski
Channel: EuroBSDcon
Date: 2019-10-16

Description:

Background

Capsicum is a sandbox framework in the FreeBSD operating systems
and it’s based on the capabilities concept. Programs running in a sandbox
don’t have access to any global namespaces (such as fillesytem or network
namespace). Last year was very productive for Capsicum. More people got
involved in the project and new interesting features were developed. However,
most importantly a lot of applications from base systems were sandboxed.
Research

With a growing number of sandboxed applications we also recognized
new kinds of problems. Some of them we’ve already managed to solve. The
FreeBSD community was able to sandbox around 22 new applications re-
cently, but it’s still long way from sandboxing all of them.

One of the thing we noticed during that process is a large chunk of code
which we needed to rewrite multiple times in different programs. To simplify
the use of this framework we introduced Capsicum helpers, a small C header
of few inline functions which allows to reduce repeating parts of codes. One
of very common thing is to limit standard output and input descriptors,
this forces us to copy paste around 15 lines of code. Thanks to simple API
1we are able to limit it to 2 lines of code. The header
provides us also more grainy API for every descriptor:

- caph_limit_stdio
- caph_limit_stdout
- caph_limit_stdin
- caph_limit_stderr

As well as generic function caph_limit_stream which can limit any descriptor
provided. All those function are limiting descriptor to the most common ioctl
and capability rights.

Capsicum helpers also provides a few functions which allows to cache some
common used data. For example localtime need to read once /etc/localtime.
If localtime function is called after entering sandbox then function will get bad
time. The caph_cache_tzdata function was introduced to cache time zones
files. One of the reasons of collecting such functions is also documenting for
developers which things need to be cached before entering Capsicum.
A very common problem of Capsicum is silent failures. When sandbox
is added to an application, a developer cannot notice some conditions of
program. For example if an application is using a library and this library
is using random number generator by opening /dev/random if possible and
otherwise use some insecure random generator. If a developer will not no-
tice this behavior by analyzing the code this can lead to introducing new
bugs while snadboxing application. One way is to use ktrace infrastructure
but this also can be unnoticed by developer. Due to the new debugging
feature for Capsicum which was implemented by Konstantin Belousov un-
der FreeBSD foundation sponsorship. Enabling procctl(PROC_TRAPCAP)
(per-process) or sysctl kern.trap_enocap (globally in the system) kernel will
issue SIGTRAP to generate a core dump or enter the debugger incited of
returning ENOTCAPABLE or ECAPMODE.

Some sandboxed applications had very interesting stories, like dd. One
of the problem we encountered was that dd is a build tool. Another one was
the problem which overrating stderr descriptor. Case studies of sandboxing
applications like that can be very educational for future developers.

Summary

Last year was crucial for the Capsicum community. My presentation
will focus on the past year of development of Capsicum framework. We
introduced a few interesting features (like Capsicum helper or new debugging
infrastructure). FreeBSD got a few new sandboxed applications, some of
them, like dd, has a very interesting history that are worth presenting.

Speaker biography:

Mariusz Zaborski is a software developer at WHEEL Systems and student at
Warsaw University of Technology.
Mariusz’s main ares of interest are OS security and low-level
programming. At Wheel Systems, Mariusz is developing a solution to
monitor, record and control traffic in an IT infrastructure.

He has been involved in the development of Capsicum and Casper since
Google Summer of Code 2013, which he successfully passed under
the mentorship of Paweł Jakub Dawidek.

Mariusz has been a FreeBSD project commiter since 2015.