Seccomp sandbox changes (performance and correctness fixes, primarily targetting x86-32)

sandbox/linux/seccomp/sandbox.cc

+// Copyright (c) 2010 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
 #include "library.h"
 #include "sandbox_impl.h"
 #include "syscall_table.h"
 
 namespace playground {
 
 // Global variables
 int                           Sandbox::proc_self_maps_ = -1;
 enum Sandbox::SandboxStatus   Sandbox::status_ = STATUS_UNKNOWN;
 int                           Sandbox::pid_;
@@ skipping 354 matching lines @@
     return 0;
   }
   pid_t pid;
   switch ((pid = sys.fork())) {
     case -1:
       status_ = STATUS_UNSUPPORTED;
       return 0;
     case 0: {
       int devnull = sys.open("/dev/null", O_RDWR, 0);
       if (devnull >= 0) {
-        dup2(devnull, 0);
-        dup2(devnull, 1);
-        dup2(devnull, 2);
+        sys.dup2(devnull, 0);
+        sys.dup2(devnull, 1);
+        sys.dup2(devnull, 2);
+        sys.close(devnull);
       }
       if (proc_fd >= 0) {
         setProcSelfMaps(sys.openat(proc_fd, "self/maps", O_RDONLY, 0));
       }
       startSandbox();
       write(sys, fds[1], "", 1);
 
       // Try to tell the trusted thread to shut down the entire process in an
       // orderly fashion
       defaultSystemCallHandler(__NR_exit_group, 0, 0, 0, 0, 0, 0);
@@ skipping 28 matching lines @@
 
 void Sandbox::startSandbox() {
   if (status_ == STATUS_UNSUPPORTED) {
     die("The seccomp sandbox is not supported on this computer");
   } else if (status_ == STATUS_ENABLED) {
     return;
   }
 
   SysCalls sys;
   if (proc_self_maps_ < 0) {
-    proc_self_maps_              = sys.open("/proc/self/maps", O_RDONLY, 0);
+    proc_self_maps_        = sys.open("/proc/self/maps", O_RDONLY, 0);
     if (proc_self_maps_ < 0) {
       die("Cannot access \"/proc/self/maps\"");
     }
   }
 
   // The pid is unchanged for the entire program, so we can retrieve it once
   // and store it in a global variable.
-  pid_                           = sys.getpid();
+  pid_                     = sys.getpid();
 
   // Block all signals, except for the RDTSC handler
   setupSignalHandlers();
 
   // Get socketpairs for talking to the trusted process
   int pair[4];
-  if (socketpair(AF_UNIX, SOCK_STREAM, 0, pair) ||
-      socketpair(AF_UNIX, SOCK_STREAM, 0, pair+2)) {
+  if (sys.socketpair(AF_UNIX, SOCK_STREAM, 0, pair) ||
+      sys.socketpair(AF_UNIX, SOCK_STREAM, 0, pair+2)) {
     die("Failed to create trusted thread");
   }
-  processFdPub_                  = pair[0];
-  cloneFdPub_                    = pair[2];
-  SecureMemArgs::Args* secureMem = createTrustedProcess(pair[0], pair[1],
-                                                        pair[2], pair[3]);
+  processFdPub_            = pair[0];
+  cloneFdPub_              = pair[2];
+  SecureMemArgs* secureMem = createTrustedProcess(pair[0], pair[1],
+                                                  pair[2], pair[3]);
 
   // We find all libraries that have system calls and redirect the system
   // calls to the sandbox. If we miss any system calls, the application will be
   // terminated by the kernel's seccomp code. So, from a security point of
   // view, if this code fails to identify system calls, we are still behaving
   // correctly.
   {
     Maps maps(proc_self_maps_);
-    const char *libs[] = { "ld", "libc", "librt", "libpthread", NULL };
+    const char *libs[]     = { "ld", "libc", "librt", "libpthread", NULL };
 
     // Intercept system calls in the VDSO segment (if any). This has to happen
     // before intercepting system calls in any of the other libraries, as
     // the main kernel entry point might be inside of the VDSO and we need to
     // determine its address before we can compare it to jumps from inside
     // other libraries.
     for (Maps::const_iterator iter = maps.begin(); iter != maps.end(); ++iter){
       Library* library = *iter;
       if (library->isVDSO() && library->parseElf()) {
         library->makeWritable(true);
@@ skipping 47 matching lines @@
   // Creating the trusted thread enables sandboxing
   createTrustedThread(processFdPub_, cloneFdPub_, secureMem);
 
   // We can no longer check for sandboxing support at this point, but we also
   // know for a fact that it is available (as we just turned it on). So update
   // the status to reflect this information.
   status_ = STATUS_ENABLED;
 }
 
 } // namespace