SYSTRACE(1) | General Commands Manual | SYSTRACE(1) |
systrace
—
generate and enforce system call policies
systrace |
[-AaCeitUuV ] [-c
user:group]
[-d policydir]
[-E logfile]
[-f file]
[-g gui]
[-p pid]
command ... |
The systrace
utility monitors and controls
an application's access to the system by enforcing access policies for
system calls. The systrace
utility might be used to
trace an untrusted application's access to the system. Alternatively, it
might be used to protect the system from software bugs (such as buffer
overflows) by constraining a daemon's access to the system. Its privilege
elevation feature can be used to obviate the need to run large, untrusted
programs as root when only one or two system calls require root
privilege.
The access policy can be generated interactively or obtained from
a policy file. Interactive policy generation will be performed by the
“notification user agent”, normally
xsystrace(1), unless text
mode is specified via -t
.
When running in “automatic enforcement” mode, operations not covered by the policy raise an alarm and allow a user to refine the currently configured policy.
The options are as follows:
-A
-a
-e
flag is
specified.-C
systrace
in cradle mode; currently, when
multiple processes are started with systrace protection, each
systrace
starts its own UI (user interface)
process. Cradle mode allows a user to attach all
systrace
processes to one UI. This may be useful,
for example, in scenarios where systrace
is being
heavily used. If a cradle server is not running, one is launched.-c
user:group-d
policydir-E
logfile-e
-f
filesystrace
knows about. The dirname in
the policy may contain an "*" to match any possible pathname.
The wildcard is removed from the policy database the first time that a
filename matches.-g
gui-i
-p
pidsystrace
should attach to. The full path name of the corresponding binary has to be
specified as command.-t
-U
-u
lstat
()
and
access
()
are translated to
fsread
().-V
systrace
.The policy is specified via the following grammar:
filter = expression "then" action errorcode logcode expression = symbol | "not" expression | "(" expression ")" | expression "and" expression | expression "or" expression symbol = string typeoff "match" cmdstring | string typeoff "eq" cmdstring | string typeoff "neq" cmdstring | string typeoff "sub" cmdstring | string typeoff "nsub" cmdstring | string typeoff "inpath" cmdstring | string typeoff "re" cmdstring | "true" typeoff = /* empty */ | "[" number "]" action = "permit" | "deny" | "ask" errorcode = /* empty */ | "[" string "]" logcode = /* empty */ | "log"
The cmdstring is an arbitrary string
enclosed with quotation marks. The errorcode is used
to return an errno(2) value to
the system call when using a deny action. The values
“inherit” and “detach” have special meanings
when used with a permit rule for the
execve system call. When using
“inherit,” the current policy is inherited for the new binary.
With “detach,” systrace
detaches from
a process after successfully completing the execve
system call.
The ask action specifies that the user should be prompted for a decision every time that the rule matches.
The filter operations have the following meaning:
By appending the log statement to a rule, a matching system call and its arguments are logged. This is useful, for example, to log all invocations of the execve system call.
Policy entries may contain an appended predicate. Predicates have the following format:
", if" {"user", "group"} {"=", "!=", "<", ">" } {number, string}
A rule is added to the configured policy only if its predicate evaluates to true.
The environment variables $HOME
,
$USER
and $CWD
are
substituted in rules. Comments, begun by an unquoted ‘#’
character and continuing to the end of the line, are ignored.
With systrace
it is possible to remove
setuid or setgid binaries, and use the privilege elevation feature instead.
Single system calls can be executed with higher privileges if specified by
the policy. For example,
native-bind: sockaddr eq "inet-[0.0.0.0]:22" then permit as root
allows an unprivileged application to bind to a reserved port.
Privilege elevation requires that the systrace
process is executed as root.
The following statements can be appended after the permit in a policy to elevate the privileges for the matching system call:
as user as user:group as :group
The effective uid and gid are elevated only for the duration of the system call, and are restored to the old values afterwards (except for the seteuid or setegid system calls).
An excerpt from a sample ls(1) policy might look as follows:
Policy: /bin/ls, Emulation: native [...] native-fsread: filename eq "$HOME" then permit native-fchdir: permit [...] native-fsread: filename eq "/tmp" then permit native-stat: permit native-fsread: filename match "$HOME/*" then permit native-fsread: filename eq "/etc/pwd.db" then permit [...] native-fsread: filename eq "/etc" then deny[eperm], if group != wheel
The systrace
utility was developed by
Niels Provos.
Applications that use clone()-like system calls to share the
complete address space between processes may be able to replace system call
arguments after they have been evaluated by systrace
and escape policy enforcement.
September 12, 2015 | OpenBSD-5.9 |