straycall 0.1.0

data/lib/straycall/policy/filesystem.rb

@@ -0,0 +1,119 @@
+# frozen_string_literal: true
+
+require "fcntl"
+
+module Straycall
+  module Policy
+    class Filesystem
+      AT_FDCWD = -100
+      WRITE_FLAGS = Fcntl::O_WRONLY | Fcntl::O_RDWR | Fcntl::O_CREAT | Fcntl::O_TRUNC | Fcntl::O_APPEND
+
+      def initialize(cache_size: 4096)
+        raise ArgumentError, "cache_size must be positive" unless cache_size.is_a?(Integer) && cache_size.positive?
+
+        @write_default = :allow
+        @write_roots = []
+        @read_denials = []
+        @cache_size = cache_size
+        @cache = {}
+        @mutex = Mutex.new
+      end
+
+      def allow_write_under(path)
+        @write_roots << normalize_config_path(path)
+        clear_cache
+      end
+
+      def deny_write_elsewhere!
+        @write_default = :deny
+        clear_cache
+      end
+
+      def deny_read(path)
+        @read_denials << normalize_config_path(path)
+        clear_cache
+      end
+
+      def active?
+        @write_default == :deny || !@read_denials.empty?
+      end
+
+      def read_denials?
+        !@read_denials.empty?
+      end
+
+      def write?(flags)
+        (flags & WRITE_FLAGS).positive?
+      end
+
+      def allowed_write?(path)
+        cached([:write, path]) do
+          @write_default == :allow || path.match?(%r{\A/proc/(?:self|\d+)/task/\d+/comm\z}) || @write_roots.any? { |root| under?(path, root) }
+        end
+      end
+
+      def denied_read?(path)
+        cached([:read, path]) { @read_denials.any? { |root| under?(path, root) } }
+      end
+
+      def resolve(path, tid:, dirfd: AT_FDCWD)
+        return File.expand_path(path) if path.start_with?(File::SEPARATOR)
+
+        base = if signed(dirfd) == AT_FDCWD
+          File.readlink("/proc/#{tid}/cwd")
+        else
+          File.readlink("/proc/#{tid}/fd/#{signed(dirfd)}")
+        end
+        File.expand_path(path, base)
+      rescue SystemCallError => error
+        raise PathResolutionError, "cannot resolve target path through /proc: #{error.message}"
+      end
+
+      def marshal_dump
+        [@write_default, @write_roots, @read_denials, @cache_size]
+      end
+
+      def marshal_load(values)
+        @write_default, @write_roots, @read_denials, @cache_size = values
+        @cache = {}
+        @mutex = Mutex.new
+      end
+
+      private
+
+      def normalize_config_path(path)
+        unless path.is_a?(String) && !path.empty? && !path.include?("\0")
+          raise ConfigurationError, "filesystem paths must be non-empty strings without NUL bytes"
+        end
+
+        File.expand_path(path)
+      end
+
+      def signed(value)
+        value >= (1 << 63) ? value - (1 << 64) : value
+      end
+
+      def under?(path, root)
+        path == root || path.start_with?("#{root}#{File::SEPARATOR}")
+      end
+
+      def cached(key)
+        @mutex.synchronize do
+          if @cache.key?(key)
+            value = @cache.delete(key)
+            @cache[key] = value
+            return value
+          end
+
+          @cache[key] = yield
+          @cache.shift if @cache.length > @cache_size
+          @cache[key]
+        end
+      end
+
+      def clear_cache
+        @mutex.synchronize { @cache.clear }
+      end
+    end
+  end
+end

data/lib/straycall/policy/network.rb

@@ -0,0 +1,83 @@
+# frozen_string_literal: true
+
+require "ipaddr"
+require "socket"
+
+module Straycall
+  module Policy
+    class Network
+      Rule = Struct.new(:address, :ports)
+
+      def initialize
+        @default = :deny
+        @inet = []
+        @unix = []
+      end
+
+      def deny!
+        @default = :deny
+      end
+
+      def allow!
+        @default = :allow
+      end
+
+      def allow_loopback(ports: nil)
+        add_inet(IPAddr.new("127.0.0.0/8"), ports)
+        add_inet(IPAddr.new("::1"), ports)
+      end
+
+      def allow_unix(path)
+        unless path.is_a?(String) && !path.empty? && !path.include?("\0")
+          raise ConfigurationError, "Unix socket paths must be non-empty strings without NUL bytes"
+        end
+
+        @unix << File.expand_path(path)
+      end
+
+      def allow_host(host, ports: nil)
+        unless host.is_a?(String) && !host.empty? && !host.include?("\0")
+          raise ConfigurationError, "hosts must be non-empty strings without NUL bytes"
+        end
+
+        Addrinfo.getaddrinfo(host, nil, nil, Socket::SOCK_STREAM).filter_map do |address|
+          add_inet(IPAddr.new(address.ip_address), ports) if address.ip?
+        end
+      rescue SocketError => error
+        raise ConfigurationError, "cannot resolve host #{host.inspect}: #{error.message}"
+      end
+
+      def allowed?(address)
+        return true if @default == :allow
+        return @unix.any? { |prefix| address.unix_path.start_with?(prefix) } if address.unix?
+        return false unless address.ip?
+
+        ip = IPAddr.new(address.ip_address.split("%", 2).first)
+        @inet.any? do |rule|
+          rule.address.include?(ip) && (rule.ports.nil? || rule.ports.any? { |port| port === address.ip_port })
+        end
+      end
+
+      def allow_all?
+        @default == :allow
+      end
+
+      private
+
+      def add_inet(address, ports)
+        @inet << Rule.new(address, normalize_ports(ports))
+      end
+
+      def normalize_ports(ports)
+        return if ports.nil?
+
+        Array(ports).each do |port|
+          next if port.is_a?(Range) && port.begin.is_a?(Integer) && port.end.is_a?(Integer) && port.begin.between?(1, port.end) && port.end <= 65_535
+          next if port.is_a?(Integer) && (1..65_535).cover?(port)
+
+          raise ConfigurationError, "ports must contain integers or ranges between 1 and 65535"
+        end.freeze
+      end
+    end
+  end
+end

data/lib/straycall/policy.rb

@@ -0,0 +1,45 @@
+# frozen_string_literal: true
+
+module Straycall
+  module Policy
+    FORBIDDEN_NOTIFY = %i[read write recvfrom ppoll poll select futex clock_nanosleep rt_sigreturn].freeze
+
+    module_function
+
+    FILESYSTEM_NOTIFY = %i[openat openat2 unlinkat renameat renameat2 mkdirat].freeze
+    LEGACY_FILESYSTEM_NOTIFY = %i[open creat unlink rename mkdir].freeze
+    EXEC_NOTIFY = %i[execve execveat].freeze
+
+    def seccomp(config)
+      notified = notification_names(config)
+      validate_notified!(*notified)
+
+      conditional = []
+      conditional << :openat if notified.include?(:openat) && !config.filesystem.read_denials?
+      conditional << :open if notified.include?(:open) && !config.filesystem.read_denials?
+      Seccomp::Notify::Policy.new(deny_io_uring: !config.io_uring_allowed?) do
+        notify(*(notified - conditional))
+        notify_if(:openat, argument: 2, mask: Policy::Filesystem::WRITE_FLAGS) if conditional.include?(:openat)
+        notify_if(:open, argument: 1, mask: Policy::Filesystem::WRITE_FLAGS) if conditional.include?(:open)
+        deny :ptrace
+      end
+    end
+
+    def notification_names(config)
+      names = %i[socket connect bind listen sendto sendmsg sendmmsg]
+      if config.filesystem.active? || config.on_violation == :record
+        names.concat(FILESYSTEM_NOTIFY)
+        names.concat(LEGACY_FILESYSTEM_NOTIFY) if RUBY_PLATFORM.include?("linux") && RUBY_PLATFORM.include?("x86_64")
+      end
+      names.concat(EXEC_NOTIFY) if config.exec.active? || config.on_violation == :record
+      names
+    end
+
+    def validate_notified!(*names)
+      invalid = names.map(&:to_sym) & FORBIDDEN_NOTIFY
+      raise ConfigurationError, "cannot notify reporter syscall(s): #{invalid.join(", ")}" unless invalid.empty?
+
+      true
+    end
+  end
+end

data/lib/straycall/prompt.rb

@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+
+module Straycall
+  class Prompt
+    def initialize(io = nil)
+      @io = io
+      @mutex = Mutex.new
+    end
+
+    def allow?(syscall, target)
+      io = nil
+      @mutex.synchronize do
+        io = @io || File.open("/dev/tty", "r+")
+        io.print("straycall: allow #{syscall}(2) → #{target}? [y/N] ")
+        io.flush
+        %w[y yes].include?(io.gets.to_s.strip.downcase)
+      end
+    rescue IOError, SystemCallError
+      false
+    ensure
+      io&.close if !@io && io && !io.closed?
+    end
+  end
+end

data/lib/straycall/recorder.rb

@@ -0,0 +1,38 @@
+# frozen_string_literal: true
+
+require "yaml"
+require "fileutils"
+
+module Straycall
+  class Recorder
+    def initialize(path = ".straycall.yml")
+      @path = path
+    end
+
+    def write(violations)
+      network = violations.filter_map do |item|
+        next unless item.target[:type] == "inet" && item.target[:host] != "?"
+
+        {"host" => item.target[:host]}.tap do |rule|
+          rule["ports"] = [item.target[:port]] if (1..65_535).cover?(item.target[:port])
+        end
+      end.uniq
+      unix = violations.filter_map { |item| item.target[:path] if item.target[:type] == "unix" && item.target[:path] != "?" }.uniq
+      writes = violations.filter_map do |item|
+        File.dirname(item.target[:path]) if item.target[:type] == "file" && item.target[:path] != "?"
+      end.uniq
+      executables = violations.filter_map do |item|
+        item.target[:path] if item.target[:type] == "exec" && item.target[:path] != "?"
+      end.uniq
+      policy = {
+        "network" => {"default" => "deny", "allow" => network + unix.map { |path| {"unix" => path} }},
+        "write" => {"default" => "deny", "allow" => writes},
+        "exec" => {"default" => "deny", "allow" => executables},
+        "on_violation" => "fail"
+      }
+      FileUtils.mkdir_p(File.dirname(@path))
+      File.write(@path, YAML.dump(policy))
+      @path
+    end
+  end
+end

data/lib/straycall/report/console.rb

@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+module Straycall
+  module Report
+    class Console
+      def initialize(io = $stderr)
+        @io = io
+      end
+
+      def violation(item)
+        @io.puts("straycall: #{item.syscall}(2) → #{target(item.target)}")
+        @io.puts("  #{item.example[:file]}:#{item.example[:line]} #{item.example[:description]}") if item.example
+        Array(item.backtrace).each { |line| @io.puts("    #{line}") }
+        @io.puts("  origin: #{item.origin}") if item.origin
+        @io.puts("  hint: #{item.suggestion}") if item.suggestion
+      end
+
+      private
+
+      def target(value)
+        return value[:path] if %w[unix file exec].include?(value[:type])
+        return "socket domain #{value[:domain]}" if value[:domain]
+        return "socket fd #{value[:fd]}" if value[:type] == "socket"
+
+        "#{value[:host]}:#{value[:port]}"
+      end
+    end
+  end
+end

data/lib/straycall/report/json.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+require "fileutils"
+require "json"
+
+module Straycall
+  module Report
+    class JSON
+      def initialize(path)
+        @path = path
+      end
+
+      def write(violations)
+        FileUtils.mkdir_p(File.dirname(@path))
+        File.write(@path, ::JSON.pretty_generate(version: 1, violations: violations.map(&:to_h)) << "\n")
+      end
+    end
+  end
+end

data/lib/straycall/reporter/client.rb

@@ -0,0 +1,102 @@
+# frozen_string_literal: true
+
+require_relative "protocol"
+
+module Straycall
+  module Reporter
+    class Client
+      def initialize(socket, timeout: 0.2)
+        @socket = socket
+        @reader = Protocol::Reader.new(socket)
+        @timeout = timeout
+        @mutex = Mutex.new
+        @alive = true
+      end
+
+      def example
+        return @example unless @alive
+
+        @mutex.synchronize do
+          @socket.write(Protocol.sync_request)
+          read_ack
+          @example
+        end
+      rescue IOError, SystemCallError
+        @alive = false
+        @example
+      end
+
+      def backtrace(tid)
+        return unless @alive
+
+        @mutex.synchronize do
+          @socket.write(Protocol.backtrace_request(tid))
+          read_backtrace(tid)
+        end
+      rescue IOError, SystemCallError
+        @alive = false
+        nil
+      end
+
+      def notify_violation
+        @mutex.synchronize do
+          if @alive
+            @socket.write("VIOLATION\n")
+            read_ack
+          else
+            @socket.write_nonblock("VIOLATION\n", exception: false)
+          end
+        end
+      rescue IOError, SystemCallError
+        @alive = false
+      end
+
+      def close
+        @socket.close unless @socket.closed?
+      end
+
+      private
+
+      def read_backtrace(tid)
+        deadline = Process.clock_gettime(Process::CLOCK_MONOTONIC) + @timeout
+        loop do
+          remaining = deadline - Process.clock_gettime(Process::CLOCK_MONOTONIC)
+          return if remaining <= 0
+
+          line = @reader.read(timeout: remaining)
+          unless line
+            @alive = false
+            return
+          end
+
+          type, value, payload = Protocol.parse(line)
+          case type
+          when :backtrace
+            return payload if value == tid
+          when :example
+            @example = value
+          end
+        end
+      end
+
+      def read_ack
+        deadline = Process.clock_gettime(Process::CLOCK_MONOTONIC) + @timeout
+        loop do
+          remaining = deadline - Process.clock_gettime(Process::CLOCK_MONOTONIC)
+          return if remaining <= 0
+
+          line = @reader.read(timeout: remaining)
+          unless line
+            @alive = false
+            return
+          end
+
+          type, value = Protocol.parse(line)
+          return if type == :ack
+
+          @example = value if type == :example
+        end
+      end
+    end
+  end
+end

data/lib/straycall/reporter/protocol.rb

@@ -0,0 +1,79 @@
+# frozen_string_literal: true
+
+require "json"
+
+module Straycall
+  module Reporter
+    module Protocol
+      class Reader
+        LIMIT = 64 * 1024
+
+        def initialize(socket)
+          @socket = socket
+          @buffer = String.new(capacity: LIMIT)
+          @chunk = String.new(capacity: 4096)
+        end
+
+        def read(timeout: nil)
+          deadline = Process.clock_gettime(Process::CLOCK_MONOTONIC) + timeout if timeout
+          loop do
+            if (newline = @buffer.index("\n"))
+              return @buffer.slice!(0, newline + 1)
+            end
+            if deadline
+              remaining = deadline - Process.clock_gettime(Process::CLOCK_MONOTONIC)
+              return if remaining <= 0 || !IO.select([@socket], nil, nil, remaining)
+            end
+
+            @socket.readpartial(4096, @chunk)
+            raise IOError, "reporter message exceeds #{LIMIT} bytes" if @buffer.bytesize + @chunk.bytesize > LIMIT
+
+            @buffer << @chunk
+          end
+        rescue EOFError
+          nil
+        end
+      end
+
+      module_function
+
+      def backtrace_request(tid)
+        "BT #{Integer(tid)}\n"
+      end
+
+      def backtrace_response(tid, backtrace)
+        payload = backtrace ? JSON.generate(backtrace) : "-"
+        "BT #{Integer(tid)} #{payload}\n"
+      end
+
+      def example(value)
+        "EXAMPLE #{JSON.generate(value)}\n"
+      end
+
+      def sync_request
+        "SYNC\n"
+      end
+
+      def parse(line)
+        type, rest = line.to_s.chomp.split(" ", 2)
+        case type
+        when "BT"
+          tid, payload = rest.to_s.split(" ", 2)
+          [:backtrace, Integer(tid), payload && payload != "-" ? JSON.parse(payload) : nil]
+        when "EXAMPLE"
+          [:example, JSON.parse(rest, symbolize_names: true)]
+        when "VIOLATION"
+          [:violation]
+        when "SYNC"
+          [:sync]
+        when "OK"
+          [:ack]
+        else
+          [:unknown]
+        end
+      rescue ArgumentError, JSON::ParserError
+        [:unknown]
+      end
+    end
+  end
+end

data/lib/straycall/reporter/symbolizer.rb

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+module Straycall
+  module Reporter
+    module Symbolizer
+      module_function
+
+      def call(tid, instruction_pointer, maps: nil)
+        lines = maps ? maps.each_line : File.foreach("/proc/#{Integer(tid)}/maps")
+        lines.each do |line|
+          range, _permissions, file_offset, _device, _inode, path = line.split(nil, 6)
+          start_address, end_address = range.split("-", 2).map { |value| Integer(value, 16) }
+          next unless (start_address...end_address).cover?(instruction_pointer)
+
+          return unless path
+
+          offset = instruction_pointer - start_address + Integer(file_offset, 16)
+          return "#{path.strip}+0x#{offset.to_s(16)}"
+        end
+        nil
+      rescue ArgumentError, Errno::ENOENT, Errno::EACCES
+        nil
+      end
+    end
+  end
+end

data/lib/straycall/reporter/thread_reporter.rb

@@ -0,0 +1,73 @@
+# frozen_string_literal: true
+
+require_relative "protocol"
+
+module Straycall
+  module Reporter
+    class ThreadReporter
+      attr_reader :thread
+
+      def initialize(socket)
+        @socket = socket
+        @reader = Protocol::Reader.new(socket)
+        @write_mutex = Mutex.new
+        @violation = false
+      end
+
+      def start
+        return self unless RUBY_ENGINE == "ruby" && Thread.current.respond_to?(:native_thread_id)
+
+        ready = Queue.new
+        @thread = Thread.new { ready << true; run }
+        @thread.name = "straycall-reporter" if @thread.respond_to?(:name=)
+        ready.pop
+        self
+      end
+
+      def notify_example(example)
+        @example = Protocol.example(example)
+      end
+
+      def violation?
+        return true if @violation
+
+        pending = @socket.recv_nonblock(Protocol::Reader::LIMIT, Socket::MSG_PEEK, exception: false)
+        pending.is_a?(String) && pending.match?(/(?:\A|\n)VIOLATION\n/)
+      rescue IOError, SystemCallError
+        false
+      end
+
+      def stop
+        @socket.close unless @socket.closed?
+        @thread&.join(0.2)
+      end
+
+      private
+
+      def run
+        while (line = @reader.read)
+          type, tid = Protocol.parse(line)
+          case type
+          when :backtrace
+            target = Thread.list.find { |candidate| candidate != Thread.current && candidate.native_thread_id == tid }
+            write(Protocol.backtrace_response(tid, target&.backtrace))
+          when :violation
+            @violation = true
+            write("OK\n")
+          when :sync
+            write(@example) if @example
+            write("OK\n")
+          end
+        end
+      rescue IOError, SystemCallError
+        nil
+      end
+
+      def write(message)
+        @write_mutex.synchronize { @socket.write(message) }
+      rescue IOError, SystemCallError
+        nil
+      end
+    end
+  end
+end

data/lib/straycall/rspec.rb

@@ -0,0 +1,51 @@
+# frozen_string_literal: true
+
+require "rspec/core"
+require_relative "../straycall"
+
+module Straycall
+  module RSpec
+    module_function
+
+    def install
+      return unless Straycall.available?
+
+      require "seccomp/notify"
+      require_relative "in_process"
+      require_relative "target"
+      supervisor_socket, target_socket = UNIXSocket.pair
+      InProcess.install(Straycall.config, report_socket: supervisor_socket, inherited_report_socket: target_socket)
+      Target.start(target_socket)
+      configure_hooks
+    end
+
+    def configure_hooks
+      ::RSpec.configure do |config|
+        config.before do |example|
+          Straycall::RSpec.ensure_supervisor!
+          Target.reporter&.notify_example(
+            file: example.metadata[:file_path],
+            line: example.metadata[:line_number],
+            description: example.full_description
+          )
+        end
+        config.after(:suite) do
+          begin
+            Straycall::RSpec.ensure_supervisor!
+            raise Error, "syscall violations were detected; see the straycall report" if Target.violation?
+          ensure
+            Target.stop
+          end
+        end
+      end
+    end
+
+    def ensure_supervisor!
+      return unless Seccomp::Notify.supervisor_alive? == false
+
+      raise Error, "straycall supervisor stopped; refusing to continue with an unmonitored suite"
+    end
+  end
+end
+
+Straycall::RSpec.install