syd 3.54.1

//
// Syd: rock-solid application kernel
// src/workers/run.rs: `syd_main' ptrace(2) thread
//
// Copyright (c) 2024, 2025, 2026 Ali Polatel <alip@chesswob.org>
// Based in part upon rusty_pool which is:
//     Copyright (c) Robin Friedli <robinfriedli@icloud.com>
//     SPDX-License-Identifier: Apache-2.0
//
// SPDX-License-Identifier: GPL-3.0

use std::{
    os::fd::{AsRawFd, RawFd},
    sync::{
        atomic::{AtomicBool, Ordering},
        Arc, RwLock,
    },
};

use concurrent_queue::PushError;
use libseccomp::{scmp_cmp, ScmpAction, ScmpFilterContext};
use nix::{
    errno::Errno,
    unistd::{Gid, Pid, Uid},
};

use crate::{
    compat::{safe_wait_all, WaitStatus},
    config::*,
    confine::{
        confine_scmp_close, confine_scmp_close_range, confine_scmp_execveat,
        confine_scmp_getdents64, confine_scmp_ioctl_pty, confine_scmp_ioctl_syd, confine_scmp_kill,
        confine_scmp_madvise, confine_scmp_open, confine_scmp_openat, confine_scmp_openat2,
        confine_scmp_pidfd_getfd, confine_scmp_pidfd_open, confine_scmp_pidfd_send_signal,
        confine_scmp_prctl, confine_scmp_ptrace, confine_scmp_read, confine_scmp_readlinkat,
        confine_scmp_setid, confine_scmp_sigaction, confine_scmp_statx, confine_scmp_sysinfo,
        confine_scmp_tgkill, confine_scmp_tkill, confine_scmp_waitid, confine_scmp_write_run,
        confine_scmp_wx_syd, SydNotifReq, Sydcall, SIGCANCEL, SIGSETXID, SIGTIMER,
    },
    cookie::safe_kill,
    err::SydResult,
    fd::SafeOwnedFd,
    info,
    kernel::ptrace::event::{fork::sysevent_fork, sig::sysevent_sig, sysx::sysevent_sysx},
    ptrace::{
        ptrace_cont, ptrace_get_syscall_info, ptrace_getevent, ptrace_listen, ptrace_skip_syscall,
    },
    sandbox::{LockState, Options, Sandbox, SandboxGuard},
    workers::WorkerCache,
};

pub(crate) struct Tracer {
    cache: Arc<WorkerCache>,
    sandbox: Arc<RwLock<Sandbox>>,
    should_exit: Arc<AtomicBool>,
    queue_wr_fd: Option<SafeOwnedFd>,
}

impl Tracer {
    pub(crate) fn new(
        cache: Arc<WorkerCache>,
        sandbox: Arc<RwLock<Sandbox>>,
        should_exit: Arc<AtomicBool>,
        queue_wr_fd: crate::fd::SafeOwnedFd,
    ) -> Self {
        Self {
            cache,
            sandbox,
            should_exit,
            queue_wr_fd: Some(queue_wr_fd),
        }
    }

    // Run the ptrace(2) loop. This is the main entry point.
    pub(crate) fn run(mut self, child_pid: Pid, wait_all: bool) -> SydResult<u8> {
        let mut xcode = None;

        loop {
            // Handle pending ptrace responses.
            self.handle_ptrace_responses();

            // Close pipe for Ghost mode to unblock emulators.
            if self.queue_wr_fd.is_some() && Sandbox::ghost_once() {
                self.cache.sysreq_queue.close();
                self.queue_wr_fd = None;
            }

            match safe_wait_all() {
                Ok(Some(status)) => {
                    self.handle_ptrace_responses();

                    if let Some(exit_code) = self.handle(child_pid, status, wait_all) {
                        xcode = Some(exit_code);
                        if !wait_all {
                            break;
                        }
                    }
                }
                Err(Errno::ECHILD) => break,
                Ok(None) => {}                          // siglongjmp fired.
                Err(Errno::EINTR | Errno::EAGAIN) => {} // emulator signaled.
                Err(errno) => return Err(errno.into()),
            };
        }

        // Inform other threads to exit and wake monitor.
        self.should_exit.store(true, Ordering::Release);
        self.cache.notify_mon();

        Ok(xcode.unwrap_or(127))
    }

    // Handle pending ptrace responses.
    fn handle_ptrace_responses(&self) {
        while let Ok(response) = self.cache.ptrace_resp.pop() {
            self.cache.handle_ptrace_response(response);
        }
    }

    // Push a ptrace event to queue for emulators to handle.
    fn push_ptrace_event(&mut self, req: SydNotifReq) {
        // Close pipe for Ghost mode.
        let is_ghost = Sandbox::ghost_once();
        if is_ghost && self.queue_wr_fd.is_some() {
            self.cache.sysreq_queue.close();
            self.queue_wr_fd = None;
        }

        // Push to queue for emulators to handle.
        if let Some(ref wr_fd) = self.queue_wr_fd {
            match self.cache.sysreq_queue.push(req) {
                Ok(()) => {
                    if self.cache.sysreq_queue.is_full() {
                        self.cache.notify_mon();
                    }
                    let _ = self.cache.notify_emu(wr_fd.as_raw_fd());
                }
                Err(PushError::Full(req)) => {
                    self.cache.notify_mon();
                    self.discard_request(req, is_ghost);
                }
                Err(PushError::Closed(req)) => {
                    self.discard_request(req, is_ghost);
                }
            }
        } else {
            self.discard_request(req, is_ghost);
        }
    }

    fn discard_request(&self, req: SydNotifReq, is_ghost: bool) {
        match req {
            SydNotifReq::PtraceScmp { pid, info } => {
                // sigreturn(2) must be terminated, except for Ghost mode.
                // FIXME: This can be used to circumvent SROP mitigations.
                if req.is_sigreturn() {
                    if is_ghost {
                        let _ = ptrace_cont(pid, None);
                    } else {
                        let _ = safe_kill(pid, libc::SIGKILL);
                    }
                    return;
                }

                // Deny syscall with EACCES (or ENOSYS if Ghost mode).
                let errno = if is_ghost {
                    Errno::ENOSYS
                } else {
                    Errno::EACCES
                };

                if let Err(err) = ptrace_skip_syscall(pid, info.arch, Some(errno)) {
                    if err != Errno::ESRCH {
                        let _ = safe_kill(pid, libc::SIGKILL);
                    }
                } else if cfg!(any(
                    target_arch = "mips",
                    target_arch = "mips32r6",
                    target_arch = "mips64",
                    target_arch = "mips64r6",
                    target_arch = "s390x"
                )) {
                    // MIPS/s390x: stop at syscall-exit to write return value.
                    if self.cache.add_error(pid, Some(errno)).is_err() {
                        let _ = safe_kill(pid, libc::SIGKILL);
                    }
                } else {
                    // Resume process after register modification.
                    let _ = ptrace_cont(pid, None);
                }
            }

            SydNotifReq::PtraceExit { pid, .. } => {
                if is_ghost {
                    // Ghost mode: Continue process.
                    let _ = ptrace_cont(pid, None);
                } else {
                    // Terminate process.
                    let _ = safe_kill(pid, libc::SIGKILL);
                }
            }

            SydNotifReq::PtraceExec { pid } => {
                // Terminate process.
                let _ = safe_kill(pid, libc::SIGKILL);
            }

            SydNotifReq::Seccomp(req) => unreachable!(
                "BUG: Tracer::discard_request called with seccomp request `{req:?}', report a bug!"
            ),
        }
    }

    fn handle(&mut self, cpid: Pid, status: WaitStatus, wait_all: bool) -> Option<u8> {
        match status {
            WaitStatus::Exited(pid, exit_code) => {
                let is_child = pid == cpid;

                // Handle child exit.
                self.handle_exit(pid, is_child, wait_all);

                if is_child {
                    return Some(exit_code.try_into().unwrap_or(127));
                }
            }
            WaitStatus::Signaled(pid, signal, _core) => {
                // Remove cache entries which belong to this TID/TGID.
                // pid is TID with trace/allow_unsafe_ptrace:0 (default).
                // pid is TGID with trace/allow_unsafe_ptrace:1.
                // del_tgid calls del_tid internally.
                self.cache.del_tgid(pid);

                if pid == cpid {
                    return Some(128_i32.saturating_add(signal).try_into().unwrap_or(128));
                }
            }
            WaitStatus::PtraceEvent(
                pid,
                libc::SIGSTOP | libc::SIGTSTP | libc::SIGTTIN | libc::SIGTTOU,
                libc::PTRACE_EVENT_STOP,
            ) => {
                // Use PTRACE_LISTEN to handle group-stop.
                let _ = ptrace_listen(pid);
            }
            WaitStatus::PtraceEvent(
                pid,
                _, // Can this ever be !SIGTRAP?,
                libc::PTRACE_EVENT_STOP,
            ) => {
                // ptrace-stop, do not forward the signal.
                let _ = ptrace_cont(pid, None);
            }
            WaitStatus::PtraceEvent(pid, sig, 0) => {
                sysevent_sig(pid, sig, &self.cache, &self.sandbox);
            }
            WaitStatus::PtraceEvent(pid, libc::SIGTRAP, libc::PTRACE_EVENT_SECCOMP) => {
                let info = match ptrace_get_syscall_info(pid) {
                    Ok(info) => info,
                    Err(Errno::ESRCH) => return None,
                    Err(_) => {
                        let _ = safe_kill(pid, libc::SIGKILL);
                        return None;
                    }
                };

                self.push_ptrace_event(SydNotifReq::PtraceScmp { pid, info });
            }
            WaitStatus::PtraceSyscall(pid) => {
                sysevent_sysx(pid, &self.cache, &self.sandbox);
            }
            WaitStatus::PtraceEvent(
                pid,
                libc::SIGTRAP,
                libc::PTRACE_EVENT_CLONE | libc::PTRACE_EVENT_FORK | libc::PTRACE_EVENT_VFORK,
            ) => {
                #[expect(clippy::cast_possible_truncation)]
                let child_pid = match ptrace_getevent(pid) {
                    Ok(p) => Pid::from_raw(p as libc::pid_t),
                    Err(Errno::ESRCH) => return None,
                    Err(_) => {
                        let _ = safe_kill(pid, libc::SIGKILL);
                        return None;
                    }
                };

                if let Some(response) = sysevent_fork(pid, child_pid, &self.sandbox) {
                    self.cache.handle_ptrace_response(response);
                }
            }
            WaitStatus::PtraceEvent(pid, libc::SIGTRAP, libc::PTRACE_EVENT_EXEC) => {
                self.push_ptrace_event(SydNotifReq::PtraceExec { pid });
            }
            WaitStatus::PtraceEvent(pid, libc::SIGTRAP, libc::PTRACE_EVENT_EXIT) => {
                #[expect(clippy::cast_possible_truncation)]
                let status = match ptrace_getevent(pid) {
                    Ok(status) => WaitStatus::from_raw(pid, status as i32),
                    Err(Errno::ESRCH) => return None,
                    Err(_) => {
                        let _ = safe_kill(pid, libc::SIGKILL);
                        return None;
                    }
                };

                self.push_ptrace_event(SydNotifReq::PtraceExit {
                    pid,
                    status,
                    wait_all,
                });
            }
            status => panic!("Unhandled wait event: {status:?}"),
        }

        None
    }

    fn handle_exit(&self, pid: Pid, is_child: bool, wait_all: bool) {
        // Remove cache entries which belong to this TID/TGID.
        // pid is TID with trace/allow_unsafe_ptrace:0 (default).
        // pid is TGID with trace/allow_unsafe_ptrace:1.
        // del_tgid calls del_tid internally.
        self.cache.del_tgid(pid);

        // We're done if:
        // (a) This is not the eldest process.
        // (b) trace/exit_wait_all is not set and we'll exit shortly.
        if !is_child || !wait_all {
            return;
        }

        // Lock sandbox immediately if we're in lock:exec.
        // The eldest child exited and sandbox can no longer
        // be edited. Let's assert that.
        let mut sandbox =
            SandboxGuard::Write(self.sandbox.write().unwrap_or_else(|err| err.into_inner()));
        if sandbox.lock == Some(LockState::Exec) {
            // Panic is the only option here on errors.
            #[expect(clippy::disallowed_methods)]
            sandbox
                .lock(LockState::Set)
                .expect("BUG: failed to lock sandbox, report a bug!");
        }
    }

    /// Prepare to confine the Tracer threads.
    #[expect(clippy::cognitive_complexity)]
    pub(crate) fn prepare_confine(
        options: Options,
        has_pid: bool,
        pty_fd: Option<RawFd>,
        queue_wr_fd: RawFd,
        transit_uids: &[(Uid, Uid)],
        transit_gids: &[(Gid, Gid)],
    ) -> SydResult<ScmpFilterContext> {
        let ssb = options.allow_unsafe_exec_speculative();
        let restrict_cookie = !options.allow_unsafe_nocookie();
        let safe_setuid = options.allow_safe_setuid();
        let safe_setgid = options.allow_safe_setgid();
        let safe_setid = safe_setuid || safe_setgid;

        let mut ctx = ScmpFilterContext::new(ScmpAction::KillProcess)?;

        // Enforce the NO_NEW_PRIVS functionality before
        // loading the seccomp filter into the kernel.
        ctx.set_ctl_nnp(true)?;

        // Disable Speculative Store Bypass mitigations
        // with trace/allow_unsafe_exec_speculative:1
        ctx.set_ctl_ssb(ssb)?;

        // DO NOT synchronize filter to all threads.
        // Thread pool confines itself as necessary.
        ctx.set_ctl_tsync(false)?;

        // We kill for bad system call and bad arch.
        ctx.set_act_badarch(ScmpAction::KillProcess)?;

        // Use a binary tree sorted by syscall number if possible.
        let _ = ctx.set_ctl_optimize(2);

        // Do NOT add supported architectures to the filter.
        // This ensures Syd can never run a non-native system call,
        // which we do not need at all.
        // seccomp_add_architectures(&mut ctx)?;

        // Prevent executable memory.
        confine_scmp_wx_syd(&mut ctx)?;

        // Deny open and {l,}stat with ENOSYS rather than KillProcess.
        confine_scmp_open(&mut ctx)?;

        // openat(2) may be used to open the parent directory only by getdir_long().
        confine_scmp_openat(&mut ctx)?;

        // openat2(2) may be used only with syscall argument cookies.
        confine_scmp_openat2(&mut ctx, restrict_cookie)?;

        // close(2) and close_range(2) may be used only with syscall argument cookies.
        confine_scmp_close(&mut ctx, restrict_cookie)?;
        confine_scmp_close_range(&mut ctx, restrict_cookie)?;

        // Allow reads up to 65536 bytes with cookies.
        confine_scmp_read(&mut ctx, 0x10000, restrict_cookie)?;

        // Allow writes to log fd and queue notification pipe.
        confine_scmp_write_run(&mut ctx, queue_wr_fd, restrict_cookie)?;

        // readlinkat(2) may only be used with syscall argument cookies.
        confine_scmp_readlinkat(&mut ctx, restrict_cookie)?;

        // statx(2) may only be used with syscall argument cookies.
        confine_scmp_statx(&mut ctx, restrict_cookie)?;

        // Allow safe madvise(2) advice.
        confine_scmp_madvise(&mut ctx)?;

        // waitid(2) may only be used with syscall argument cookies.
        confine_scmp_waitid(&mut ctx, restrict_cookie)?;

        // Allow safe fcntl(2) utility calls.
        for sysname in ["fcntl", "fcntl64"] {
            let syscall = match Sydcall::from_name(sysname) {
                Ok(syscall) => syscall,
                Err(_) => {
                    info!("ctx": "confine", "op": "allow_run_syscall",
                        "msg": format!("invalid or unsupported syscall {sysname}"));
                    continue;
                }
            };

            // TODO: Figure out what fcntl(2) ops are needed for KCOV.
            if cfg!(feature = "kcov") {
                ctx.add_rule(ScmpAction::Allow, syscall)?;
                continue;
            }

            for op in MAIN_FCNTL_OPS {
                ctx.add_rule_conditional(ScmpAction::Allow, syscall, &[scmp_cmp!($arg1 == *op)])?;
            }
        }

        let prctl_ops = MAIN_PRCTL_OPS.iter().chain(if safe_setid {
            MAIN_PRCTL_OPS_SAFESETID.iter()
        } else {
            [].iter()
        });

        // Allow safe prctl(2) operations.
        confine_scmp_prctl(&mut ctx, prctl_ops)?;

        // Allow ioctl(2) request PROCMAP_QUERY to lookup proc_pid_maps(5) efficiently.
        // This request is new in Linux-6.11.
        confine_scmp_ioctl_syd(&mut ctx, restrict_cookie, None /*seccomp_fd*/)?;

        // Allow ioctl(2) request TCSETS2 on saved stdin fd for PTY restore.
        if let Some(fd) = pty_fd {
            confine_scmp_ioctl_pty(&mut ctx, fd, restrict_cookie)?;
        }

        // Deny installing new signal handlers for {rt_,}sigaction(2).
        confine_scmp_sigaction(&mut ctx)?;

        // Allow execveat(2) with AT_EXECVE_CHECK for Linux>=6.14.
        confine_scmp_execveat(&mut ctx, restrict_cookie)?;

        // 1. getdents64(2), sysinfo(2) may be used only with syscall argument cookies.
        // 2. getdents64(2) is used by PID sandboxing to readdir proc(5).
        // 3. sysinfo(2) is used by PID sandboxing to get number of processes.
        if has_pid {
            confine_scmp_getdents64(&mut ctx, restrict_cookie)?;
            confine_scmp_sysinfo(&mut ctx, restrict_cookie)?;
        }

        // pidfd family system calls may be used only with syscall argument cookies.
        confine_scmp_pidfd_getfd(&mut ctx, restrict_cookie)?;
        confine_scmp_pidfd_open(&mut ctx, restrict_cookie)?;
        confine_scmp_pidfd_send_signal(&mut ctx, restrict_cookie)?;

        // kill(2) may be used only with syscall argument cookies.
        confine_scmp_kill(&mut ctx, &[libc::SIGKILL], restrict_cookie)?;

        // Signal allowlist for tkill(2) and tgkill(2):
        // 1. Allow 0 for existence checks.
        // 2. Allow libc internal signals for thread cancellation and timers.
        // 3. SIGSETXID is only needed when SafeSetID is enabled.
        if safe_setid {
            let sigs = [SIGCANCEL, SIGTIMER, SIGSETXID];
            confine_scmp_tkill(&mut ctx, &sigs)?;
            confine_scmp_tgkill(&mut ctx, &sigs)?;
        } else {
            let sigs = [SIGCANCEL, SIGTIMER];
            confine_scmp_tkill(&mut ctx, &sigs)?;
            confine_scmp_tgkill(&mut ctx, &sigs)?;
        }

        // ptrace(2) may be used only with syscall argument cookies.
        confine_scmp_ptrace(&mut ctx, restrict_cookie)?;

        // Allow safe system calls.
        //
        // KCOV_SYSCALLS is empty in case `kcov` feature is disabled.
        // PROF_SYSCALLS is empty in case `prof` feature is disabled.
        for sysname in MAIN_SYSCALLS
            .iter()
            .chain(ALLOC_SYSCALLS)
            .chain(FUTEX_SYSCALLS)
            .chain(GETID_SYSCALLS)
            .chain(KCOV_SYSCALLS)
            .chain(PROF_SYSCALLS)
            .chain(VDSO_SYSCALLS)
        {
            if let Ok(syscall) = Sydcall::from_name(sysname) {
                ctx.add_rule(ScmpAction::Allow, syscall)?;
            } else {
                info!("ctx": "confine", "op": "allow_run_syscall",
                    "msg": format!("invalid or unsupported syscall {sysname}"));
            }
        }

        // Allow UID/GID changing system calls as necessary.
        if safe_setid {
            confine_scmp_setid(
                "main",
                &mut ctx,
                safe_setuid,
                safe_setgid,
                transit_uids,
                transit_gids,
            )?;
        }

        Ok(ctx)
    }
}