sandbox profile question

Questions and Answers about all things *OS (macOS, iOS, tvOS, watchOS)

sandbox profile question

Postby scknight » Wed Aug 22, 2018 1:55 pm

I'm using sandbox_exec to look at the compiled sandbox format. I have a short profile that I compiled

Code: Select all
(version 1)
(deny default)
(allow file-read*
   (regex #"/bin/*")
   (vnode-type REGULAR-FILE))

I would expect that all operations other than the file-read related ones would denied since I have specified deny default. Looking at the compiled file though there seem to be some operations that just default to being allowed. Here's a snippet from a tool I'm working on

Code: Select all
0x0027: mach-task-name
0x0027: signal

0x0028: file-read*
0x0028: file-read-data
0x0028: file-read-metadata
0x0028: file-read-xattr

0x002a: darwin-notification-post
0x002a: dynamic-code-generation
0x002a: file-clone
0x002a: file-link
0x002a: file-map-executable
0x002a: file-test-existence
0x002a: iokit-get-properties
0x002a: mach-cross-domain-lookup
0x002a: nvram*
0x002a: nvram-delete
0x002a: nvram-get
0x002a: nvram-set
0x002a: process-info*
0x002a: process-info-codesignature
0x002a: process-info-dirtycontrol
0x002a: process-info-listpids
0x002a: process-info-rusage
0x002a: process-info-pidinfo
0x002a: process-info-pidfdinfo
0x002a: process-info-pidfileportinfo
0x002a: process-info-setcontrol
0x002a: socket-ioctl
0x002a: system-privilege

0x002b: default
0x002b: appleevent-send
0x002b: authorization-right-obtain
0x002b: boot-arg-set
0x002b: device*
0x002b: device-camera
0x002b: device-microphone
0x002b: distributed-notification-post
0x002b: file*
0x002b: file-chroot
0x002b: file-ioctl
0x002b: file-issue-extension
0x002b: file-mknod
0x002b: file-mount
0x002b: file-mount-update
0x002b: file-revoke
0x002b: file-search
0x002b: file-unmount
0x002b: file-write*
0x002b: file-write-acl
0x002b: file-write-create
0x002b: file-write-data
0x002b: file-write-finderinfo
0x002b: file-write-flags
0x002b: file-write-mode
0x002b: file-write-owner
0x002b: file-write-setugid
0x002b: file-write-times
0x002b: file-write-unlink
0x002b: file-write-xattr
0x002b: fs-rename
0x002b: fs-snapshot*
0x002b: fs-snapshot-create
0x002b: fs-snapshot-delete
0x002b: fs-snapshot-revert
0x002b: generic-issue-extension
0x002b: qtn-user
0x002b: hid-control
0x002b: iokit*
0x002b: iokit-issue-extension
0x002b: iokit-open
0x002b: iokit-set-properties
0x002b: ipc*
0x002b: ipc-posix*
0x002b: ipc-posix-issue-extension
0x002b: ipc-posix-sem*
0x002b: ipc-posix-sem-create
0x002b: ipc-posix-sem-open
0x002b: ipc-posix-sem-post
0x002b: ipc-posix-sem-unlink
0x002b: ipc-posix-sem-wait
0x002b: ipc-posix-shm*
0x002b: ipc-posix-shm-read*
0x002b: ipc-posix-shm-read-data
0x002b: ipc-posix-shm-read-metadata
0x002b: ipc-posix-shm-write*
0x002b: ipc-posix-shm-write-create
0x002b: ipc-posix-shm-write-data
0x002b: ipc-posix-shm-write-unlink
0x002b: ipc-sysv*
0x002b: ipc-sysv-msg
0x002b: ipc-sysv-sem
0x002b: ipc-sysv-shm
0x002b: job-creation
0x002b: load-unsigned-code
0x002b: lsopen
0x002b: mach*
0x002b: mach-host*
0x002b: mach-host-exception-port-set
0x002b: mach-host-special-port-set
0x002b: mach-issue-extension
0x002b: mach-lookup
0x002b: mach-per-user-lookup
0x002b: mach-priv*
0x002b: mach-priv-host-port
0x002b: mach-priv-task-port
0x002b: mach-register
0x002b: network*
0x002b: network-inbound
0x002b: network-bind
0x002b: network-outbound
0x002b: opendirectory-user-modify
0x002b: process*
0x002b: process-codesigning-status*
0x002b: process-codesigning-status-set
0x002b: process-codesigning-status-get
0x002b: process-exec*
0x002b: process-exec-interpreter
0x002b: process-fork
0x002b: pseudo-tty
0x002b: sysctl*
0x002b: sysctl-read
0x002b: sysctl-write
0x002b: system*
0x002b: system-acct
0x002b: system-audit
0x002b: system-automount
0x002b: system-chud
0x002b: system-debug
0x002b: system-fsctl
0x002b: system-info
0x002b: system-kext*
0x002b: system-kext-load
0x002b: system-kext-unload
0x002b: system-kext-query
0x002b: system-mac-label
0x002b: system-nfssvc
0x002b: system-package-check
0x002b: system-reboot
0x002b: system-sched
0x002b: system-set-time
0x002b: system-socket
0x002b: system-suspend-resume
0x002b: system-swap
0x002b: user-preference*
0x002b: user-preference-read
0x002b: managed-preference-read
0x002b: user-preference-write
0x002b: storage-class-map

0x0027: (00 0e 0001 002a 002b) target
0x0028: (00 1d 0001 002a 0029) vnode-type
0x0029: (00 81 0000 002a 002b) regex
0x002a: (01 00 0000 0000 0000) allow
0x002b: (01 05 0000 0000 0000) deny

Things like dynamic-code-allocation, nvram and all the process operations seem to correspond with a terminal operation node that corresponds with allow.

Is there something in the system sandbox compilation code that always has additional things defined? Is it the standard policy from libsandbox.dylib? Looking for that policy it looks like that might make sense. here's the standard policy

Code: Select all
;;;;; Standard policy applied to all sandboxed processes.
;;;;; Copyright (c) 2014-2018 Apple Inc. All rights reserved.
(version 1)
(define (allowed? op)
  (sbpl-operation-can-return? op 'allow))
(define (denied? op)
  (sbpl-operation-can-return? op 'deny))
  ((orig-finalize %finalize)
     (lambda ()
       (if (allowed? storage-class-map)
         (error "storage class definition not permitted in this context"))
  (set! %finalize run-func-then-finalize))
;; Always allow a process to signal itself.
(allow signal (target self))
;; Always allow a process to get its own task-name port.
(allow mach-task-name (target self))
Posts: 56
Joined: Thu Nov 10, 2016 1:01 pm

Re: sandbox profile question

Postby scknight » Wed Aug 22, 2018 2:51 pm

Also the output above is from 10.14. Apparently the data was shifted around in the terminal nodes. Prior to 10.14 the above code compiles with the terminal nodes data laid out like this

Code: Select all
0100 0000 0000 0000
0100 0500 0000 0000

As of 10.14 it's now laid out like this

Code: Select all
0100 0000 0000 0000
0105 0000 0000 0000
Posts: 56
Joined: Thu Nov 10, 2016 1:01 pm

Re: sandbox profile question

Postby morpheus » Fri Aug 24, 2018 5:14 pm

AAPL keeps changing the format, owing to the number of operations and operation names being modified with each version. Both are hard coded into the kext and libsandbox, but the impact is that generic decompilation tools - which don't have access to that information - end up buggy at best and crashing at worst. That's why I coded that compile option into sandbox-exec : I use it a lot myself.

There is, in fact, a standard policy, so irrespective of your profile it will be applied first. You can get it by compiling an empty profile with my modified sandbox-exec.
Site Admin
Posts: 694
Joined: Thu Apr 11, 2013 6:24 pm

Return to Questions and Answers

Who is online

Users browsing this forum: No registered users and 1 guest