sandbox-app-launcher

#!/bin/bash

## Copyright (C) 2012 - 2020 ENCRYPTED SUPPORT LP <adrelanos@riseup.net>
## See the file COPYING for copying conditions.

set -e

app_name="${1}"
shift 1
: ${app_path:="$(type -P "${app_name}" || true)"}

if ! [[ "${app_name}" =~ [0-9a-zA-Z/] ]]; then
   echo "ERROR: Invalid character in app_name." >&2
   exit 1
fi

if ! [[ "${app_path}" =~ [0-9a-zA-Z/] ]]; then
   echo "ERROR: Invalid character in app_path." >&2
   exit 1
fi

main_app_dir="/usr/share/sandbox-app-launcher"
auto_dir="/var/cache/sandbox-app-launcher-autogenerated"
wrapper_dir="${auto_dir}/wrappers"
wrapper_dir_wx="${wrapper_dir}-wx"
wrapper_script="${wrapper_dir}/${app_name}"
appdata_dir="/home/sandbox-app-launcher-appdata"
app_user="sandbox-${app_name}"
app_homedir="${appdata_dir}/${app_name}"
seccomp_filter="${auto_dir}/seccomp-filter.bpf"
wx_whitelist="${main_app_dir}/wx_whitelist"
shared_dir="${appdata_dir}/shared"
bwrap_args=""

xsession_d_file_list_executable=(
  /etc/X11/Xsession.d/20torbrowser
  /etc/X11/Xsession.d/20uwt
  /etc/X11/Xsession.d/20whonix
  /etc/X11/Xsession.d/20whonix-welcome-page
  /etc/X11/Xsession.d/40open_link_confirmation
  /etc/X11/Xsession.d/40open_link_confirmation_kde
  /etc/X11/Xsession.d/50anon-apps-config
  /etc/X11/Xsession.d/50default_editor
  /etc/X11/Xsession.d/50tb_default_browser
  /etc/X11/Xsession.d/50torbrowser_default_browser
  /etc/X11/Xsession.d/50security-misc
)

xsession_d_file_list_existing=(
  /etc/X11/Xsession.d/20qt-gnome-desktop-session-id
  /etc/X11/Xsession.d/20qt-x11-no-mitshm
  /etc/X11/Xsession.d/25xdg-qubes-settings
)

if [ "${app_name}" = "torbrowser" ]; then
  app_path="${app_homedir}/.tb/tor-browser/Browser/start-tor-browser"
fi

error_handler() {
  echo "
## sandbox-app-launcher BUG.
## BASH_COMMAND: ${BASH_COMMAND}
## Please report this BUG!
" >&2
  exit 1
}

trap "error_handler" ERR

if ! [ "$(id -u)" = "0" ]; then
  echo "ERROR: Must run as root." >&2
  exit 1
fi

if [ -f "/etc/sandbox-app-launcher/${app_name}.conf" ]; then
  . "/etc/sandbox-app-launcher/${app_name}.conf"
fi

setup() {
  if ! [ -x "${app_path}" ] && ! [ "${app_name}" = "torbrowser" ]; then
    echo "ERROR: Could not find '${app_name}' in \$PATH." >&2
    exit 1
  fi

  if [ "${app_name}" = "shared" ]; then
    echo "ERROR: The app name cannot be 'shared'." >&2
    exit 1
  fi

  if ! [ -d "${main_app_dir}" ]; then
    mkdir -m 755 "${main_app_dir}"
  fi

  if ! [ -d "${auto_dir}" ]; then
    mkdir -m 755 "${auto_dir}"
  fi

  if ! [ -d "${wrapper_dir}" ]; then
    mkdir -m 755 "${wrapper_dir}"
  fi

  if ! [ -d "${wrapper_dir_wx}" ]; then
    mkdir -m 755 "${wrapper_dir_wx}"
  fi

  if ! [ -d "${appdata_dir}" ]; then
    mkdir -m 755 "${appdata_dir}"
  fi

  if ! [ -d "${shared_dir}" ]; then
    mkdir -m 1777 "${shared_dir}"
  fi

  if ! getent passwd | sed -e 's/:.*//g' | grep -qw "${app_user}"; then
    adduser --no-create-home --disabled-login --gecos "" "${app_user}"
  fi

  if ! [ -d "${app_homedir}" ]; then
    mkdir --parents "${app_homedir}"
  fi

  if ! [ "$(stat -c "%U" "${app_homedir}")" = "${app_user}" ]; then
    chown --recursive "${app_user}" "${app_homedir}"
  fi

  if ! [ "$(stat -c %a "${app_homedir}")" = "700" ]; then
    chmod 700 -R "${app_homedir}"
  fi

  ## Generate seccomp filter.
  compiler_flags="-lseccomp -ldl -D_GNU_SOURCE -Wdate-time -D_FORTIFY_SOURCE=2 -g -O2 -fstack-protector-all -Wformat -Werror=format-security -Wl,-z,relro -Wl,-z,now"

  if ! [ -f "${seccomp_filter}" ]; then
    "${main_app_dir}/autogen-seccomp" "${main_app_dir}/seccomp-whitelist" > "${auto_dir}/seccomp.c"
    gcc "${auto_dir}/seccomp.c" -o "${auto_dir}/seccomp" ${compiler_flags}
    chmod 700 "${auto_dir}/seccomp"
    "${auto_dir}/seccomp"
  fi

  if ! [ -f "${main_app_dir}/seccomp-filter-wx.bpf" ]; then
    "${main_app_dir}/autogen-seccomp" "${main_app_dir}/seccomp-whitelist-wx" > "${auto_dir}/seccomp-wx.c"
    str_replace "seccomp-filter.bpf" "seccomp-filter-wx.bpf" "${auto_dir}/seccomp-wx.c" >/dev/null
    gcc "${auto_dir}/seccomp-wx.c" -o "${auto_dir}/seccomp-wx" ${compiler_flags}
    chmod 700 "${auto_dir}/seccomp-wx"
    "${auto_dir}/seccomp-wx"
  fi

  ## Optionally allow dynamic native code execution.
  ##
  ## This allows creating memory mappings that are both
  ## writable and executable, allows transitioning a
  ## writable memory mapping to executable and allows
  ## executing programs from writable directories i.e.
  ## violating W^X.
  ##
  ## This is generally a security issue since it allows an
  ## attacker to execute new arbitary code so preventing this
  ## will force the attacker to use the already existing code
  ## (ROP/JOP) which is far more limited.
  ##
  ## Although, some things require this such as JIT engines in
  ## browsers so it must be optional.
  if [ "${allow_dynamic_native_code_exec}" = "yes" ]; then
    seccomp_filter="${auto_dir}/seccomp-filter-wx.bpf"
    wrapper_dir="${wrapper_dir_wx}"
  fi

  ## Create wrapper.
  cat <<EOF > "${wrapper_script}"
#!/bin/bash

for file_name in $xsession_d_file_list_executable ; do
  if [ -x "$file_name" ]; then
    source "$file_name"
  fi
done

for file_name in $xsession_d_file_list_existing ; do
  if [ -x "$file_name" ]; then
    source "$file_name"
  fi
done

dbus-launch
"${app_path}" "\${@}" 1>/dev/null
EOF

  ## Debugging.
  if [ -o xtrace ]; then
    cat "${wrapper_script}"
  fi

  chmod 755 "${wrapper_script}"
}

run_program() {
  ## TODO: X11 sandbox - not needed if we switch to wayland
  ## TODO: IPC namespace
  ## TODO: Network namespace - probably via ip netns
  ## TODO: Don't preserve the environment - env -i

  ## Optionally remove network access by creating an empty net namespace.
  if [ "${allow_net}" = "no" ]; then
    bwrap_args+="--unshare-net "
  fi

  ## Optionally allow webcam access.
  if [ "${allow_webcam}" = "yes" ]; then
    for device in /dev/video*
    do
      if [ -f "${device}" ]; then
        bwrap_args+="--dev-bind-try ${device} ${device} "
      fi
    done
  fi

  ## Optionally allow microphone access.
  if [ "${allow_mic}" = "yes" ]; then
    bwrap_args+="--dev-bind-try /dev/snd /dev/snd "
  fi

  ## Shared storage.
  if [ "${shared_storage}" = "read-write" ]; then
    bwrap_args+="--bind ${shared_dir} ${shared_dir} --bind /shared /shared "
  elif [ "${shared_storage}" = "read-only" ]; then
    bwrap_args+="--ro-bind ${shared_dir} ${shared_dir} --ro-bind /shared /shared "
  fi

  ## Install Tor Browser.
  if [ "${app_name}" = "torbrowser" ]; then
    if ! [ -d "${app_homedir}/.tb" ]; then
      sudo -H -u "${app_user}" HOME="${app_homedir}" bash -c "tb_skip_functions+=' remount_exec tb_start_tor_browser ' torbrowser"
    fi
    bwrap_args+="--ro-bind-try /run/anon-ws-disable-stacked-tor/127.0.0.1_9150.sock /run/anon-ws-disable-stacked-tor/127.0.0.1_9150.sock "
    bwrap_args+="--ro-bind-try /run/anon-ws-disable-stacked-tor/127.0.0.1_9151.sock /run/anon-ws-disable-stacked-tor/127.0.0.1_9151.sock "
  fi

  sudo -H -u "${app_user}" bash -c "
  bwrap \
  --ro-bind /bin /bin \
  --ro-bind /usr/bin /usr/bin \
  --ro-bind /lib /lib \
  --ro-bind-try /lib32 /lib32 \
  --ro-bind-try /lib64 /lib64 \
  --ro-bind /usr/lib /usr/lib \
  --ro-bind-try /usr/local/lib /usr/local/lib \
  --ro-bind /usr/share /usr/share \
  --ro-bind-try /usr/local/share /usr/local/share \
  --ro-bind /usr/include /usr/include \
  --ro-bind /etc /etc \
  --ro-bind-data 10 /etc/passwd \
  --ro-bind-data 11 /etc/group \
  --ro-bind ${main_app_dir}/machine-id /etc/machine-id \
  --ro-bind /var/lib /var/lib \
  --tmpfs /var/lib/dbus \
  --ro-bind ${main_app_dir}/machine-id /var/lib/dbus/machine-id \
  --ro-bind /sys/devices /sys/devices \
  --ro-bind /sys/class /sys/class \
  --ro-bind /sys/bus /sys/bus \
  --ro-bind /sys/fs/cgroup /sys/fs/cgroup \
  --bind ${app_homedir} ${app_homedir} \
  --proc /proc \
  --tmpfs /tmp \
  --ro-bind-try /tmp/.X11-unix /tmp/.X11-unix \
  --tmpfs /var/tmp \
  --tmpfs /var/cache \
  --ro-bind ${wrapper_script} ${wrapper_script} \
  --ro-bind ${app_path} ${app_path} \
  --tmpfs /run \
  --symlink /run /var/run \
  --dev /dev \
  --chdir ${app_homedir} \
  --setenv HOME ${app_homedir} \
  --setenv USER ${app_user} \
  --setenv LOGNAME ${app_user} \
  --setenv XAUTHORITY ${app_homedir}/.Xauthority \
  --setenv SHELL /sbin/nologin \
  --unsetenv SUDO_USER \
  --unsetenv SUDO_UID \
  --unsetenv SUDO_GID \
  --unsetenv SUDO_COMMAND \
  --unsetenv OLDPWD \
  --unsetenv MAIL \
  --unshare-pid \
  --unshare-cgroup \
  --unshare-uts \
  --hostname host \
  --new-session \
  --cap-drop all \
  --seccomp 12 \
  10< <(getent passwd root ${app_user} nobody) \
  11< <(getent group root ${app_user} nobody) \
  12< ${seccomp_filter} \
  ${bwrap_args} \
  ${wrapper_script} ${@}"

  ## Don't leave any left-over processes such as the D-Bus daemon.
  killall -9 -u "${app_user}"
}

setup
run_program