syd 3.57.0

//
// Syd: rock-solid application kernel
// src/workers/aes.rs: `syd_aes' encryption thread
//
// Copyright (c) 2024, 2025, 2026 Ali Polatel <alip@chesswob.org>
//
// SPDX-License-Identifier: GPL-3.0

// SAFETY:
// 1. This module has (almost) been liberated from unsafe code.
//    SafeOwnedFd::from_raw_fd is used for crypt_fd which is unsafe.
//    Use deny rather than forbid so we can allow this case.
// 2. This module forbids arithmetic side effects, et al.
#![deny(unsafe_code)]
#![forbid(clippy::arithmetic_side_effects)]
#![forbid(clippy::cast_possible_truncation)]
#![forbid(clippy::cast_possible_wrap)]

use std::{
    fmt,
    mem::MaybeUninit,
    os::fd::{AsFd, FromRawFd, RawFd},
    sync::{
        atomic::{AtomicUsize, Ordering},
        Arc, Condvar, Mutex,
    },
    thread,
};

use ctr::cipher::{StreamCipher, StreamCipherSeek};
use hmac::Mac;
use libseccomp::{ScmpAction, ScmpFilterContext};
use nix::{
    errno::Errno,
    fcntl::{posix_fadvise, OFlag, PosixFadviseAdvice},
    sched::{unshare, CloneFlags},
    unistd::{gettid, lseek64, Gid, Pid, Uid, Whence},
};
use serde::{Serialize, Serializer};
use zeroize::Zeroizing;

#[cfg(target_arch = "x86")]
use crate::cookie::CookieIdx::Ftruncate64Arg3;
use crate::{
    alert,
    compat::seccomp_load,
    config::*,
    confine::{
        confine_scmp_clone, confine_scmp_clone3, confine_scmp_close, confine_scmp_fadvise,
        confine_scmp_fcntl, confine_scmp_ftruncate, confine_scmp_madvise, confine_scmp_open_stat,
        confine_scmp_prctl, confine_scmp_read, confine_scmp_setid, confine_scmp_sigaction,
        confine_scmp_write, confine_scmp_wx_syd, Sydcall,
    },
    cookie::safe_ftruncate64,
    err::{err2no, SydResult},
    error,
    fd::{closeexcept, seal_memfd_all, SafeOwnedFd},
    hash::{
        aes_ctr, hmac_sha256, AesKey, CryptKey, SydHashMap, BLOCK_SIZE, CRYPT_MAGIC_OFFSET,
        HMAC_TAG_SIZE, IV, SYD3_HDR_OFFSET, SYD3_HDR_SIZE,
    },
    id::SydId,
    info,
    io::{read_chunk, write_all},
    landlock::Errata,
    landlock_policy::LandlockPolicy,
    lookup::FileInfo,
    ofd::lock_fd,
    path::{XPath, XPathBuf},
    retry::{retry_on_eintr, retry_on_intr},
    sandbox::Options,
    sealbox::SealedSlice,
    xfmt,
};

#[derive(Debug, Copy, Clone, Eq, PartialEq, Ord, PartialOrd)]
pub(crate) enum AesMod {
    Read,
    Append,
    Write,
}

impl fmt::Display for AesMod {
    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
        match self {
            Self::Read => write!(f, "read"),
            Self::Append => write!(f, "append"),
            Self::Write => write!(f, "write"),
        }
    }
}

impl Serialize for AesMod {
    fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
    where
        S: Serializer,
    {
        serializer.serialize_str(&self.to_string())
    }
}

impl From<OFlag> for AesMod {
    fn from(flags: OFlag) -> Self {
        if flags.contains(OFlag::O_WRONLY) || flags.contains(OFlag::O_RDWR) {
            if flags.contains(OFlag::O_APPEND) {
                Self::Append
            } else {
                Self::Write
            }
        } else {
            Self::Read
        }
    }
}

#[derive(Clone)]
pub(crate) struct AesVal {
    pub(crate) crypt_fd: RawFd,
    pub(crate) enc_fd: RawFd,
    pub(crate) info: FileInfo,
    pub(crate) mode: AesMod,
    pub(crate) tid: Pid,
}

pub(crate) type AesMap = SydHashMap<XPathBuf, AesVal>;
pub(crate) type AesLock = Arc<(Mutex<AesMap>, Condvar)>;

pub(crate) struct AesFilter {
    bpf: SealedSlice<u8>,
    flags: libc::c_ulong,
}

impl AesFilter {
    pub(crate) fn new(bpf: SealedSlice<u8>, flags: libc::c_ulong) -> Self {
        Self { bpf, flags }
    }
}

pub(crate) struct AesConfig {
    keys: AesKey,
    filter: Option<Arc<AesFilter>>,
    memfd: bool,
}

impl AesConfig {
    pub(crate) fn new(keys: AesKey, filter: Option<Arc<AesFilter>>, memfd: bool) -> Self {
        Self {
            keys,
            filter,
            memfd,
        }
    }
}

struct AesGuard<'a> {
    files: &'a AesLock,
    pending: &'a AtomicUsize,
    path: XPathBuf,
    tid: Pid,
}

impl Drop for AesGuard<'_> {
    fn drop(&mut self) {
        let (aes_map, cvar) = &**self.files;
        let mut aes_map = aes_map.lock().unwrap_or_else(|e| e.into_inner());

        if aes_map
            .get(&self.path)
            .is_some_and(|val| val.tid == self.tid)
        {
            aes_map.remove(&self.path);
        }

        let was_last = self.pending.fetch_sub(1, Ordering::Release) == 1;
        drop(aes_map);

        if was_last {
            cvar.notify_all();
        }
    }
}

pub(crate) struct AesWorker {
    crypt_keys: AesKey,
    crypt_iv: IV,

    crypt_data: AesVal,
    crypt_path: XPathBuf,

    files: AesLock,
    filter: Option<Arc<AesFilter>>,

    memfd: bool,
    pending: Arc<AtomicUsize>,
}

impl AesWorker {
    pub(crate) fn prepare_confine(
        options: Options,
        transit_uids: &[(Uid, Uid)],
        transit_gids: &[(Gid, Gid)],
        _dry_run: bool,
    ) -> SydResult<ScmpFilterContext> {
        // Create seccomp(2) filter with default action.
        let mut ctx = ScmpFilterContext::new(ScmpAction::KillProcess)?;

        // Enforce the NO_NEW_PRIVS functionality before
        // loading the seccomp filter into the kernel.
        ctx.set_ctl_nnp(true)?;

        // Disable Speculative Store Bypass mitigations
        // with trace/allow_unsafe_exec_speculative:1.
        ctx.set_ctl_ssb(options.allow_unsafe_exec_speculative())?;

        // DO NOT synchronize filter to all threads.
        // Main thread will confine itself.
        ctx.set_ctl_tsync(false)?;

        // We kill for bad system call and bad arch.
        ctx.set_act_badarch(ScmpAction::KillProcess)?;

        // Use a binary tree sorted by syscall number if possible.
        let _ = ctx.set_ctl_optimize(2);

        // Syscall argument cookies may be disabled
        // at startup with trace/allow_unsafe_nocookie:1.
        let restrict_cookie = !options.allow_unsafe_nocookie();

        // Do NOT add supported architectures to the filter.
        // This ensures Syd can never run a non-native system call,
        // which we do not need at all.
        // seccomp_add_architectures(&mut ctx)?;

        // Prevent executable memory.
        confine_scmp_wx_syd(&mut ctx)?;

        // Deny open and stat family with ENOSYS rather than KillProcess.
        confine_scmp_open_stat(&mut ctx, true /* openat2 */, true /* statx */)?;

        // Allow reads up to IO_BUF_SIZE bytes
        let rw_max: u64 = IO_BUF_SIZE.try_into().or(Err(Errno::EOVERFLOW))?;
        confine_scmp_read(&mut ctx, rw_max, restrict_cookie)?;

        // Allow writes to log fd OR up to IO_BUF_SIZE bytes.
        confine_scmp_write(
            &mut ctx,
            Some(rw_max),
            false, /*log_only*/
            restrict_cookie,
        )?;

        // Allow clones without namespace flags.
        confine_scmp_clone(&mut ctx)?;
        // Deny clone3 with ENOSYS for compatibility.
        confine_scmp_clone3(&mut ctx)?;

        // Allow fadvise family syscalls.
        confine_scmp_fadvise(&mut ctx)?;

        // Allow safe madvise(2) advice.
        confine_scmp_madvise(&mut ctx)?;

        // ftruncate{,64}(2) may be used only with syscall argument cookies.
        confine_scmp_ftruncate(&mut ctx, restrict_cookie)?;

        // close(2) may be used only with syscall argument cookies.
        confine_scmp_close(&mut ctx, restrict_cookie)?;

        // Allow safe fcntl(2) utility calls.
        confine_scmp_fcntl(&mut ctx, AES_FCNTL_OPS)?;

        // Allow safe prctl(2) operations.
        confine_scmp_prctl(&mut ctx, AES_PRCTL_OPS)?;

        // Deny installing new signal handlers for {rt_,}sigaction(2).
        confine_scmp_sigaction(&mut ctx)?;

        // Allow safe system calls.
        for sysname in AES_SYSCALLS
            .iter()
            .chain(ALLOC_SYSCALLS)
            .chain(FUTEX_SYSCALLS)
            .chain(GETID_SYSCALLS)
            .chain(VDSO_SYSCALLS)
        {
            match Sydcall::from_name(sysname) {
                Ok(syscall) => {
                    ctx.add_rule(ScmpAction::Allow, syscall)?;
                }
                Err(_) => {
                    info!("ctx": "confine", "op": "allow_aes_syscall",
                        "msg": xfmt!("invalid or unsupported syscall {sysname}"));
                }
            }
        }

        // Allow UID/GID changing system calls as necessary.
        let safe_setuid = options.allow_safe_setuid();
        let safe_setgid = options.allow_safe_setgid();
        if safe_setuid || safe_setgid {
            confine_scmp_setid(
                "aes",
                &mut ctx,
                safe_setuid,
                safe_setgid,
                transit_uids,
                transit_gids,
            )?;
        }

        Ok(ctx)
    }

    pub(crate) fn try_spawn(
        cfg: &AesConfig,
        crypt_iv: IV,
        crypt_data: AesVal,
        crypt_path: &XPath,
        files: &AesLock,
        pending: &Arc<AtomicUsize>,
    ) -> Result<Pid, Errno> {
        let ready = Arc::new((Mutex::new(None::<Pid>), Condvar::new()));
        retry_on_intr(|| {
            let ready = Arc::clone(&ready);
            let worker = AesWorker {
                crypt_keys: Arc::clone(&cfg.keys),
                crypt_iv: crypt_iv.clone(),

                crypt_data: crypt_data.clone(),
                crypt_path: XPathBuf::try_from(crypt_path)?,

                files: Arc::clone(files),
                filter: cfg.filter.clone(),

                memfd: cfg.memfd,
                pending: Arc::clone(pending),
            };

            thread::Builder::new()
                .name(SydId::get_name("syd_aes").to_string())
                .stack_size(AES_STACK_SIZE)
                .spawn(move || {
                    if let Err(errno) =
                        Self::unshare(worker.crypt_data.crypt_fd, worker.crypt_data.enc_fd)
                    {
                        alert!("ctx": "boot", "op": "unshare_aes_thread",
                            "msg": xfmt!("failed to unshare AES fds: {errno}"),
                            "err": errno as i32);
                        std::process::exit(101);
                    }

                    // Notify parent emulator of our TID after unshare(2).
                    let mut worker = worker;
                    worker.crypt_data.tid = gettid();
                    let (lock, cvar) = &*ready;
                    {
                        let mut guard = lock.lock().unwrap_or_else(|e| e.into_inner());
                        *guard = Some(worker.crypt_data.tid);
                    }
                    cvar.notify_one();

                    // All done, enter main loop.
                    worker.run()
                })
                .map_err(|err| err2no(&err))
        })?;

        let (lock, cvar) = &*ready;
        {
            let mut guard = lock.lock().unwrap_or_else(|e| e.into_inner());
            loop {
                if let Some(tid) = *guard {
                    break Ok(tid);
                }
                guard = cvar.wait(guard).unwrap_or_else(|e| e.into_inner());
            }
        }
    }

    fn run(self) -> SydResult<()> {
        let AesWorker {
            crypt_keys,
            crypt_iv,

            crypt_data,
            crypt_path,

            files,
            filter,

            memfd,
            pending,
        } = self;

        if let Some(filter) = filter {
            // Set up a landlock(7) sandbox to disallow all access.
            let abi = crate::landlock::ABI::new_current();
            let errata = crate::landlock::Errata::query();
            let policy = LandlockPolicy {
                scoped_abs: true,
                scoped_sig: errata.contains(Errata::SCOPED_SIGNAL_SAME_TGID),
                ..Default::default()
            };
            let _ = policy.restrict_self(abi);

            // Filter is exported by monitor thread, and kept for Syd lifetime.
            if let Err(errno) = seccomp_load(&filter.bpf, filter.flags) {
                alert!("ctx": "boot", "op": "confine_aes_thread",
                    "msg": xfmt!("failed to confine AES thread: {errno}"),
                    "err": errno as i32);
                std::process::exit(101);
            }
        } else {
            error!("ctx": "confine", "op": "confine_aes_thread",
                "msg": "AES thread is running unconfined in debug mode");
        }

        // SAFETY: crypt_fd is a valid file descriptor.
        #[expect(unsafe_code)]
        let crypt_fd = unsafe { SafeOwnedFd::from_raw_fd(crypt_data.crypt_fd) };

        // AesGuard's Drop implementation cleans up.
        let _guard = AesGuard {
            files: &files,
            pending: &pending,
            path: crypt_path,
            tid: crypt_data.tid,
        };

        // Attempt to lock fd for write.
        // This will succeed once all readers are done reading.
        match retry_on_eintr(|| lock_fd(&crypt_fd, true, true)) {
            Ok(()) => Self::sync(&crypt_fd, &crypt_keys, crypt_iv, crypt_data, memfd),
            Err(errno) => Err(errno.into()),
        }
    }

    fn sync<Fd: AsFd>(
        crypt_fd: Fd,
        crypt_keys: &CryptKey,
        crypt_iv: IV,
        crypt_data: AesVal,
        memfd: bool,
    ) -> SydResult<()> {
        if memfd {
            // Seal memfd to ensure no further writes happen.
            seal_memfd_all(&crypt_fd)?;
        }

        let file_mode = crypt_data.mode;

        // SAFETY: crypt_data.enc_fd is a valid FD.
        #[expect(unsafe_code)]
        let enc_fd = unsafe { SafeOwnedFd::from_raw_fd(crypt_data.enc_fd) };

        // Nothing to do if file was readonly.
        let mut is_append = match file_mode {
            AesMod::Read => return Ok(()),
            AesMod::Append => true,
            _ => false,
        };

        // Handle truncation quickly.
        let data_size: u64 = lseek64(&crypt_fd, 0, Whence::SeekEnd)?
            .try_into()
            .or(Err(Errno::EOVERFLOW))?;
        if data_size == 0 {
            retry_on_eintr(|| safe_ftruncate64(&enc_fd, 0))?;
            return Ok(());
        }

        // Handle opened for append but encrypted file is new.
        let mut file_size: u64 = lseek64(&enc_fd, 0, Whence::SeekEnd)?
            .try_into()
            .or(Err(Errno::EOVERFLOW))?;
        if is_append && file_size == 0 {
            is_append = false;
        }

        // Handle opened for append but appended nothing quickly.
        if is_append && data_size <= file_size.saturating_sub(SYD3_HDR_SIZE) {
            return Ok(());
        }

        // AES-CTR cipher keyed with IV.
        let mut cipher = aes_ctr(crypt_keys.enc(), &crypt_iv)?;

        // Encrypt-then-MAC: MAC(magic || iv || ciphertext).
        let mut mac = hmac_sha256(crypt_keys.mac())?;
        mac.update(CRYPT_MAGIC);
        mac.update(crypt_iv.as_ref());

        // Hint kernel about I/O access patterns.
        Self::advise_io(&crypt_fd, &enc_fd)?;

        // Allocate plaintext/ciphertext buffer to be zeroized on drop.
        let mut buf = Zeroizing::new([MaybeUninit::<u8>::uninit(); IO_BUF_SIZE]);

        // Handle last block re-encryption for append.
        let plain_len: usize = if is_append {
            // Adjust "file_size" to exclude header.
            file_size = file_size
                .checked_sub(SYD3_HDR_SIZE)
                .ok_or(Errno::EOVERFLOW)?;

            // Determine offset of last full block.
            let last_block_offset = Self::get_last_block_offset(file_size)?;

            // Advance keystream to last full block boundary.
            cipher.seek(last_block_offset);

            // Position crypt_fd offset for append.
            Self::seek2append(&crypt_fd, last_block_offset, file_size)?;

            // Ensure no stale bytes from last partial block survive.
            assert!(
                data_size >= file_size,
                "BUG: stale bytes in last partial block, report a bug!"
            );

            // Authenticate ciphertext prefix [0, last_block_offset).
            lseek64(&enc_fd, SYD3_HDR_OFFSET, Whence::SeekSet)?;
            let mut remaining: usize = last_block_offset.try_into().or(Err(Errno::EOVERFLOW))?;
            while remaining > 0 {
                let len = remaining.min(IO_BUF_SIZE);
                let chunk = read_chunk(&enc_fd, &mut buf[..len])?;
                mac.update(&*chunk);
                remaining = remaining.checked_sub(len).ok_or(Errno::EOVERFLOW)?;
            }

            // Overwrite from last full block onward.
            let off = SYD3_HDR_OFFSET
                .checked_add(last_block_offset.try_into().or(Err(Errno::EOVERFLOW))?)
                .ok_or(Errno::EOVERFLOW)?;
            lseek64(&enc_fd, off, Whence::SeekSet)?;

            // Re-encrypt partial last block plus appended bytes.
            data_size
                .checked_sub(last_block_offset)
                .ok_or(Errno::EOVERFLOW)?
                .try_into()
                .or(Err(Errno::EOVERFLOW))?
        } else {
            // Non-append mode: Overwrite file.

            // Reset crypt_fd to start of file.
            lseek64(&crypt_fd, 0, Whence::SeekSet)?;

            if file_size > 0 {
                // Remove previous content.
                retry_on_eintr(|| safe_ftruncate64(&enc_fd, 0))?;
                lseek64(&enc_fd, 0, Whence::SeekSet)?;
            }

            // Write encrypted file header with given IV.
            Self::write_header(&enc_fd, &crypt_iv)?;

            // Encrypt whole plaintext.
            data_size.try_into().or(Err(Errno::EOVERFLOW))?
        };

        // Encrypt plaintext, authenticate ciphertext, and write it.
        let mut remaining = plain_len;
        while remaining > 0 {
            let len = remaining.min(IO_BUF_SIZE);
            let chunk = read_chunk(&crypt_fd, &mut buf[..len])?;
            cipher.apply_keystream(chunk);
            mac.update(&*chunk);
            write_all(&enc_fd, &*chunk)?;
            remaining = remaining.checked_sub(len).ok_or(Errno::EOVERFLOW)?;
        }

        // Write HMAC tag between magic header and IV.
        let tag = mac.finalize().into_bytes();
        lseek64(&enc_fd, CRYPT_MAGIC_OFFSET, Whence::SeekSet)?;
        write_all(&enc_fd, &tag[..])?;

        Ok(())
    }

    // Unshare AES thread for isolation.
    fn unshare(crypt_fd: RawFd, enc_fd: RawFd) -> Result<(), Errno> {
        unshare(CloneFlags::CLONE_FILES | CloneFlags::CLONE_FS | CloneFlags::CLONE_SYSVSEM)?;

        // We have to sort the set as the FDs are randomized.
        #[expect(clippy::cast_sign_loss)]
        let mut keep = [
            crypt_fd as libc::c_uint,
            enc_fd as libc::c_uint,
            crate::log::LOG_FD.load(Ordering::Relaxed) as libc::c_uint,
        ];
        keep.sort_unstable();

        closeexcept(&keep)
    }

    // Hint kernel about I/O access patterns.
    fn advise_io<Fd1: AsFd, Fd2: AsFd>(crypt_fd: Fd1, enc_fd: Fd2) -> Result<(), Errno> {
        // Mark enc_fd as SEQUENTIAL before writes to encourage
        // clustered I/O and reduce random writeback patterns.
        posix_fadvise(&enc_fd, 0, 0, PosixFadviseAdvice::POSIX_FADV_SEQUENTIAL)?;

        // Set crypt_fd SEQUENTIAL|WILLNEED before the main pump to
        // prime readahead and avoid small read bursts starving the
        // cryptography pipeline.
        posix_fadvise(&crypt_fd, 0, 0, PosixFadviseAdvice::POSIX_FADV_SEQUENTIAL)?;
        posix_fadvise(&crypt_fd, 0, 0, PosixFadviseAdvice::POSIX_FADV_WILLNEED)?;

        Ok(())
    }

    // Returns offset of the last full block.
    //
    // File size doesn't include header size.
    fn get_last_block_offset(file_size: u64) -> Result<u64, Errno> {
        let remainder = file_size
            .checked_rem(BLOCK_SIZE as u64)
            .ok_or(Errno::EOVERFLOW)?;
        file_size.checked_sub(remainder).ok_or(Errno::EOVERFLOW)
    }

    // Positions plaintext fd offset for append.
    //
    // If there is a partial block at the end, we need to re-encrypt it.
    // Last block offset is offset of last full block.
    // File size doesn't include the header size.
    fn seek2append<Fd: AsFd>(
        crypt_fd: Fd,
        last_block_offset: u64,
        file_size: u64,
    ) -> Result<(), Errno> {
        if last_block_offset < file_size {
            // Adjust crypt_fd to read from last full block offset.
            let off: i64 = last_block_offset.try_into().or(Err(Errno::EOVERFLOW))?;
            lseek64(crypt_fd, off, Whence::SeekSet)
        } else {
            // No partial block, start reading from current file size.
            let off: i64 = file_size.try_into().or(Err(Errno::EOVERFLOW))?;
            lseek64(crypt_fd, off, Whence::SeekSet)
        }
        .map(drop)
    }

    // Write encrypted file header with the given IV.
    fn write_header<Fd: AsFd>(enc_fd: Fd, iv: &IV) -> Result<(), Errno> {
        write_all(&enc_fd, CRYPT_MAGIC)?;
        write_all(&enc_fd, &[0u8; HMAC_TAG_SIZE])?;
        write_all(&enc_fd, iv.as_ref())?;
        Ok(())
    }
}

#[cfg(test)]
mod tests {
    use super::*;
    use crate::hash::BLOCK_SIZE;

    #[test]
    fn test_get_last_block_offset_1() {
        let result = AesWorker::get_last_block_offset(0);
        assert_eq!(result, Ok(0));
    }

    #[test]
    fn test_get_last_block_offset_2() {
        let result = AesWorker::get_last_block_offset(BLOCK_SIZE as u64);
        assert_eq!(result, Ok(BLOCK_SIZE as u64));
    }

    #[test]
    fn test_get_last_block_offset_3() {
        let result = AesWorker::get_last_block_offset(BLOCK_SIZE as u64 + 1);
        assert_eq!(result, Ok(BLOCK_SIZE as u64));
    }

    #[test]
    fn test_get_last_block_offset_4() {
        let result = AesWorker::get_last_block_offset(2 * BLOCK_SIZE as u64);
        assert_eq!(result, Ok(2 * BLOCK_SIZE as u64));
    }

    #[test]
    fn test_get_last_block_offset_5() {
        let result = AesWorker::get_last_block_offset(1);
        assert_eq!(result, Ok(0));
    }

    #[test]
    fn test_get_last_block_offset_6() {
        let result = AesWorker::get_last_block_offset(BLOCK_SIZE as u64 - 1);
        assert_eq!(result, Ok(0));
    }
}