1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
|
.\" $OpenBSD: systrace.1,v 1.33 2003/05/29 00:39:12 itojun Exp $
.\"
.\" Copyright 2002 Niels Provos <provos@citi.umich.edu>
.\" All rights reserved.
.\"
.\" Redistribution and use in source and binary forms, with or without
.\" modification, are permitted provided that the following conditions
.\" are met:
.\" 1. Redistributions of source code must retain the above copyright
.\" notice, this list of conditions and the following disclaimer.
.\" 2. Redistributions in binary form must reproduce the above copyright
.\" notice, this list of conditions and the following disclaimer in the
.\" documentation and/or other materials provided with the distribution.
.\" 3. All advertising materials mentioning features or use of this software
.\" must display the following acknowledgement:
.\" This product includes software developed by Niels Provos.
.\" 4. The name of the author may not be used to endorse or promote products
.\" derived from this software without specific prior written permission.
.\"
.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
.\"
.\" Manual page, using -mandoc macros
.\"
.Dd June 3, 2002
.Dt SYSTRACE 1
.Os
.Sh NAME
.Nm systrace
.Nd generate and enforce system call policies
.Sh SYNOPSIS
.Nm systrace
.Bk -words
.Op Fl aAituU
.Op Fl d Ar policydir
.Op Fl g Ar gui
.Op Fl f Ar file
.Op Fl c Ar uid:gid
.Op Fl p Ar pid
.Ar command ...
.Ek
.Sh DESCRIPTION
The
.Nm
utility monitors and controls an application's access to the system by
enforcing access policies for system calls.
The
.Nm
utility might be used to trace an untrusted application's access to
the system.
Alternatively, it might be used to protect the system
from software bugs (such as buffer overflows) by constraining a
daemon's access to the system.
Its privilege elevation feature can be used to obviate the
need to run large, untrusted programs as root when only one or two
system calls require root privilege.
.Pp
The access policy can be generated interactively or obtained from a
policy file.
Interactive policy generation will be performed by the ``notification
user agent'', normally
.Xr xsystrace 1 ,
unless text mode is specified via
.Fl t .
.Pp
When running in ``automatic enforcement'' mode,
operations not covered by the policy raise an alarm and
allow an user to refine the currently configured policy.
.Pp
The options are as follows:
.Bl -tag -width Dfxfile
.It Fl a
Enables automatic enforcement of configured policies.
An operation not covered by policy is denied and logged via
.Xr syslog 3 .
.It Fl A
Automatically generate a policy that allows every operation the
application executes.
The created policy functions as a base that can be refined.
.It Fl u
Do not perform aliasing on system call names.
Aliasing is enabled by default to group similar system calls into a
single compound name.
For example, system calls that read from the file system
like
.Fn lstat
and
.Fn access
are translated to
.Fn fsread .
.It Fl i
Inherits the policy - child processes inherit policy of the parent binary.
.It Fl t
Uses text mode to ask for interactive policy generation.
.It Fl U
Ignore user configured policies and use only global system policies.
.It Fl d Ar policydir
Specifies an alternative location for the user's directory from
which policies are loaded and to which changed policies are stored.
.It Fl g Ar gui
Specifies an alternative location for the notification user interface.
.It Fl c Ar uid:gid
Specifies the
.Va uid
and
.Va gid
that the monitored application should be executed with,
which must be specified as non-negative integers (not as names).
This is useful in conjunction with privilege elevation and requires
root privilege.
.It Fl f Ar file
The policies specified in
.Ar file
are added to the policies that
.Nm
knows about.
.It Fl p Ar pid
Specifies the pid of a process that
.Nm
should attach to.
The full path name of the corresponding binary has to be specified
as
.Ar command .
.El
.Ss POLICY
The policy is specified via the following grammar:
.Bd -literal -offset AAA
filter = expression "then" action errorcode logcode
expression = symbol | "not" expression | "(" expression ")" |
expression "and" expression | expression "or" expression
symbol = string typeoff "match" cmdstring |
string typeoff "eq" cmdstring | string typeoff "neq" cmdstring |
string typeoff "sub" cmdstring | string typeoff "nsub" cmdstring |
string typeoff "inpath" cmdstring | string typeoff "re" cmdstring |
"true"
typeoff = /* empty */ | "[" number "]"
action = "permit" | "deny"
errorcode = /* empty */ | "[" string "]"
logcode = /* empty */ | "log"
.Ed
.Pp
The
.Va cmdstring
is an arbitrary string enclosed with quotation marks.
The
.Va errorcode
is used to return an
.Xr errno 2
value to the system call when using a
.Va deny
action.
The values
.Do
inherit
.Dc
and
.Do
detach
.Dc
have special meanings when used with a
.Va permit
rule for the
.Xr execve 2
system call.
When using
.Do
inherit,
.Dc
the current policy is inherited for the new binary.
With
.Do
detach,
.Dc
.Nm
detaches from a process after successfully
completing
the
.Xr execve 2
system call.
.Pp
The filter operations have the following meaning:
.Bl -hang -width Dinpath -offset AAA
.It match
Evaluates to true if file name globbing according to
.Xr fnmatch 3
succeeds.
.It eq
Evaluates to true if the system call argument matches
.Va cmdstring
exactly.
.It neq
This is the logical negation of
.Va eq .
.It sub
Performs a substring match on the system call argument.
.It nsub
This is the logical negation of
.Va sub .
.It inpath
Evaluates to true if the system call argument is a subpath of
.Va cmdstring .
.It re
Evaluates to true if the system call arguments matches
the specified regular expression.
.El
.Pp
By appending the
.Va log
statement to a rule, a matching system call and its arguments
are logged to
.Xr syslog 3 .
This is useful, for example, to log all invocations of the
.Xr execve 2
system call.
.Pp
Policy entries may contain an appended predicate.
Predicates have the following format:
.Bd -literal -offset AAA
", if" {"user", "group"} {"=", "!=", "<", ">" } {number, string}
.Ed
.Pp
A rule is added to the configured policy only if its predicate
evaluates to true.
.Pp
The environment variables
.Ev $HOME , $USER
and
.Ev $CWD
are substituted in rules.
Comments, begun by an unquoted '#' character and
continuing to the end of the line, are ignored.
.Sh PRIVILEGE ELEVATION
With
.Nm
it is possible to remove setuid or setgid binaries, and use the
privilege elevation feature instead.
Single system calls can be executed with higher privileges if
specified by the policy.
For example,
.Bd -literal -offset 4
native-bind: sockaddr eq "inet-[0.0.0.0]:22" then permit as root
.Ed
.Pp
allows an unprivileged application to bind to a reserved port.
Privilege elevation requires that the
.Nm
process is executed as root.
.Pp
The following statements can be appended after the
.Va permit
in a policy to elevate the privileges for the matching system call:
.Bd -literal -offset 4
as user
as user:group
as group
.Ed
.Pp
The effective
.Va uid
and
.Va gid
are elevated only for the duration of the system call, and are restored
to the old values afterwards (except for the
.Xr seteuid 2
and
.Xr setegid 2
system calls).
.Sh FILES
.Bl -tag -width xHOME/xsystrace -compact
.It Pa /dev/systrace
systrace device
.It Pa /etc/systrace
global systrace policies
.It Pa $HOME/.systrace
user specified policies, one per binary, with slashes in the full pathname
replaced by the underscore character.
.El
.Sh EXAMPLES
An excerpt from a sample
.Xr ls 1
policy might look as follows:
.Bd -literal -offset AAA
Policy: /bin/ls, Emulation: native
[...]
native-fsread: filename eq "$HOME" then permit
native-fchdir: permit
[...]
native-fsread: filename eq "/tmp" then permit
native-stat: permit
native-fsread: filename match "$HOME/*" then permit
native-fsread: filename eq "/etc/pwd.db" then permit
[...]
native-fsread: filename eq "/etc" then deny[eperm], if group != wheel
.Ed
.Sh SEE ALSO
.Xr systrace 4
.Sh AUTHORS
The
.Nm
utility was developed by Niels Provos.
.Sh BUGS
Applications that use clone()-like system calls to share the complete
address space between processes may be able to replace system call
arguments after they have been evaluated by
.Nm
and escape policy enforcement.
|