Coverage Report

Created: 2019-07-24 05:18

/Users/buildslave/jenkins/workspace/clang-stage2-coverage-R/llvm/tools/clang/lib/StaticAnalyzer/Checkers/ChrootChecker.cpp
Line
Count
Source (jump to first uncovered line)
1
//===-- ChrootChecker.cpp - chroot usage checks ---------------------------===//
2
//
3
// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4
// See https://llvm.org/LICENSE.txt for license information.
5
// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6
//
7
//===----------------------------------------------------------------------===//
8
//
9
//  This file defines chroot checker, which checks improper use of chroot.
10
//
11
//===----------------------------------------------------------------------===//
12
13
#include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
14
#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
15
#include "clang/StaticAnalyzer/Core/Checker.h"
16
#include "clang/StaticAnalyzer/Core/CheckerManager.h"
17
#include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
18
#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
19
#include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h"
20
#include "clang/StaticAnalyzer/Core/PathSensitive/ProgramStateTrait.h"
21
#include "clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h"
22
23
using namespace clang;
24
using namespace ento;
25
26
namespace {
27
28
// enum value that represent the jail state
29
enum Kind { NO_CHROOT, ROOT_CHANGED, JAIL_ENTERED };
30
31
3
bool isRootChanged(intptr_t k) { return k == ROOT_CHANGED; }
32
//bool isJailEntered(intptr_t k) { return k == JAIL_ENTERED; }
33
34
// This checker checks improper use of chroot.
35
// The state transition:
36
// NO_CHROOT ---chroot(path)--> ROOT_CHANGED ---chdir(/) --> JAIL_ENTERED
37
//                                  |                               |
38
//         ROOT_CHANGED<--chdir(..)--      JAIL_ENTERED<--chdir(..)--
39
//                                  |                               |
40
//                      bug<--foo()--          JAIL_ENTERED<--foo()--
41
class ChrootChecker : public Checker<eval::Call, check::PreCall> {
42
  // This bug refers to possibly break out of a chroot() jail.
43
  mutable std::unique_ptr<BuiltinBug> BT_BreakJail;
44
45
  const CallDescription Chroot{"chroot", 1}, Chdir{"chdir", 1};
46
47
public:
48
5
  ChrootChecker() {}
49
50
37
  static void *getTag() {
51
37
    static int x;
52
37
    return &x;
53
37
  }
54
55
  bool evalCall(const CallEvent &Call, CheckerContext &C) const;
56
  void checkPreCall(const CallEvent &Call, CheckerContext &C) const;
57
58
private:
59
  void evalChroot(const CallEvent &Call, CheckerContext &C) const;
60
  void evalChdir(const CallEvent &Call, CheckerContext &C) const;
61
};
62
63
} // end anonymous namespace
64
65
34
bool ChrootChecker::evalCall(const CallEvent &Call, CheckerContext &C) const {
66
34
  if (Call.isCalled(Chroot)) {
67
3
    evalChroot(Call, C);
68
3
    return true;
69
3
  }
70
31
  if (Call.isCalled(Chdir)) {
71
2
    evalChdir(Call, C);
72
2
    return true;
73
2
  }
74
29
75
29
  return false;
76
29
}
77
78
3
void ChrootChecker::evalChroot(const CallEvent &Call, CheckerContext &C) const {
79
3
  ProgramStateRef state = C.getState();
80
3
  ProgramStateManager &Mgr = state->getStateManager();
81
3
82
3
  // Once encouter a chroot(), set the enum value ROOT_CHANGED directly in
83
3
  // the GDM.
84
3
  state = Mgr.addGDM(state, ChrootChecker::getTag(), (void*) ROOT_CHANGED);
85
3
  C.addTransition(state);
86
3
}
87
88
2
void ChrootChecker::evalChdir(const CallEvent &Call, CheckerContext &C) const {
89
2
  ProgramStateRef state = C.getState();
90
2
  ProgramStateManager &Mgr = state->getStateManager();
91
2
92
2
  // If there are no jail state in the GDM, just return.
93
2
  const void *k = state->FindGDM(ChrootChecker::getTag());
94
2
  if (!k)
95
0
    return;
96
2
97
2
  // After chdir("/"), enter the jail, set the enum value JAIL_ENTERED.
98
2
  const Expr *ArgExpr = Call.getArgExpr(0);
99
2
  SVal ArgVal = C.getSVal(ArgExpr);
100
2
101
2
  if (const MemRegion *R = ArgVal.getAsRegion()) {
102
2
    R = R->StripCasts();
103
2
    if (const StringRegion* StrRegion= dyn_cast<StringRegion>(R)) {
104
2
      const StringLiteral* Str = StrRegion->getStringLiteral();
105
2
      if (Str->getString() == "/")
106
1
        state = Mgr.addGDM(state, ChrootChecker::getTag(),
107
1
                           (void*) JAIL_ENTERED);
108
2
    }
109
2
  }
110
2
111
2
  C.addTransition(state);
112
2
}
113
114
// Check the jail state before any function call except chroot and chdir().
115
void ChrootChecker::checkPreCall(const CallEvent &Call,
116
36
                                 CheckerContext &C) const {
117
36
  // Ignore chroot and chdir.
118
36
  if (Call.isCalled(Chroot) || 
Call.isCalled(Chdir)33
)
119
5
    return;
120
31
121
31
  // If jail state is ROOT_CHANGED, generate BugReport.
122
31
  void *const* k = C.getState()->FindGDM(ChrootChecker::getTag());
123
31
  if (k)
124
3
    if (isRootChanged((intptr_t) *k))
125
2
      if (ExplodedNode *N = C.generateNonFatalErrorNode()) {
126
2
        if (!BT_BreakJail)
127
1
          BT_BreakJail.reset(new BuiltinBug(
128
1
              this, "Break out of jail", "No call of chdir(\"/\") immediately "
129
1
                                         "after chroot"));
130
2
        C.emitReport(llvm::make_unique<BugReport>(
131
2
            *BT_BreakJail, BT_BreakJail->getDescription(), N));
132
2
      }
133
31
}
134
135
5
void ento::registerChrootChecker(CheckerManager &mgr) {
136
5
  mgr.registerChecker<ChrootChecker>();
137
5
}
138
139
5
bool ento::shouldRegisterChrootChecker(const LangOptions &LO) {
140
5
  return true;
141
5
}