WIP: Implement seccomp-bpf sandbox for nacl_helper_nonsfi.

sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.cc

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.h"
 
 #include <errno.h>
 #include <fcntl.h>
 #include <fcntl.h>
-#include <linux/futex.h>
-#include <linux/net.h>
 #include <sched.h>
 #include <signal.h>
-#include <sys/ioctl.h>
 #include <sys/mman.h>
 #include <sys/prctl.h>
 #include <sys/resource.h>
 #include <sys/stat.h>
 #include <sys/time.h>
 #include <sys/types.h>
 #include <time.h>
 #include <unistd.h>
 
 #include "base/basictypes.h"
 #include "base/logging.h"
 #include "base/macros.h"
 #include "base/time/time.h"
 #include "build/build_config.h"
 #include "sandbox/linux/bpf_dsl/bpf_dsl.h"
-#include "sandbox/linux/bpf_dsl/seccomp_macros.h"
 #include "sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.h"
 #include "sandbox/linux/seccomp-bpf/sandbox_bpf.h"
 #include "sandbox/linux/system_headers/linux_syscalls.h"
 
+#if !defined(OS_NACL_NONSFI)
+// TODO
+#include <linux/futex.h>
+#include <linux/net.h>
+#include <sys/ioctl.h>
+#include "sandbox/linux/bpf_dsl/seccomp_macros.h"
+#endif
+
 #if defined(OS_ANDROID)
 
 #include "sandbox/linux/system_headers/android_futex.h"
 
 #if !defined(F_DUPFD_CLOEXEC)
 #define F_DUPFD_CLOEXEC (F_LINUX_SPECIFIC_BASE + 6)
 #endif
 
 // https://android.googlesource.com/platform/bionic/+/lollipop-release/libc/private/bionic_prctl.h
 #if !defined(PR_SET_VMA)
 #define PR_SET_VMA 0x53564d41
 #endif
 
 // https://android.googlesource.com/platform/system/core/+/lollipop-release/libcutils/sched_policy.c
 #if !defined(PR_SET_TIMERSLACK_PID)
 #define PR_SET_TIMERSLACK_PID 41
 #endif
 
 #endif  // defined(OS_ANDROID)
 
+#if !defined(PR_SET_NAME)
+// TODO
+#define PR_SET_NAME 15
+#endif
+
 #if defined(__arm__) && !defined(MAP_STACK)
 #define MAP_STACK 0x20000  // Daisy build environment has old headers.
 #endif
 
 #if defined(__mips__) && !defined(MAP_STACK)
 #define MAP_STACK 0x40000
 #endif
 namespace {
 
 inline bool IsArchitectureX86_64() {
@@ skipping 73 matching lines @@
   const Arg<int> option(0);
   return Switch(option)
       .CASES((PR_GET_NAME, PR_SET_NAME, PR_GET_DUMPABLE, PR_SET_DUMPABLE),
              Allow())
 #if defined(OS_ANDROID)
       .CASES((PR_SET_VMA, PR_SET_TIMERSLACK_PID), Allow())
 #endif
       .Default(CrashSIGSYSPrctl());
 }
 
+#if !defined(OS_NACL_NONSFI)
 ResultExpr RestrictIoctl() {
   const Arg<int> request(1);
   return Switch(request).CASES((TCGETS, FIONREAD), Allow()).Default(
       CrashSIGSYSIoctl());
 }
 
 ResultExpr RestrictMmapFlags() {
   // The flags you see are actually the allowed ones, and the variable is a
   // "denied" mask because of the negation operator.
   // Significantly, we don't permit MAP_HUGETLB, or the newer flags such as
   // MAP_POPULATE.
   // TODO(davidung), remove MAP_DENYWRITE with updated Tegra libraries.
   const uint64_t kAllowedMask = MAP_SHARED | MAP_PRIVATE | MAP_ANONYMOUS |
                                 MAP_STACK | MAP_NORESERVE | MAP_FIXED |
                                 MAP_DENYWRITE;
   const Arg<int> flags(3);
   return If((flags & ~kAllowedMask) == 0, Allow()).Else(CrashSIGSYS());
 }
+#endif
 
 ResultExpr RestrictMprotectFlags() {
   // The flags you see are actually the allowed ones, and the variable is a
   // "denied" mask because of the negation operator.
   // Significantly, we don't permit weird undocumented flags such as
   // PROT_GROWSDOWN.
   const uint64_t kAllowedMask = PROT_READ | PROT_WRITE | PROT_EXEC;
   const Arg<int> prot(2);
   return If((prot & ~kAllowedMask) == 0, Allow()).Else(CrashSIGSYS());
 }
 
+#if !defined(OS_NACL_NONSFI)
 ResultExpr RestrictFcntlCommands() {
   // We also restrict the flags in F_SETFL. We don't want to permit flags with
   // a history of trouble such as O_DIRECT. The flags you see are actually the
   // allowed ones, and the variable is a "denied" mask because of the negation
   // operator.
   // Glibc overrides the kernel's O_LARGEFILE value. Account for this.
   uint64_t kOLargeFileFlag = O_LARGEFILE;
   if (IsArchitectureX86_64() || IsArchitectureI386() || IsArchitectureMips())
     kOLargeFileFlag = 0100000;
 
   const Arg<int> cmd(1);
   const Arg<long> long_arg(2);
 
   const uint64_t kAllowedMask = O_ACCMODE | O_APPEND | O_NONBLOCK | O_SYNC |
                                 kOLargeFileFlag | O_CLOEXEC | O_NOATIME;
   return Switch(cmd)
       .CASES((F_GETFL,
               F_GETFD,
               F_SETFD,
               F_SETLK,
               F_SETLKW,
               F_GETLK,
               F_DUPFD,
               F_DUPFD_CLOEXEC),
              Allow())
       .Case(F_SETFL,
             If((long_arg & ~kAllowedMask) == 0, Allow()).Else(CrashSIGSYS()))
       .Default(CrashSIGSYS());
 }
+#endif
 
 #if defined(__i386__) || defined(__mips__)
+#if !defined(OS_NACL_NONSFI)
 ResultExpr RestrictSocketcallCommand() {
   // Unfortunately, we are unable to restrict the first parameter to
   // socketpair(2). Whilst initially sounding bad, it's noteworthy that very
   // few protocols actually support socketpair(2). The scary call that we're
   // worried about, socket(2), remains blocked.
   const Arg<int> call(0);
   return Switch(call)
       .CASES((SYS_SOCKETPAIR,
               SYS_SHUTDOWN,
               SYS_RECV,
               SYS_SEND,
               SYS_RECVFROM,
               SYS_SENDTO,
               SYS_RECVMSG,
               SYS_SENDMSG),
              Allow())
       .Default(Error(EPERM));
 }
 #endif
+#endif
 
 ResultExpr RestrictKillTarget(pid_t target_pid, int sysno) {
   switch (sysno) {
     case __NR_kill:
     case __NR_tgkill: {
       const Arg<pid_t> pid(0);
       return If(pid == target_pid, Allow()).Else(CrashSIGSYSKill());
     }
     case __NR_tkill:
       return CrashSIGSYSKill();
     default:
       NOTREACHED();
       return CrashSIGSYS();
   }
 }
 
+#if !defined(OS_NACL_NONSFI)
+// TODO
 ResultExpr RestrictFutex() {
   const uint64_t kAllowedFutexFlags = FUTEX_PRIVATE_FLAG | FUTEX_CLOCK_REALTIME;
   const Arg<int> op(1);
   return Switch(op & ~kAllowedFutexFlags)
       .CASES((FUTEX_WAIT,
               FUTEX_WAKE,
               FUTEX_REQUEUE,
               FUTEX_CMP_REQUEUE,
               FUTEX_WAKE_OP,
               FUTEX_WAIT_BITSET,
               FUTEX_WAKE_BITSET),
              Allow())
       .Default(CrashSIGSYSFutex());
 }
+#endif
 
+#if !defined(OS_NACL_NONSFI)
 ResultExpr RestrictGetSetpriority(pid_t target_pid) {
   const Arg<int> which(0);
   const Arg<int> who(1);
   return If(which == PRIO_PROCESS,
             If(who == 0 || who == target_pid, Allow()).Else(Error(EPERM)))
       .Else(CrashSIGSYS());
 }
+#endif
 
 ResultExpr RestrictClockID() {
   static_assert(4 == sizeof(clockid_t), "clockid_t is not 32bit");
   const Arg<clockid_t> clockid(0);
   return If(
 #if defined(OS_CHROMEOS)
              // Allow the special clock for Chrome OS used by Chrome tracing.
              clockid == base::TimeTicks::kClockSystemTrace ||
 #endif
                  clockid == CLOCK_MONOTONIC ||
@@ skipping 28 matching lines @@
   const Arg<pid_t> pid(0);
   return If(pid == 0 || pid == target_pid, Allow()).Else(CrashSIGSYS());
 }
 
 ResultExpr RestrictGetrusage() {
   const Arg<int> who(0);
   return If(who == RUSAGE_SELF, Allow()).Else(CrashSIGSYS());
 }
 
 }  // namespace sandbox.