TAME(2)

NAME
tame - restrict system operations

SYNOPSIS
#include <sys/tame.h>
int
tame(int flags, const char *paths[]);

DESCRIPTION
The current process is forced into a restricted-service operating mode. A few subsets are available, roughly described as computation, memory management, read-write operations on file descriptors, opening of files, networking. In general, these modes were selected by studying the operation of many programs using libc and other such interfaces, and setting flags or paths.

Use of tame() in an application will require at least some study and understanding of the interfaces called. Subsequent calls to tame() can reduce the abilities further, but abilities can never be regained.

A process which attempts a restricted operation is killed with SIGKILL. If TAME_ABORT is set, then a non-blockable SIGABRT is delivered instead, possibly resulting in a core(5) file.

A flags value of 0 restricts the process to the _exit(2) system call. This can be used for pure computation operating on memory shared with another process.

All TAME_* options below (with the exception of TAME_ABORT) permit the following system calls:

clock_getres(2), clock_gettime(2), fchdir(2), getdtablecount(2), getegid(2), geteuid(2), getgid(2), getgroups(2), getitimer(2), getlogin(2), getpgid(2), getpgrp(2), getpid(2), getppid(2), getresgid(2), getresuid(2), getrlimit(2), getsid(2), getthrid(2), gettimeofday(2), getuid(2), getuid(2), issetugid(2), nanosleep(2), sendsyslog(2), setitimer(2), sigaction(2), sigprocmask(2), sigreturn(2), umask(2), wait4(2).

Some system calls, when allowed, have restrictions applied to them:

access(2)
    May check for existence of /etc/localtime.
adjtime(2)
    Read-only, for ntpd(8).
chmod(2)
fchmod(2)
fchmodat(2)
chown(2)
lchown(2)
fchown(2)
fchownat(2)
    Setuid/setgid bits do not work, nor can the user or group be changed on a file.
open(2)
    May open /etc/localtime, any files below /usr/share/zoneinfo and files ending in libc.cat below the directory /usr/share/nls/.
readlink(2)
    May operate on /etc/malloc.conf.
sysctl(3)
    A small set of read-only operations are allowed, sufficient to support: getdomainname(3), gethostname(3), getifaddrs(3), uname(3), system sensor readings.
tame(2)
    Can only reduce permissions; can only set a list of paths once.

The flags are specified as a bitwise OR of the following values:

TAME_MALLOC
    To allow use of the malloc(3) family of functions, the following system calls are permitted:

    getentropy(2), madvise(2), minherit(2), mmap(2), mprotect(2), mquery(2), munmap(2).

TAME_RW
    The following system calls are permitted to allow most types of IO operations on previously allocated file descriptors, including libevent or handwritten async IO loops:

    poll(2), kevent(2), kqueue(2), select(2), close(2), dup(2), dup2(2), dup3(2), closefrom(2), shutdown(2), read(2), readv(2), pread(2), preadv(2), write(2), writev(2), pwrite(2), pwritev(2), ftruncate(2), lseek(2), fcntl(2), fsync(2), pipe(2), pipe2(2), socketpair(2), getdents(2), sendto(2), sendmsg(2), recvmsg(2), recvfrom(2), fstat(2).

TAME_STDIO
    This subset is simply the combination of TAME_MALLOC and TAME_RW. As a result, all the expected functionalities of libc stdio work.

TAME_RPATH
    A number of system calls are allowed if they only cause read-only effects on the filesystem:

    chdir(2), getcwd(3), openat(2), fstatat(2), faccessat(2), readlinkat(2), lstat(2), chmod(2), fchmod(2), fchmodat(2), chflags(2), chflagsat(2), chown(2), fchown(2), fchownat(2), fstat(2), getfsstat(2).

TAME_WPATH
    A number of system calls are allowed and may cause write-effects on the filesystem:

    getcwd(3), openat(2), fstatat(2), faccessat(2), readlinkat(2), lstat(2), chmod(2), fchmod(2), fchmodat(2), chflags(2), chflagsat(2), chown(2), fchown(2), fchownat(2), fstat(2).

TAME_CPATH
    A number of system calls and sub-modes are allowed, which may create new files or directories in the filesystem:

    rename(2), rmdir(2), renameat(2), link(2), linkat(2), symlink(2), unlink(2), unlinkat(2), mkdir(2), mkdirat(2).

TAME_TMPPATH
    A number of system calls are allowed to do operations in the /tmp directory, including create, read, or write:

    lstat(2), chmod(2), chflags(2), chown(2), unlink(2), fstat(2).

TAME_INET
    The following system calls are allowed to operate in the AF_INET and AF_INET6 domains:

    socket(2), listen(2), bind(2), connect(2), accept4(2), accept(2), getpeername(2), getsockname(2), setsockopt(2), getsockopt(2).

    setsockopt(2) has been reduced in functionality substantially.

TAME_FATTR
    The following system calls are allowed to make explicit changes to fields in struct stat relating to a file:

    utimes(2), futimes(2), utimensat(2), futimens(2), chmod(2), fchmod(2), fchmodat(2), chflags(2), chflagsat(2), chown(2), fchownat(2), lchown(2), fchown(2).

TAME_UNIX
    The following system calls are allowed to operate in the AF_UNIX domain:

    socket(2), listen(2), bind(2), connect(2), accept4(2), accept(2), getpeername(2), getsockname(2), setsockopt(2), getsockopt(2).

TAME_DNS
    Subsequent to a successful open(2) of /etc/resolv.conf, a few system calls become able to allow DNS network transactions:

    sendto(2), recvfrom(2), socket(2), connect(2).

TAME_GETPW
    This allows read-only opening of files in /etc for the getpwnam(3), getgrnam(3), getgrouplist(3), and initgroups(3) family of functions. They may also need to operate in a yp(8) environment, so a successful open(2) of /var/run/ypbind.lock enables the TAME_INET flag.

TAME_CMSG
    Allows passing of file descriptors using the sendmsg(2) and recvmsg(2) functions.

TAME_IOCTL
    Allows a subset of ioctl(2) operations:

    FIOCLEX, FIONCLEX, FIONREAD, FIONBIO, FIOGETOWN, TIOCGETA, TIOCGPGRP, TIOCGWINSZ, TIOCSTI.

TAME_PROC
    Allows the following process relationship operations:

    fork(2), vfork(2), kill(2), setgroups(2), setresgid(2), setresuid(2),

TAME_ABORT
    Deliver an unblockable SIGABRT upon violation instead of SIGKILL.

A whitelist of permitted paths may be provided in paths. All other paths will return ENOENT.

RETURN VALUES

ERRORS
tame() will fail if:

[EFAULT]
    paths points outside the process's allocated address space.

[ENAMETOOLONG]
    An element of paths is too large, or prepending cwd to it would exceed PATH_MAX bytes.

[EPERM]
    This process is attempting to increase permissions.

[E2BIG]
    The paths array is too large, or the total number of bytes exceeds a system-imposed limit. The limit in the system as released is 262144 bytes (ARG_MAX).

HISTORY
The tame() system call appeared in OpenBSD 5.8.