Internal change

PiperOrigin-RevId: 752483547
Change-Id: I87b566f42825a885a3a980c6bacae3ec6966cba1

Author: Sandboxed API Team

sandboxed_api/sandbox2/policy.cc

@@ -23,6 +23,7 @@
 #include <linux/seccomp.h>
 #include <sched.h>
 #include <sys/mman.h>
+#include <sys/ptrace.h>
 #include <syscall.h>
 
 #include <cerrno>
@@ -188,6 +189,21 @@ std::vector<sock_filter> Policy::GetDefaultPolicy(
   policy.insert(policy.end(), {SYSCALL(internal::kMagicSyscallNo,
                                        ERRNO(internal::kMagicSyscallErr))});
 
+  // If the user has explicitly allowed unsafe ptrace operations needed for
+  // collecting core dumps, then we allow these.
+  if (allow_unsafe_coredump_ptrace_) {
+    policy.insert(policy.end(), {
+                                    JNE32(__NR_ptrace, JUMP(&l, past_ptrace_l)),
+                                    ARG_32(0),
+                                    JEQ32(PTRACE_DETACH, ALLOW),
+                                    JEQ32(PTRACE_PEEKDATA, ALLOW),
+                                    JEQ32(PTRACE_ATTACH, ALLOW),
+                                    JEQ32(PTRACE_GETREGSET, ALLOW),
+                                    JEQ32(PTRACE_PEEKUSER, ALLOW),
+                                    LOAD_SYSCALL_NR,
+                                    LABEL(&l, past_ptrace_l),
+                                });
+  }
   // Forbid ptrace because it's unsafe or too risky. The user policy can only
   // block (i.e. return an error instead of killing the process) but not allow
   // ptrace. This uses LOAD_SYSCALL_NR from above.

sandboxed_api/sandbox2/policy.h

@@ -99,6 +99,7 @@ class Policy final {
 
   bool allow_map_exec_ = false;
   bool allow_safe_bpf_ = false;
+  bool allow_unsafe_coredump_ptrace_ = false;
   bool allow_speculation_ = false;
 
   // The policy set by the user.

sandboxed_api/sandbox2/policybuilder.cc

@@ -1472,8 +1472,15 @@ absl::StatusOr<std::unique_ptr<Policy>> PolicyBuilder::TryBuild() {
                                    allow_mount_propagation_);
   }
 
+  if (user_policy_handles_ptrace_ && allow_unsafe_coredump_ptrace_) {
+    return absl::FailedPreconditionError(
+        "Cannot set both user_policy_handles_ptrace_ and "
+        "allow_unsafe_coredump_ptrace_.");
+  }
+
   policy->allow_map_exec_ = allow_map_exec_;
   policy->allow_safe_bpf_ = allow_safe_bpf_;
+  policy->allow_unsafe_coredump_ptrace_ = allow_unsafe_coredump_ptrace_;
   policy->allow_speculation_ = allow_speculation_;
   policy->collect_stacktrace_on_signal_ = collect_stacktrace_on_signal_;
   policy->collect_stacktrace_on_violation_ = collect_stacktrace_on_violation_;

sandboxed_api/sandbox2/policybuilder.h

@@ -50,6 +50,7 @@ class AllowAllSyscalls;
 class NamespacesToken;
 class LoadUserBpfCodeFromFile;
 class MapExec;
+class UnsafeCoreDumpPtrace;
 class SeccompSpeculation;
 class TraceAllSyscalls;
 class UnrestrictedNetworking;
@@ -1023,6 +1024,8 @@ class PolicyBuilder final {
   NetNsMode netns_mode_ = NETNS_MODE_UNSPECIFIED;
   bool allow_map_exec_ = true;  //  Temporary default while we migrate users.
   bool allow_safe_bpf_ = false;
+  // Temporary while coredump collection is migrated away from ptrace.
+  bool allow_unsafe_coredump_ptrace_ = false;
   bool allow_speculation_ = false;
   bool allow_mount_propagation_ = false;
   std::string hostname_ = std::string(kDefaultHostname);