straycall 0.1.0

data/exe/straycall

@@ -0,0 +1,6 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+require "straycall/cli"
+
+exit Straycall::CLI.start

data/exe/straycall-supervisor

@@ -0,0 +1,29 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+health_writer = IO.for_fd(Integer(ARGV.fetch(4)))
+health_writer.sync = true
+health_writer.write("R")
+
+require "socket"
+require "seccomp/notify"
+require "straycall"
+require "straycall/supervisor"
+
+socket = UNIXSocket.for_fd(Integer(ARGV.fetch(0)))
+target_pid = Integer(ARGV.fetch(1))
+config = Marshal.load([ARGV.fetch(2)].pack("H*")) # rubocop:disable Security/MarshalLoad
+report_socket = UNIXSocket.for_fd(Integer(ARGV.fetch(3)))
+listener = Seccomp::Notify::FdPassing.recv_fd(socket)
+socket.close
+guard = Straycall::Supervisor.new(config, reporter: Straycall::Reporter::Client.new(report_socket))
+supervisor = Seccomp::Notify::Supervisor.new(
+  listener,
+  target_pid:,
+  target_child: false,
+  health_writer:,
+  concurrency: 8
+)
+guard.register(supervisor)
+health_writer.write("S")
+supervisor.run

data/lib/straycall/cli.rb

@@ -0,0 +1,73 @@
+# frozen_string_literal: true
+
+require "optparse"
+require "tmpdir"
+require_relative "../straycall"
+
+module Straycall
+  class CLI
+    def self.start(argv = ARGV)
+      new(argv).run
+    end
+
+    def initialize(argv)
+      @argv = argv.dup
+      @config_actions = []
+    end
+
+    def run
+      parse!
+      return exec(*@argv) unless Straycall.available?
+
+      require "seccomp/notify"
+      require_relative "supervisor"
+      status, violations = Supervisor.new(Straycall.config).run(@argv)
+      if Straycall.config.on_violation == :record
+        require_relative "recorder"
+        Recorder.new(@policy_path).write(violations)
+      end
+      return 1 if violations.any? { |violation| violation.action == :denied }
+
+      child_exit_code(status)
+    rescue OptionParser::ParseError, ConfigurationError => error
+      warn "straycall: #{error.message}"
+      64
+    end
+
+    private
+
+    def child_exit_code(status)
+      return 1 unless status
+
+      status.signaled? ? 128 + status.termsig : status.exitstatus
+    end
+
+    def parse!
+      parser = OptionParser.new do |options|
+        options.banner = "Usage: straycall [options] -- command [args]"
+        options.on("--config PATH") { |value| @config_path = value }
+        options.on("--[no-]backtrace") { |value| @config_actions << ->(config) { config.report_backtrace = value } }
+        options.on("--report-path PATH") { |value| @config_actions << ->(config) { config.report_path = value } }
+        options.on("--record") { @config_actions << ->(config) { config.on_violation = :record } }
+        options.on("--policy-path PATH") { |value| @policy_path = value }
+        options.on("--warn") { @config_actions << ->(config) { config.on_violation = :warn } }
+        options.on("--prompt") { @config_actions << ->(config) { config.on_violation = :prompt } }
+        options.on("--preset NAME") { |value| @config_actions << ->(config) { apply_preset(config, value) } }
+      end
+      parser.order!(@argv)
+      @argv.shift if @argv.first == "--"
+      raise OptionParser::MissingArgument, "command" if @argv.empty?
+      @policy_path ||= ".straycall.yml"
+      Straycall.config = @config_path ? Config.load(@config_path) : Straycall.config
+      @config_actions.each { |action| action.call(Straycall.config) }
+    end
+
+    def apply_preset(config, name)
+      raise ConfigurationError, "unknown preset: #{name}" unless name == "bundle-install"
+
+      config.on_violation = :prompt
+      config.allow_write_under(Dir.pwd, Dir.tmpdir, Gem.dir)
+      config.deny_write_elsewhere!
+    end
+  end
+end

data/lib/straycall/config.rb

@@ -0,0 +1,217 @@
+# frozen_string_literal: true
+
+require "yaml"
+require_relative "policy/network"
+require_relative "policy/filesystem"
+require_relative "policy/exec"
+
+module Straycall
+  class Config
+    MODES = %i[fail warn record prompt].freeze
+    TOP_LEVEL_KEYS = %w[network write exec on_violation report_backtrace report_path].freeze
+
+    def self.load(path)
+      data = YAML.safe_load_file(path, permitted_classes: [], aliases: false) || {}
+      raise ConfigurationError, "configuration must be a mapping" unless data.is_a?(Hash)
+
+      unknown = data.keys.map(&:to_s) - TOP_LEVEL_KEYS
+      raise ConfigurationError, "unknown configuration keys: #{unknown.join(", ")}" unless unknown.empty?
+
+      new.tap { |config| config.apply(data) }
+    rescue Psych::Exception => error
+      raise ConfigurationError, "invalid YAML: #{error.message}"
+    rescue SystemCallError => error
+      raise ConfigurationError, "cannot read configuration: #{error.message}"
+    end
+
+    attr_reader :network, :filesystem, :exec
+    attr_reader :report_backtrace, :report_path
+
+    def initialize
+      @network = Policy::Network.new
+      @filesystem = Policy::Filesystem.new
+      @exec = Policy::Exec.new
+      @on_violation = :fail
+      @report_backtrace = true
+      @report_path = nil
+      @allow_io_uring = false
+    end
+
+    def deny_network!
+      network.deny!
+    end
+
+    def allow_loopback(ports: nil)
+      network.allow_loopback(ports:)
+    end
+
+    def allow_unix(path)
+      network.allow_unix(path)
+    end
+
+    def allow_host(host, ports: nil)
+      network.allow_host(host, ports:)
+    end
+
+    def allow_write_under(*paths)
+      paths.each { |path| filesystem.allow_write_under(path) }
+    end
+
+    def deny_write_elsewhere!
+      filesystem.deny_write_elsewhere!
+    end
+
+    def deny_read(*paths)
+      paths.each { |path| filesystem.deny_read(path) }
+    end
+
+    def allow_exec(*paths)
+      paths.each { |path| exec.allow(path) }
+    end
+
+    def deny_exec_elsewhere!
+      exec.deny_elsewhere!
+    end
+
+    def deny_exec(*paths)
+      paths.each { |path| exec.deny(path) }
+    end
+
+    def allow_io_uring!
+      @allow_io_uring = true
+    end
+
+    def io_uring_allowed?
+      @allow_io_uring
+    end
+
+    def on_violation
+      @on_violation
+    end
+
+    def report_backtrace=(value)
+      raise ConfigurationError, "report_backtrace must be true or false" unless [true, false].include?(value)
+
+      @report_backtrace = value
+    end
+
+    def report_path=(value)
+      unless value.nil? || (value.is_a?(String) && !value.empty? && !value.include?("\0"))
+        raise ConfigurationError, "report_path must be a non-empty string without NUL bytes or nil"
+      end
+
+      @report_path = value
+    end
+
+    def on_violation=(mode)
+      mode = mode.to_sym if mode.respond_to?(:to_sym)
+      raise ConfigurationError, "on_violation must be one of: #{MODES.join(", ")}" unless MODES.include?(mode)
+
+      @on_violation = mode
+    end
+
+    def apply(data)
+      apply_network(section(data, "network")) if key?(data, "network")
+      apply_write(section(data, "write")) if key?(data, "write")
+      apply_exec(section(data, "exec")) if key?(data, "exec")
+      self.on_violation = fetch(data, "on_violation") if key?(data, "on_violation")
+      self.report_backtrace = boolean(data, "report_backtrace") if key?(data, "report_backtrace")
+      if key?(data, "report_path")
+        raise ConfigurationError, "report_path must be a string" unless fetch(data, "report_path").is_a?(String)
+
+        self.report_path = fetch(data, "report_path")
+      end
+      self
+    end
+
+    private
+
+    def apply_network(data)
+      validate_keys!(data, %w[default allow], "network")
+      default = key?(data, "default") ? fetch(data, "default") : "deny"
+      raise ConfigurationError, "network.default must be allow or deny" unless %w[allow deny].include?(default)
+
+      default == "allow" ? network.allow! : network.deny!
+      array(data, "allow").each do |rule|
+        raise ConfigurationError, "network allow rules must be mappings" unless rule.is_a?(Hash)
+        validate_keys!(rule, %w[host ports unix], "network allow rule")
+
+        unix = key?(rule, "unix")
+        host = key?(rule, "host")
+        raise ConfigurationError, "network allow rule requires exactly one of host or unix" if unix == host
+
+        if unix
+          raise ConfigurationError, "unix network allow rules cannot specify ports" if key?(rule, "ports")
+
+          path = fetch(rule, "unix")
+          allow_unix(string(path, "unix"))
+        else
+          address = fetch(rule, "host")
+          allow_host(string(address, "host"), ports: fetch(rule, "ports"))
+        end
+      end
+    end
+
+    def apply_write(data)
+      validate_keys!(data, %w[default allow deny_read], "write")
+      default = key?(data, "default") ? fetch(data, "default") : "allow"
+      raise ConfigurationError, "write.default must be allow or deny" unless %w[allow deny].include?(default)
+
+      array(data, "allow").each { |path| allow_write_under(string(path, "write.allow")) }
+      deny_write_elsewhere! if default == "deny"
+      array(data, "deny_read").each { |path| deny_read(string(path, "write.deny_read")) }
+    end
+
+    def apply_exec(data)
+      validate_keys!(data, %w[default allow deny], "exec")
+      default = key?(data, "default") ? fetch(data, "default") : "allow"
+      raise ConfigurationError, "exec.default must be allow or deny" unless %w[allow deny].include?(default)
+
+      array(data, "allow").each { |path| allow_exec(string(path, "exec.allow")) }
+      array(data, "deny").each { |path| deny_exec(string(path, "exec.deny")) }
+      deny_exec_elsewhere! if default == "deny"
+    end
+
+    def section(data, key)
+      value = fetch(data, key)
+      raise ConfigurationError, "#{key} must be a mapping" unless value.is_a?(Hash)
+
+      value
+    end
+
+    def array(data, key)
+      value = key?(data, key) ? fetch(data, key) : []
+      raise ConfigurationError, "#{key} must be an array" unless value.is_a?(Array)
+
+      value
+    end
+
+    def boolean(data, key)
+      value = fetch(data, key)
+      raise ConfigurationError, "#{key} must be true or false" unless [true, false].include?(value)
+
+      value
+    end
+
+    def string(value, label)
+      raise ConfigurationError, "#{label} must be a string" unless value.is_a?(String)
+
+      value
+    end
+
+    def validate_keys!(data, allowed, label)
+      unknown = data.keys.map(&:to_s) - allowed
+      raise ConfigurationError, "unknown #{label} keys: #{unknown.join(", ")}" unless unknown.empty?
+    end
+
+    def fetch(data, key)
+      return data[key] if data.key?(key)
+
+      data[key.to_sym]
+    end
+
+    def key?(data, key)
+      data.key?(key) || data.key?(key.to_sym)
+    end
+  end
+end

data/lib/straycall/handlers/exec.rb

@@ -0,0 +1,22 @@
+# frozen_string_literal: true
+
+module Straycall
+  module Handlers
+    module Exec
+      def handle_exec(request, dirfd_index, path_index)
+        path_address = request.args[path_index]
+        path = dirfd_index && request.read(path_address, 1) == "\0" ? "" : request.read_string(path_address)
+        dirfd = dirfd_index ? request.args[dirfd_index] : Policy::Filesystem::AT_FDCWD
+        path = @config.filesystem.resolve(path, tid: request.tid, dirfd:)
+        target = {type: "exec", path:}
+        if !@config.exec.allowed?(path) || @config.on_violation == :record
+          record_violation(request, target, %(allow_exec #{path.inspect}))
+        else
+          request.continue!(unsafe: true)
+        end
+      rescue PathResolutionError, Seccomp::Notify::MemoryReadError
+        record_violation(request, {type: "exec", path: "?"}, nil)
+      end
+    end
+  end
+end

data/lib/straycall/handlers/filesystem.rb

@@ -0,0 +1,65 @@
+# frozen_string_literal: true
+
+module Straycall
+  module Handlers
+    module Filesystem
+      def handle_openat(request)
+        handle_open(request, request.args[0], request.args[1], request.args[2])
+      end
+
+      def handle_openat2(request)
+        flags = request.read(request.args[2], 8).unpack1("Q<")
+        handle_open(request, request.args[0], request.args[1], flags)
+      end
+
+      def handle_path_mutation(request, dirfd, path_address)
+        path = resolve_path(request, dirfd, path_address)
+        target = {type: "file", path:, operation: request.syscall.to_s}
+        if !@config.filesystem.allowed_write?(path) || @config.on_violation == :record
+          record_violation(request, target, %(allow_write_under #{File.dirname(path).inspect}))
+        else
+          request.continue!(unsafe: true)
+        end
+      rescue PathResolutionError, Seccomp::Notify::MemoryReadError
+        record_violation(request, {type: "file", path: "?"}, nil)
+      end
+
+      def handle_rename(request, source_dirfd, source_address, destination_dirfd, destination_address)
+        source = resolve_path(request, source_dirfd, source_address)
+        destination = resolve_path(request, destination_dirfd, destination_address)
+        target = {type: "file", path: destination, source:, operation: request.syscall.to_s}
+        allowed = @config.filesystem.allowed_write?(source) && @config.filesystem.allowed_write?(destination)
+        if !allowed || @config.on_violation == :record
+          record_violation(request, target, %(allow_write_under #{File.dirname(destination).inspect}))
+        else
+          request.continue!(unsafe: true)
+        end
+      rescue PathResolutionError, Seccomp::Notify::MemoryReadError
+        record_violation(request, {type: "file", path: "?"}, nil)
+      end
+
+      private
+
+      def handle_open(request, dirfd, path_address, flags)
+        path = resolve_path(request, dirfd, path_address)
+        filesystem = @config.filesystem
+        write = filesystem.write?(flags)
+        denied = write ? !filesystem.allowed_write?(path) : filesystem.denied_read?(path)
+        target = {type: "file", path:, flags:}
+        if denied || (@config.on_violation == :record && write)
+          suggestion = write ? %(allow_write_under #{File.dirname(path).inspect}) : nil
+          record_violation(request, target, suggestion)
+        else
+          request.continue!(unsafe: true)
+        end
+      rescue PathResolutionError, Seccomp::Notify::MemoryReadError
+        record_violation(request, {type: "file", path: "?", flags:}, nil)
+      end
+
+      def resolve_path(request, dirfd, address)
+        path = request.read_string(address)
+        @config.filesystem.resolve(path, tid: request.tid, dirfd:)
+      end
+    end
+  end
+end

data/lib/straycall/in_process.rb

@@ -0,0 +1,74 @@
+# frozen_string_literal: true
+
+require "rbconfig"
+require "socket"
+require "seccomp/notify"
+
+module Straycall
+  module InProcess
+    module_function
+
+    def install(config, report_socket:, inherited_report_socket:)
+      transfer_socket, supervisor_socket = UNIXSocket.pair
+      health_reader, health_writer = IO.pipe
+      policy = Policy.seccomp(config)
+      flags = policy.flags
+      flags |= Seccomp::Notify::Constants::SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV if Seccomp::Notify.features[:wait_killable_recv]
+      program = Seccomp::Notify::BPF::Builder.new(policy, transfer_fd: transfer_socket.fileno).build
+
+      [supervisor_socket, report_socket, health_writer].each { |io| io.close_on_exec = false }
+      inherited_report_socket.close_on_exec = true
+      transfer_socket.close_on_exec = true
+      encoded_config = Marshal.dump(config).unpack1("H*")
+      clean_environment = ENV.keys.grep(/\A(?:BUNDLE|BUNDLER|RUBY(?:OPT|LIB))/).to_h { |name| [name, nil] }
+      load_path = [File.expand_path("..", __dir__), File.join(Gem.loaded_specs.fetch("seccomp-notify").full_gem_path, "lib")].join(File::PATH_SEPARATOR)
+      pid = Process.spawn(
+        clean_environment,
+        RbConfig.ruby,
+        "-I", load_path,
+        File.expand_path("../../exe/straycall-supervisor", __dir__),
+        supervisor_socket.fileno.to_s,
+        Process.pid.to_s,
+        encoded_config,
+        report_socket.fileno.to_s,
+        health_writer.fileno.to_s,
+        supervisor_socket.fileno => supervisor_socket.fileno,
+        report_socket.fileno => report_socket.fileno,
+        health_writer.fileno => health_writer.fileno,
+        pgroup: true
+      )
+      supervisor_socket.close
+      report_socket.close
+      health_writer.close
+      unless IO.select([health_reader], nil, nil, 5) && health_reader.read(1) == "R"
+        raise Error, "straycall supervisor failed to start"
+      end
+      health_reader.close_on_exec = false
+      ENV["SECCOMP_NOTIFY_HEALTH_FD"] = health_reader.fileno.to_s
+      @health_reader = health_reader
+
+      result = Seccomp::Notify::Libc.prctl(Seccomp::Notify::Constants::PR_SET_PTRACER, pid)
+      raise SystemCallError.new("prctl(PR_SET_PTRACER)", Fiddle.last_error) if result.negative?
+
+      listener = Seccomp::Notify::Filter.install!(program, flags:)
+      Seccomp::Notify::FdPassing.send_fd(transfer_socket, listener)
+      listener.close
+      transfer_socket.close
+      unless IO.select([health_reader], nil, nil, 5) && health_reader.read(1) == "S"
+        raise Error, "straycall supervisor failed to initialize"
+      end
+      Process.detach(pid)
+      pid
+    rescue StandardError
+      listener&.close unless listener&.closed?
+      [transfer_socket, supervisor_socket, report_socket, health_reader, health_writer].each do |io|
+        io&.close unless io&.closed?
+      end
+      if pid
+        Process.kill("KILL", pid) rescue nil
+        Process.waitpid(pid) rescue nil
+      end
+      raise
+    end
+  end
+end

data/lib/straycall/minitest.rb

@@ -0,0 +1,47 @@
+# frozen_string_literal: true
+
+require "minitest"
+require_relative "../straycall"
+
+module Straycall
+  module Minitest
+    module Hooks
+      def before_setup
+        Straycall::Minitest.ensure_supervisor!
+        file, line = method(name).source_location
+        Target.reporter&.notify_example(file:, line:, description: "#{self.class}##{name}")
+        super
+      end
+    end
+
+    module_function
+
+    def install
+      return unless Straycall.available?
+
+      require "seccomp/notify"
+      require_relative "in_process"
+      require_relative "target"
+      supervisor_socket, target_socket = UNIXSocket.pair
+      InProcess.install(Straycall.config, report_socket: supervisor_socket, inherited_report_socket: target_socket)
+      Target.start(target_socket)
+      ::Minitest::Test.prepend(Hooks)
+      ::Minitest.after_run do
+        begin
+          Straycall::Minitest.ensure_supervisor!
+          raise Error, "syscall violations were detected; see the straycall report" if Target.violation?
+        ensure
+          Target.stop
+        end
+      end
+    end
+
+    def ensure_supervisor!
+      return unless Seccomp::Notify.supervisor_alive? == false
+
+      raise Error, "straycall supervisor stopped; refusing to continue with an unmonitored suite"
+    end
+  end
+end
+
+Straycall::Minitest.install

data/lib/straycall/policy/exec.rb

@@ -0,0 +1,44 @@
+# frozen_string_literal: true
+
+module Straycall
+  module Policy
+    class Exec
+      def initialize
+        @default = :allow
+        @allowed = []
+        @denied = []
+      end
+
+      def allow(path)
+        validate_path!(path)
+        @allowed << File.expand_path(path)
+      end
+
+      def deny_elsewhere!
+        @default = :deny
+      end
+
+      def deny(path)
+        validate_path!(path)
+        @denied << File.expand_path(path)
+      end
+
+      def active?
+        @default == :deny || !@denied.empty?
+      end
+
+      def allowed?(path)
+        path = File.expand_path(path)
+        @default == :allow ? !@denied.include?(path) : @allowed.include?(path)
+      end
+
+      private
+
+      def validate_path!(path)
+        return if path.is_a?(String) && !path.empty? && !path.include?("\0")
+
+        raise ConfigurationError, "executable paths must be non-empty strings without NUL bytes"
+      end
+    end
+  end
+end