*nix Documentation Project
·  Home
 +   man pages
·  Linux HOWTOs
·  FreeBSD Tips
·  *niX Forums

  man pages->OpenBSD man pages -> systrace (1)              



NAME    [Toc]    [Back]

     systrace - generate and enforce system call policies

SYNOPSIS    [Toc]    [Back]

     systrace [-AaCeitUu] [-c uid:gid] [-d policydir]  [-f  file]
[-g gui]
              [-p pid] command ...

DESCRIPTION    [Toc]    [Back]

     The  systrace utility monitors and controls an application's
access to the
     system by enforcing access policies for system  calls.   The
systrace utility
 might be used to trace an untrusted application's access
to the system.
  Alternatively, it might be used to protect the  system
from software
     bugs  (such  as buffer overflows) by constraining a daemon's
access to the
     system.  Its privilege elevation feature can be used to  obviate the need
     to  run  large,  untrusted programs as root when only one or
two system
     calls require root privilege.

     The access policy can be generated interactively or obtained
from a policy
 file.  Interactive policy generation will be performed by
     ``notification user agent'', normally  xsystrace(1),  unless
text mode is
     specified via -t.

     When  running  in ``automatic enforcement'' mode, operations
not covered by
     the policy raise an alarm and allow a  user  to  refine  the
currently configured

     The options are as follows:

     -A        Automatically  generate a policy that allows every
operation the
              application executes.  The created policy functions
as a base
              that can be refined.

     -a        Enables  automatic enforcement of configured policies.  An operation
 not covered by policy is denied and logged via
              or to stderr if the -e flag is specified.

     -C       Run systrace in cradle mode; currently, when multiple processes
              are started with systrace protection, each systrace
starts its
              own  UI  (user interface) process.  Cradle mode allows a user to
              attach all systrace processes to one UI.  This  may
be useful,
              for  example,  in scenarios where systrace is being
heavily used.
              If a cradle server is not running, one is launched.

     -c uid:gid
              Specifies the uid and gid that the monitored application should
              be executed with, which must be specified  as  nonnegative integers
 (not as names).  This is useful in conjunction
with privilege
 elevation and requires root privilege.

     -d policydir
              Specifies an alternative location  for  the  user's
directory from
              which  policies  are  loaded  and  to which changed
policies are

     -e       Specifies to log to stderr instead of syslog(3).

     -f file  The policies specified in file  are  added  to  the
policies that
              systrace knows about.

     -g gui   Specifies an alternative location for the notification user interface.

     -i       Inherits the policy - child processes inherit policy of the parent

     -p pid   Specifies the pid of a process that systrace should
attach to.
              The full path name of the corresponding binary  has
to be specified
 as command.

     -t       Uses text mode to ask for interactive policy generation.

     -U       Ignore user-configured policies and use only global
system policies.

     -u        Do  not  perform  aliasing  on  system call names.
Aliasing is enabled
 by default to group similar system calls into
a single
              compound name.  For example, system calls that read
from the
              file system like lstat() and access() are translated to

   POLICY    [Toc]    [Back]
     The policy is specified via the following grammar:

        filter = expression "then" action errorcode logcode
        expression  =  symbol | "not" expression | "(" expression
")" |
            expression "and" expression | expression "or" expression
        symbol = string typeoff "match" cmdstring |
            string  typeoff "eq" cmdstring | string typeoff "neq"
cmdstring |
            string  typeoff  "sub"  cmdstring  |  string  typeoff
"nsub" cmdstring |
            string  typeoff  "inpath"  cmdstring | string typeoff
"re" cmdstring |
        typeoff = /* empty */ | "[" number "]"
        action = "permit" | "deny" | "ask"
        errorcode = /* empty */ | "[" string "]"
        logcode = /* empty */ | "log"

     The cmdstring is an arbitrary string enclosed with quotation
marks.  The
     errorcode  is used to return an errno(2) value to the system
call when using
 a deny action.  The values  ``inherit''  and  ``detach''
have special
     meanings  when used with a permit rule for the execve system
call.  When
     using ``inherit,'' the current policy is inherited  for  the
new binary.
     With ``detach,'' systrace detaches from a process after successfully completing
 the execve system call.

     The ask action specifies that the user  should  be  prompted
for a decision
     every time that the rule matches.

     The filter operations have the following meaning:

        match     Evaluates to true if file name globbing according to
                 fnmatch(3) succeeds.

        eq       Evaluates to true if the  system  call  argument
                 cmdstring exactly.

        neq      This is the logical negation of eq.

        sub       Performs  a  substring match on the system call

        nsub     This is the logical negation of sub.

        inpath   Evaluates to true if the system call argument is
a subpath of

        re        Evaluates  to true if the system call arguments
matches the
                 specified regular expression.

     By appending the log statement to a rule, a matching  system
call and its
     arguments  are  logged.  This is useful, for example, to log
all invocations
 of the execve system call.

     Policy entries may contain an  appended  predicate.   Predicates have the
     following format:

        ",  if" {"user", "group"} {"=", "!=", "<", ">" } {number,

     A rule is added to the configured policy only if its  predicate evaluates
     to true.

     The  environment variables $HOME, $USER and $CWD are substituted in rules.
     Comments, begun by an unquoted `#' character and  continuing
to the end of
     the line, are ignored.


     With  systrace it is possible to remove setuid or setgid binaries, and use
     the privilege  elevation  feature  instead.   Single  system
calls can be executed
  with  higher  privileges  if specified by the policy.
For example,

        native-bind: sockaddr eq "inet-[]:22" then  permit
as root

     allows  an  unprivileged  application  to bind to a reserved
port.  Privilege
     elevation requires that the systrace process is executed  as

     The following statements can be appended after the permit in
a policy to
     elevate the privileges for the matching system call:

        as user
        as user:group
        as :group

     The effective uid and gid are elevated only for the duration
of the system
 call, and are restored to the old values afterwards (except for the
     seteuid or setegid system calls).

FILES    [Toc]    [Back]

     /dev/systrace    systrace device
     /etc/systrace    global systrace policies
     $HOME/.systrace  user specified policies,  one  per  binary,
with slashes in
                      the  full  pathname  replaced by the underscore character.

EXAMPLES    [Toc]    [Back]

     An excerpt from a sample ls(1) policy might look as follows:

       Policy: /bin/ls, Emulation: native
          native-fsread: filename eq "$HOME" then permit
          native-fchdir: permit
          native-fsread: filename eq "/tmp" then permit
          native-stat: permit
          native-fsread: filename match "$HOME/*" then permit
          native-fsread: filename eq "/etc/pwd.db" then permit
          native-fsread:  filename eq "/etc" then deny[eperm], if
group != wheel

SEE ALSO    [Toc]    [Back]


AUTHORS    [Toc]    [Back]

     The systrace utility was developed by Niels Provos.

BUGS    [Toc]    [Back]

     Applications that use clone()-like system calls to share the
complete address
  space between processes may be able to replace system
call arguments
 after they have been evaluated by systrace and  escape
policy enforcement.

OpenBSD      3.6                        November     28,     2003
[ Back ]
 Similar pages
Name OS Title
systrace OpenBSD enforce and generate policies for system calls
systrace OpenBSD enforce policies for system calls
systrace_exit OpenBSD enforce policies for system calls
systrace_fork OpenBSD enforce policies for system calls
systrace_redirect OpenBSD enforce policies for system calls
cu IRIX call another UNIX system
syscall Tru64 indirect system call
__syscall OpenBSD indirect system call
syscall OpenBSD indirect system call
syscall NetBSD indirect system call
Copyright © 2004-2005 DeniX Solutions SRL
newsletter delivery service