syd 3.52.0

//
// Syd: rock-solid application kernel
// src/workers/int.rs: `syd_int' interrupter thread
//
// Copyright (c) 2024, 2025, 2026 Ali Polatel <alip@chesswob.org>
//
// SPDX-License-Identifier: GPL-3.0

// SAFETY:
// 1. This module has (almost) been liberated from unsafe code.
//    Owner::from_raw_fd is used for notif_fd which is unsafe.
//    Use deny rather than forbid so we can allow this case.
// 2. This module forbids arithmetic side effects, et al.
#![deny(unsafe_code)]
#![forbid(clippy::arithmetic_side_effects)]
#![forbid(clippy::cast_possible_truncation)]
#![forbid(clippy::cast_possible_wrap)]

use std::{
    os::fd::{FromRawFd, RawFd},
    sync::{
        atomic::{AtomicBool, Ordering},
        Arc,
    },
    thread,
};

use libseccomp::{scmp_cmp, ScmpAction, ScmpFilterContext, ScmpSyscall};
use nix::{
    errno::Errno,
    sched::{unshare, CloneFlags},
    unistd::{getpid, lseek64, write, Gid, Pid, Uid, Whence},
};
use serde::{ser::SerializeMap, Serialize, Serializer};

use crate::{
    alert,
    cache::SysInterrupt,
    config::*,
    confine::{
        confine_scmp_close, confine_scmp_fcntl, confine_scmp_madvise, confine_scmp_open_stat,
        confine_scmp_prctl, confine_scmp_setid, confine_scmp_write, confine_scmp_wx_syd,
        secure_getenv, ExportMode,
    },
    cookie::{CookieIdx, SYSCOOKIE_POOL},
    err::{err2no, scmp2no, SydJoinHandle, SydResult},
    error,
    fd::{closeexcept, SafeOwnedFd, PROC_FD},
    fs::{seccomp_notify_id_valid, tgkill},
    info,
    proc::{proc_interrupt_read, proc_status_open},
    retry::retry_on_eintr,
    sandbox::Options,
    sigset::SydSigSet,
    workers::WorkerCache,
};

#[derive(Debug, Copy, Clone, Eq, PartialEq)]
enum InterruptSource {
    Manual,
    Signal(SydSigSet),
    ProcessInvalid(Errno),
}

impl Serialize for InterruptSource {
    fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
    where
        S: Serializer,
    {
        let mut map = serializer.serialize_map(Some(2))?;
        match self {
            Self::Manual => {
                map.serialize_entry("name", "manual")?;
            }
            Self::Signal(set) => {
                map.serialize_entry("name", "signal")?;
                map.serialize_entry("set", set)?;
            }
            Self::ProcessInvalid(errno) => {
                let err = *errno as i32;
                map.serialize_entry("name", "process")?;
                map.serialize_entry("err", &err)?;
            }
        }
        map.end()
    }
}

#[derive(Clone)]
pub(crate) struct Interrupter {
    seccomp_fd: RawFd,
    options: Options,

    transit_uids: Vec<(Uid, Uid)>,
    transit_gids: Vec<(Gid, Gid)>,

    should_exit: Arc<AtomicBool>,
    cache: Arc<WorkerCache>,
}

impl Interrupter {
    pub(crate) fn new(
        seccomp_fd: RawFd,
        options: Options,
        transit_uids: &[(Uid, Uid)],
        transit_gids: &[(Gid, Gid)],
        should_exit: Arc<AtomicBool>,
        cache: Arc<WorkerCache>,
    ) -> Self {
        Self {
            options,
            seccomp_fd,
            should_exit,
            cache,
            transit_uids: transit_uids.to_vec(),
            transit_gids: transit_gids.to_vec(),
        }
    }

    #[expect(clippy::cognitive_complexity)]
    pub(crate) fn try_spawn(self, notif_pipe: (RawFd, RawFd)) -> Result<SydJoinHandle<()>, Errno> {
        thread::Builder::new()
            .name("syd_int".to_string())
            .stack_size(INT_STACK_SIZE)
            .spawn(move || {
                // We use exit_group(2) here to bail, because this
                // unsharing is a critical safety feature.
                if let Err(errno) = unshare(CloneFlags::CLONE_FS | CloneFlags::CLONE_FILES | CloneFlags::CLONE_SYSVSEM) {
                    alert!("ctx": "boot", "op": "unshare_interrupt_thread",
                        "msg": format!("failed to unshare(CLONE_FS|CLONE_FILES|CLONE_SYSVSEM): {errno}"),
                        "err": errno as i32);
                    std::process::exit(101);
                }

                // SAFETY: notif_pipe points to valid FDs.
                #[expect(unsafe_code)]
                let (pipe_rd, pipe_wr) = unsafe {
                    (
                        SafeOwnedFd::from_raw_fd(notif_pipe.0),
                        SafeOwnedFd::from_raw_fd(notif_pipe.1),
                    )
                };
                drop(pipe_rd);
                let buf = [42u8; 1];
                #[expect(clippy::disallowed_methods)]
                match retry_on_eintr(|| write(&pipe_wr, &buf)).unwrap() {
                    0 => return Err(Errno::EIO.into()), // Syd died before reading.
                    1 => {}
                    n => unreachable!("BUG: invalid pipe write of size {n}!"),
                }

                // Close the notification pipe.
                drop(pipe_wr);

                // Interrupt thread needs to inherit the following FDs:
                // 1. Seccomp-notify FD.
                // 2. Static FD of procfs(5).
                // 3. Log FD.
                // We have to sort the set as the FDs are randomized.
                #[expect(clippy::cast_sign_loss)]
                let mut set = vec![
                    self.seccomp_fd as libc::c_uint,
                    PROC_FD() as libc::c_uint,
                    crate::log::LOG_FD.load(Ordering::Relaxed) as libc::c_uint,
                ];
                set.sort_unstable();
                if let Err(errno) = closeexcept(&set) {
                    alert!("ctx": "boot", "op": "close_range_interrupt_thread",
                        "msg": format!("failed to close range: {errno}"),
                        "err": errno as i32);
                    std::process::exit(101);
                }
                drop(set);

                // To be used by tgkill when signaling threads.
                let tgid = getpid();

                // Honour dry-run when exporting.
                let dry_run =
                    secure_getenv(ENV_SKIP_SCMP).is_some() || ExportMode::from_env().is_some();

                // Confine `syd_int' thread.
                if !dry_run {
                    // We use exit_group(2) here to bail, because this
                    // confinement is a critical safety feature.
                    let ctx = match Self::prepare_confine(
                        self.seccomp_fd,
                        tgid,
                        self.options,
                        &self.transit_uids,
                        &self.transit_gids,
                        false,
                    ) {
                        Ok(ctx) => ctx,
                        Err(error) => {
                            let errno = error.errno().unwrap_or(Errno::ENOSYS);
                            alert!("ctx": "boot", "op": "confine_int_thread",
                                "msg": format!("failed to confine: {error}"),
                                "err": errno as i32);
                            std::process::exit(101);
                        }
                    };

                    // Load seccomp(2) BPF into the kernel.
                    // We use exit_group(2) here to bail, because this
                    // confinement is a critical safety feature.
                    if let Err(error) = ctx.load() {
                        let errno = scmp2no(&error).unwrap_or(Errno::ENOSYS);
                        alert!("ctx": "boot", "op": "confine_int_thread",
                            "msg": format!("failed to confine: {error}"),
                            "err": errno as i32);
                        std::process::exit(101);
                    }

                    let safe_setid = self
                        .options
                        .intersects(Options::OPT_ALLOW_SAFE_SETUID | Options::OPT_ALLOW_SAFE_SETGID);
                    info!("ctx": "confine", "op": "confine_int_thread",
                        "msg": format!("interrupt thread confined with{} SROP mitigation",
                            if safe_setid { "out" } else { "" }));
                } else {
                    error!("ctx": "confine", "op": "confine_int_thread",
                        "msg": "interrupt thread is running unconfined in debug mode");
                }

                // Enter main loop.
                self.main(tgid)
            })
            .map_err(|err| err2no(&err))
    }

    fn main(self, tgid: Pid) -> SydResult<()> {
        // Unblock invalidated blocking system calls.
        let mut had_progress = true;
        loop {
            let (ref lock, ref cvar) = *self.cache.sysint_map.sys_block;
            let map = lock.lock().unwrap_or_else(|err| err.into_inner());

            // Wait for an interrupt or exit notification.
            // Throttle for poll timeout if no progress was made last turn.
            let mut map = if had_progress {
                cvar.wait_while(map, |map| {
                    map.is_empty() && !self.should_exit.load(Ordering::Acquire)
                })
                .unwrap_or_else(|err| err.into_inner())
            } else {
                cvar.wait_timeout(map, INT_POLL_TIME.into())
                    .unwrap_or_else(|err| err.into_inner())
                    .0
            };

            // Close proc_pid_status(5) fds at exit.
            if self.should_exit.load(Ordering::Acquire) {
                map.clear();
                return Ok(());
            }

            // Handle interrupts as necessary.
            let mut map_err = false;
            let map_len_old = map.len();
            map.retain_mut(|interrupt| {
                if map_err {
                    // Skip rest if a critical error has occurred.
                    return true;
                }

                match self.handle_interrupt(tgid, interrupt) {
                    Ok(keep) => keep,
                    Err(_) => {
                        map_err = true;
                        true
                    }
                }
            });

            // If a critical error occurred during interrupt handling,
            // unblock stuck emulator threads with manual signaling.
            if map_err {
                map.retain_mut(|interrupt| {
                    interrupt.signal = true;
                    self.handle_interrupt(tgid, interrupt).unwrap_or(false)
                });
            }

            // Keep memory usage minimal.
            map.shrink_to_fit();

            // Track whether this round removed any entries.
            had_progress = map.is_empty() || map_len_old != map.len();
        }
    }

    // Handles syscall signal interrupts.
    //
    // Returns Ok(false) if interrupt is handled, Ok(true) otherwise.
    // Returns Err(Errno) on critical errors such as ENFILE, EMFILE and ENOMEM.
    fn handle_interrupt(&self, tgid: Pid, interrupt: &mut SysInterrupt) -> Result<bool, Errno> {
        // Check if syd_emu is already done with the request.
        if interrupt.delete {
            return Ok(false);
        }

        // Check if syd_mon requested manual interruption.
        if interrupt.signal {
            Self::interrupt(tgid, interrupt, InterruptSource::Manual);
            return Ok(false);
        }

        // Open proc_pid_status(5) if it's not open already.
        //
        // We want to wake the respective syd_emu thread in case the
        // process is no longer valid otherwise we may end up with a
        // deadlock: See miniupnpc tests, thx kepstin! To prevent PID
        // reuse vectors we validate the request ID.
        let status_fd = if let Some(fd) = interrupt.status.as_ref() {
            if let Err(errno) = lseek64(fd, 0, Whence::SeekSet) {
                if self.is_valid(interrupt.request.id) {
                    let source = InterruptSource::ProcessInvalid(errno);
                    Self::interrupt(tgid, interrupt, source);
                } // no need to interrupt for invalid seccomp-id.
                return Ok(false);
            }
            fd
        } else {
            let fd = match proc_status_open(interrupt.request.pid()) {
                Ok(fd) if self.is_valid(interrupt.request.id) => {
                    // seccomp-id validated, proc_pid_status(5) is valid.
                    fd
                }
                Err(errno @ (Errno::ENFILE | Errno::EMFILE | Errno::ENOMEM)) => return Err(errno),
                Err(errno) if self.is_valid(interrupt.request.id) => {
                    let source = InterruptSource::ProcessInvalid(errno);
                    Self::interrupt(tgid, interrupt, source);
                    return Ok(false);
                }
                // seccomp-id invalid, no need to interrupt.
                _ => return Ok(false),
            };
            interrupt.status = Some(fd);
            #[expect(clippy::disallowed_methods)]
            interrupt.status.as_ref().unwrap()
        };

        // Calculate interrupt sigset from proc_pid_status(5).
        let mut sigset = match proc_interrupt_read(status_fd) {
            Ok(sigset) if sigset.is_empty() => return Ok(true), // no interrupts: keep.
            Ok(sigset) if self.is_valid(interrupt.request.id) => sigset,
            Err(errno) if self.is_valid(interrupt.request.id) => {
                let source = InterruptSource::ProcessInvalid(errno);
                Self::interrupt(tgid, interrupt, source);
                return Ok(false);
            }
            // seccomp-id invalid, no need to interrupt.
            _ => return Ok(false),
        };

        // Filter out restarting signals per-process, unless ignore_restart.
        if !interrupt.ignore_restart {
            if let Some(sigset_restart) = self
                .cache
                .sysint_map
                .sig_restart
                .lock()
                .unwrap_or_else(|err| err.into_inner())
                .get(&interrupt.tgid)
            {
                sigset.del_set(*sigset_restart);

                // Keep if received only restarting signals.
                if sigset.is_empty() {
                    return Ok(true);
                }
            }
        }

        // Interrupt syd_emu thread and remove entry.
        Self::interrupt(tgid, interrupt, InterruptSource::Signal(sigset));
        Ok(false)
    }

    // Interrupt the respective `syd_emu` thread.
    #[expect(clippy::cognitive_complexity)]
    fn interrupt(tgid: Pid, interrupt: &SysInterrupt, source: InterruptSource) {
        match retry_on_eintr(|| tgkill(tgid, interrupt.handler, libc::SIGALRM)) {
            Ok(_) | Err(Errno::ESRCH) => {
                info!("ctx": "int", "op": "interrupt_emulator",
                    "msg": "interrupted emulator thread",
                    "src": source, "int": interrupt);
            }
            Err(errno) => {
                alert!("ctx": "int", "op": "interrupt_emulator",
                    "msg": format!("failed to interrupt emulator: {errno}"),
                    "err": errno as i32,
                    "src": source, "int": interrupt);
                std::process::exit(101);
            }
        }
    }

    fn is_valid(&self, id: u64) -> bool {
        // EAGAIN|EINTR is handled.
        // ENOENT means child died mid-way.
        seccomp_notify_id_valid(self.seccomp_fd, id).is_ok()
    }

    // Confine Interrupter thread.
    #[expect(clippy::cognitive_complexity)]
    pub(crate) fn prepare_confine(
        seccomp_fd: RawFd,
        tgid: Pid,
        options: Options,
        transit_uids: &[(Uid, Uid)],
        transit_gids: &[(Gid, Gid)],
        _dry_run: bool,
    ) -> SydResult<ScmpFilterContext> {
        let restrict_cookie = !options.allow_unsafe_nocookie();

        // We cannot confine `syd_int` with a per-thread landlock(7)
        // filter here, because it requires access to proc_pid_status(5)
        // which in turn requires ptrace(2) rights and landlock(7)
        // unconditionally limits that.

        // Create seccomp filter with default action.
        let mut ctx = ScmpFilterContext::new(ScmpAction::KillProcess)?;

        // Enforce the NO_NEW_PRIVS functionality before
        // loading the seccomp filter into the kernel.
        ctx.set_ctl_nnp(true)?;

        // Disable Speculative Store Bypass mitigations
        // with trace/allow_unsafe_exec_speculative:1
        ctx.set_ctl_ssb(options.allow_unsafe_exec_speculative())?;

        // DO NOT synchronize filter to all threads.
        // Other threads will self-confine.
        ctx.set_ctl_tsync(false)?;

        // We kill for bad system call and bad arch.
        ctx.set_act_badarch(ScmpAction::KillProcess)?;

        // Use a binary tree sorted by syscall number if possible.
        let _ = ctx.set_ctl_optimize(2);

        // Do NOT add supported architectures to the filter.
        // This ensures Syd can never run a non-native system call,
        // which we do not need at all.
        // seccomp_add_architectures(&mut ctx)?;

        // Allow interrupt handler thread to send the
        // SIGALRM signal to threads in Syd's thread group.
        let sysname = "tgkill";
        #[expect(clippy::cast_sign_loss)]
        match ScmpSyscall::from_name(sysname) {
            Ok(syscall) => {
                ctx.add_rule_conditional(
                    ScmpAction::Allow,
                    syscall,
                    &[
                        scmp_cmp!($arg0 == tgid.as_raw() as u64),
                        scmp_cmp!($arg2 == libc::SIGALRM as u64),
                    ],
                )?;
            }
            Err(_) => {
                info!("ctx": "confine", "op": "allow_int_syscall",
                    "msg": format!("invalid or unsupported syscall {sysname}"));
            }
        }

        // Allow interrupt handler thread to validate seccomp(2)
        // request IDs using ioctl(2).
        let sysname = "ioctl";
        #[expect(clippy::cast_sign_loss)]
        #[expect(clippy::unnecessary_cast)]
        match ScmpSyscall::from_name(sysname) {
            Ok(syscall) => {
                ctx.add_rule_conditional(
                    ScmpAction::Allow,
                    syscall,
                    &[
                        scmp_cmp!($arg0 == seccomp_fd as u64),
                        scmp_cmp!($arg1 == crate::fs::SECCOMP_IOCTL_NOTIF_ID_VALID as u64),
                    ],
                )?;
            }
            Err(_) => {
                info!("ctx": "confine", "op": "allow_int_syscall",
                    "msg": format!("invalid or unsupported syscall {sysname}"));
            }
        }

        // Allow openat2(2) with the static proc(5) fd only.
        // Apply system call argument cookies.
        let sysname = "openat2";
        #[expect(clippy::cast_sign_loss)]
        #[expect(clippy::useless_conversion)]
        match ScmpSyscall::from_name(sysname) {
            Ok(syscall) => {
                let mut rules = vec![scmp_cmp!($arg0 == PROC_FD() as u64)];
                if restrict_cookie {
                    rules.extend([
                        scmp_cmp!($arg4 == SYSCOOKIE_POOL.get(CookieIdx::Openat2Arg4).into()),
                        scmp_cmp!($arg5 == SYSCOOKIE_POOL.get(CookieIdx::Openat2Arg5).into()),
                    ]);
                }
                ctx.add_rule_conditional(ScmpAction::Allow, syscall, &rules)?;
            }
            Err(_) => {
                info!("ctx": "confine", "op": "allow_int_syscall",
                    "msg": format!("invalid or unsupported syscall {sysname}"));
            }
        }

        // Deny rest of open and stat family with ENOSYS rather than KillProcess.
        confine_scmp_open_stat(&mut ctx, false /* openat2 */)?;

        // close(2) may be used only with syscall argument cookies.
        confine_scmp_close(&mut ctx, restrict_cookie)?;

        // Allow safe fcntl(2) utility calls.
        confine_scmp_fcntl(&mut ctx, INT_FCNTL_OPS)?;

        // Allow safe prctl(2) operations.
        confine_scmp_prctl(&mut ctx, INT_PRCTL_OPS)?;

        // Prevent executable memory.
        confine_scmp_wx_syd(&mut ctx)?;

        // Allow writes to the log-fd.
        // No proc_pid_mem(5) access required here.
        confine_scmp_write(&mut ctx, None, false)?;

        // Allow safe madvise(2) advice.
        confine_scmp_madvise(&mut ctx)?;

        // Allow safe, futex and getid system calls.
        //
        // KCOV_SYSCALLS is empty in case `kcov` feature is disabled.
        for sysname in INT_SYSCALLS
            .iter()
            .chain(ALLOC_SYSCALLS)
            .chain(FUTEX_SYSCALLS)
            .chain(GETID_SYSCALLS)
            .chain(KCOV_SYSCALLS)
            .chain(VDSO_SYSCALLS)
        {
            match ScmpSyscall::from_name(sysname) {
                Ok(syscall) => {
                    ctx.add_rule(ScmpAction::Allow, syscall)?;
                }
                Err(_) => {
                    info!("ctx": "confine", "op": "allow_int_syscall",
                        "msg": format!("invalid or unsupported syscall {sysname}"));
                }
            }
        }

        // Allow UID/GID changing system calls as necessary.
        let safe_setuid = options.allow_safe_setuid();
        let safe_setgid = options.allow_safe_setgid();
        if safe_setuid || safe_setgid {
            confine_scmp_setid(
                "int",
                &mut ctx,
                safe_setuid,
                safe_setgid,
                transit_uids,
                transit_gids,
            )?;
        }

        Ok(ctx)
    }
}