sandbox-app-launcher

#!/bin/bash

## Copyright (C) 2012 - 2020 ENCRYPTED SUPPORT LP <adrelanos@riseup.net>
## See the file COPYING for copying conditions.

set -e

app_name="${1}"
shift 1
: ${app_path:="$(type -P "${app_name}" || true)"}

if ! [[ "${app_name}" =~ [0-9a-zA-Z/] ]]; then
   echo "ERROR: Invalid character in app_name." >&2
   exit 1
fi

if ! [[ "${app_path}" =~ [0-9a-zA-Z/] ]]; then
   echo "ERROR: Invalid character in app_path." >&2
   exit 1
fi

main_app_dir="/usr/share/sandbox-app-launcher"
auto_dir="/var/cache/sandbox-app-launcher-autogenerated"
wrapper_dir="${auto_dir}/wrappers"
wrapper_dir_wx="${wrapper_dir}-wx"
appdata_dir="/home/sandbox-app-launcher-appdata"
app_user="sandbox-${app_name}"
app_homedir="${appdata_dir}/${app_name}"
seccomp_filter="${auto_dir}/seccomp-filter.bpf"
wx_whitelist="${main_app_dir}/wx_whitelist"
shared_dir="${appdata_dir}/shared"
bwrap_args=""

if [ "${app_name}" = "torbrowser" ]; then
  app_path="${app_homedir}/.tb/tor-browser/Browser/start-tor-browser"
fi

error_handler() {
  echo "
## sandbox-app-launcher BUG.
## BASH_COMMAND: ${BASH_COMMAND}
## Please report this BUG!
" >&2
  exit 1
}

trap "error_handler" ERR

if ! [ "$(id -u)" = "0" ]; then
  echo "ERROR: Must run as root." >&2
  exit 1
fi

if [ -f "/etc/sandbox-app-launcher/${app_name}.conf" ]; then
  . "/etc/sandbox-app-launcher/${app_name}.conf"
fi

setup() {
  if ! [ -x "${app_path}" ] && ! [ "${app_name}" = "torbrowser" ]; then
    echo "ERROR: Could not find '${app_name}' in \$PATH." >&2
    exit 1
  fi

  if [ "${app_name}" = "shared" ]; then
    echo "ERROR: The app name cannot be 'shared'." >&2
    exit 1
  fi

  if ! [ -d "${main_app_dir}" ]; then
    mkdir -m 755 "${main_app_dir}"
  fi

  if ! [ -d "${auto_dir}" ]; then
    mkdir -m 755 "${auto_dir}"
  fi

  if ! [ -d "${wrapper_dir}" ]; then
    mkdir -m 755 "${wrapper_dir}"
  fi

  if ! [ -d "${wrapper_dir_wx}" ]; then
    mkdir -m 755 "${wrapper_dir_wx}"
  fi

  if ! [ -d "${appdata_dir}" ]; then
    mkdir -m 755 "${appdata_dir}"
  fi

  if ! [ -d "${shared_dir}" ]; then
    mkdir -m 1777 "${shared_dir}"
  fi

  if ! getent passwd | sed -e 's/:.*//g' | grep -qw "${app_user}"; then
    adduser --no-create-home --disabled-login --gecos "" "${app_user}"
  fi

  if ! [ -d "${app_homedir}" ]; then
    mkdir --parents "${app_homedir}"
  fi

  if ! [ "$(stat -c "%U" "${app_homedir}")" = "${app_user}" ]; then
    chown --recursive "${app_user}" "${app_homedir}"
  fi

  if ! [ "$(stat -c %a "${app_homedir}")" = "700" ]; then
    chmod 700 -R "${app_homedir}"
  fi

  ## Generate seccomp filter.
  compiler_flags="-lseccomp -ldl -D_GNU_SOURCE -Wdate-time -D_FORTIFY_SOURCE=2 -g -O2 -fstack-protector-all -Wformat -Werror=format-security -Wl,-z,relro -Wl,-z,now"

  if ! [ -f "${seccomp_filter}" ]; then
    "${main_app_dir}/autogen-seccomp" "${main_app_dir}/seccomp-whitelist" > "${auto_dir}/seccomp.c"
    gcc "${auto_dir}/seccomp.c" -o "${auto_dir}/seccomp" ${compiler_flags}
    chmod 700 "${auto_dir}/seccomp"
    "${auto_dir}/seccomp"
  fi

  if ! [ -f "${main_app_dir}/seccomp-filter-wx.bpf" ]; then
    "${main_app_dir}/autogen-seccomp" "${main_app_dir}/seccomp-whitelist-wx" > "${auto_dir}/seccomp-wx.c"
    str_replace "seccomp-filter.bpf" "seccomp-filter-wx.bpf" "${auto_dir}/seccomp-wx.c" >/dev/null
    gcc "${auto_dir}/seccomp-wx.c" -o "${auto_dir}/seccomp-wx" ${compiler_flags}
    chmod 700 "${auto_dir}/seccomp-wx"
    "${auto_dir}/seccomp-wx"
  fi

  ## Optionally allow dynamic native code execution.
  ##
  ## This allows creating memory mappings that are both
  ## writable and executable, allows transitioning a
  ## writable memory mapping to executable and allows
  ## executing programs from writable directories i.e.
  ## violating W^X.
  ##
  ## This is generally a security issue since it allows an
  ## attacker to execute new arbitary code so preventing this
  ## will force the attacker to use the already existing code
  ## (ROP/JOP) which is far more limited.
  ##
  ## Although, some things require this such as JIT engines in
  ## browsers so it must be optional.
  if [ "${allow_dynamic_native_code_exec}" = "yes" ]; then
    seccomp_filter="${auto_dir}/seccomp-filter-wx.bpf"
    wrapper_dir="${wrapper_dir_wx}"
  fi

  ## Create wrapper.

  rm --force "${wrapper_dir}/${app_name}"
  touch "${wrapper_dir}/${app_name}"

  ## dbus-launch is run by /etc/X11/Xsession.d/75dbus_dbus-launch

  cat >> "${wrapper_dir}/${app_name}" << 'EOF'
#!/bin/sh

## Using sh because /etc/X11/Xsession is written in sh.

## Debugging.
set -x

export sandbox_app_launcher_wrapper_script=true
EOF

  ## /etc/X11/Xsession.d/99x11-common_start
  ## Does not work.
  ## + . /etc/X11/Xsession.d/99x11-common_start
  ## + exec /home/sandbox-app-launcher-appdata/torbrowser/.tb/tor-browser/Browser/start-tor-browser
  ## with exit code 139
  #echo "STARTUP=\"${app_path}\" \"\${@}\"" | tee --append "${wrapper_dir}/${app_name}" 1>/dev/null

  ## Copied from /etc/X11/Xsession and adjusted.
  cat >> "${wrapper_dir}/${app_name}" << 'EOF'
SYSSESSIONDIR=/etc/X11/Xsession.d
SESSIONFILES=$(run-parts --list $SYSSESSIONDIR)
if [ -n "$SESSIONFILES" ]; then
  set +e
  for SESSIONFILE in $SESSIONFILES; do
    if [ "$SESSIONFILE" = "/etc/X11/Xsession.d/99x11-common_start" ]; then
       continue
    fi
    . $SESSIONFILE
  done
  set -e
fi
EOF

  echo "\"${app_path}\" \"\${@}\"" | tee --append "${wrapper_dir}/${app_name}" 1>/dev/null

  chmod 755 "${wrapper_dir}/${app_name}"

  if [ -o xtrace ]; then
    cat "${wrapper_dir}/${app_name}"
  fi
}

run_program() {
  ## TODO: X11 sandbox - not needed if we switch to wayland
  ## TODO: IPC namespace
  ## TODO: Network namespace - probably via ip netns
  ## TODO: Don't preserve the environment - env -i

  ## Optionally remove network access by creating an empty net namespace.
  if [ "${allow_net}" = "no" ]; then
    bwrap_args+="--unshare-net "
  fi

  ## Optionally allow webcam access.
  if [ "${allow_webcam}" = "yes" ]; then
    for device in /dev/video*
    do
      if [ -f "${device}" ]; then
        bwrap_args+="--dev-bind-try ${device} ${device} "
      fi
    done
  fi

  ## Optionally allow microphone access.
  if [ "${allow_mic}" = "yes" ]; then
    bwrap_args+="--dev-bind-try /dev/snd /dev/snd "
  fi

  ## Shared storage.
  if [ "${shared_storage}" = "read-write" ]; then
    bwrap_args+="--bind ${shared_dir} ${shared_dir} --bind /shared /shared "
  elif [ "${shared_storage}" = "read-only" ]; then
    bwrap_args+="--ro-bind ${shared_dir} ${shared_dir} --ro-bind /shared /shared "
  fi

  ## Install Tor Browser.
  if [ "${app_name}" = "torbrowser" ]; then
    if ! [ -d "${app_homedir}/.tb" ]; then
      sudo -H -u "${app_user}" HOME="${app_homedir}" bash -c "tb_skip_functions+=' remount_exec tb_start_tor_browser ' torbrowser"
    fi
    bwrap_args+="--ro-bind-try /run/anon-ws-disable-stacked-tor/127.0.0.1_9150.sock /run/anon-ws-disable-stacked-tor/127.0.0.1_9150.sock "
    bwrap_args+="--ro-bind-try /run/anon-ws-disable-stacked-tor/127.0.0.1_9151.sock /run/anon-ws-disable-stacked-tor/127.0.0.1_9151.sock "
  fi

  sudo -H -u "${app_user}" bash -c "
  bwrap \
  --ro-bind /bin /bin \
  --ro-bind /usr/bin /usr/bin \
  --ro-bind /lib /lib \
  --ro-bind-try /lib32 /lib32 \
  --ro-bind-try /lib64 /lib64 \
  --ro-bind /usr/lib /usr/lib \
  --ro-bind-try /usr/local/lib /usr/local/lib \
  --ro-bind /usr/share /usr/share \
  --ro-bind-try /usr/local/share /usr/local/share \
  --ro-bind /usr/include /usr/include \
  --ro-bind /etc /etc \
  --ro-bind-data 10 /etc/passwd \
  --ro-bind-data 11 /etc/group \
  --ro-bind ${main_app_dir}/machine-id /etc/machine-id \
  --ro-bind /var/lib /var/lib \
  --tmpfs /var/lib/dbus \
  --ro-bind ${main_app_dir}/machine-id /var/lib/dbus/machine-id \
  --ro-bind /sys/devices /sys/devices \
  --ro-bind /sys/class /sys/class \
  --ro-bind /sys/bus /sys/bus \
  --ro-bind /sys/fs/cgroup /sys/fs/cgroup \
  --bind ${app_homedir} ${app_homedir} \
  --proc /proc \
  --tmpfs /tmp \
  --ro-bind-try /tmp/.X11-unix /tmp/.X11-unix \
  --tmpfs /var/tmp \
  --tmpfs /var/cache \
  --ro-bind ${wrapper_dir}/${app_name} ${wrapper_dir}/${app_name} \
  --ro-bind ${app_path} ${app_path} \
  --tmpfs /run \
  --symlink /run /var/run \
  --dev /dev \
  --chdir ${app_homedir} \
  --setenv HOME ${app_homedir} \
  --setenv USER ${app_user} \
  --setenv LOGNAME ${app_user} \
  --setenv XAUTHORITY ${app_homedir}/.Xauthority \
  --setenv SHELL /sbin/nologin \
  --unsetenv SUDO_USER \
  --unsetenv SUDO_UID \
  --unsetenv SUDO_GID \
  --unsetenv SUDO_COMMAND \
  --unsetenv OLDPWD \
  --unsetenv MAIL \
  --unshare-pid \
  --unshare-cgroup \
  --unshare-uts \
  --hostname host \
  --new-session \
  --cap-drop all \
  --seccomp 12 \
  10< <(getent passwd root ${app_user} nobody) \
  11< <(getent group root ${app_user} nobody) \
  12< ${seccomp_filter} \
  ${bwrap_args} \
  ${wrapper_dir}/${app_name} ${@}"

  ## Don't leave any left-over processes such as the D-Bus daemon.
  killall -9 -u "${app_user}"
}

setup
run_program