Non-SFI mode: Build nacl_helper_nonsfi_unittests

components/nacl/loader/nonsfi/nonsfi_sandbox_unittest.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Sanitizers internally use some syscalls which non-SFI NaCl disallows.
 #if !defined(ADDRESS_SANITIZER) && !defined(THREAD_SANITIZER) && \
     !defined(MEMORY_SANITIZER) && !defined(LEAK_SANITIZER)
 
 #include "components/nacl/loader/nonsfi/nonsfi_sandbox.h"
 
 #include <errno.h>
 #include <fcntl.h>
 #include <linux/net.h>
 #include <pthread.h>
 #include <sched.h>
 #include <signal.h>
 #include <stdlib.h>
 #include <string.h>
 #include <sys/mman.h>
 #include <sys/prctl.h>
 #include <sys/socket.h>
 #include <sys/syscall.h>
 #include <sys/types.h>
 #include <sys/wait.h>
 #include <time.h>
 #include <unistd.h>
 
+#include "base/at_exit.h"
 #include "base/bind.h"
 #include "base/callback.h"
 #include "base/compiler_specific.h"
 #include "base/files/scoped_file.h"
 #include "base/logging.h"
 #include "base/posix/eintr_wrapper.h"
 #include "base/sys_info.h"
 #include "base/threading/thread.h"
 #include "base/time/time.h"
 #include "sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.h"
 #include "sandbox/linux/seccomp-bpf/bpf_tests.h"
 #include "sandbox/linux/seccomp-bpf/sandbox_bpf.h"
 #include "sandbox/linux/seccomp-bpf/syscall.h"
 #include "sandbox/linux/system_headers/linux_futex.h"
 #include "sandbox/linux/system_headers/linux_signal.h"
 #include "sandbox/linux/system_headers/linux_syscalls.h"
 
+#if !defined(F_DUPFD_CLOEXEC)

[Mark Seaborn, 2015/05/12 18:07:37]

I notice we're accumulating various Linux #defines like these in different
files.

e.g.
components/nacl/loader/nonsfi/nonsfi_sandbox.cc:#if !defined(MAP_STACK)

Would it be worth creating a catch-all file in sandbox/linux/system_headers/ to
put these in (on an as-needed basis)?

(Otherwise, in the absence of an "#ifdef OS_NACL_NONSFI" around these, I'd
suggest putting in a comment to say explicitly that these are for building with
the PNaCl toolchain.)

[hidehiko, 2015/05/13 05:43:15]

Hmm, it's up to sandbox/ team. Instead, I added comments in this CL.

+#define F_DUPFD_CLOEXEC 1030
+#endif
+
+#if !defined(MAP_POPULATE)
+#define MAP_POPULATE 0x8000
+#endif
+
+#if !defined(PROT_GROWSDOWN)
+#define PROT_GROWSDOWN 0x01000000
+#endif
+
+#if !defined(CLOCK_MONOTONIC_RAW)
+#define CLOCK_MONOTONIC_RAW 4
+#endif
+
+#if !defined(AF_INET)
+#define AF_INET 2
+#endif
+
+#if defined(__i386__)

[Mark Seaborn, 2015/05/12 18:07:37]

Nit: Since this wraps a large block I'd put an empty line after the "#if" (and
before the "#endif") for readability.

(At least in the absence of indentation.)

[hidehiko, 2015/05/13 05:43:15]

Done.

+#if !defined(SYS_SOCKET)
+#define SYS_SOCKET 1
+#endif
+
+#if !defined(SYS_BIND)
+#define SYS_BIND 2
+#endif
+
+#if !defined(SYS_CONNECT)
+#define SYS_CONNECT 3
+#endif
+
+#if !defined(SYS_LISTEN)
+#define SYS_LISTEN 4
+#endif
+
+#if !defined(SYS_ACCEPT)
+#define SYS_ACCEPT 5
+#endif
+
+#if !defined(SYS_GETSOCKNAME)
+#define SYS_GETSOCKNAME 6
+#endif
+
+#if !defined(SYS_GETPEERNAME)
+#define SYS_GETPEERNAME 7
+#endif
+
+#if !defined(SYS_SETSOCKOPT)
+#define SYS_SETSOCKOPT 14
+#endif
+
+#if !defined(SYS_GETSOCKOPT)
+#define SYS_GETSOCKOPT 15
+#endif
+#endif // defined(__i386__)
+
 namespace {
 
 void DoPipe(base::ScopedFD* fds) {
   int tmp_fds[2];
   BPF_ASSERT_EQ(0, pipe(tmp_fds));
   fds[0].reset(tmp_fds[0]);
   fds[1].reset(tmp_fds[1]);
 }
 
 void DoSocketpair(base::ScopedFD* fds) {
@@ skipping 306 matching lines @@
 
 BPF_DEATH_TEST_C(NaClNonSfiSandboxTest,
                  fcntl_GETFL_SETFL,
                  DEATH_SEGV_MESSAGE(sandbox::GetErrorMessageContentForTests()),
                  nacl::nonsfi::NaClNonSfiBPFSandboxPolicy) {
   base::ScopedFD fds[2];
   DoSocketpair(fds);
   fcntl(fds[0].get(), F_SETFL, O_APPEND);
 }
 
+void DoFcntl(int fd, int cmd) {
+  // fcntl in PNaCl toolchian returns an error without calling actual system

[Mark Seaborn, 2015/05/12 18:07:37]

"toolchain"

[hidehiko, 2015/05/13 05:43:15]

Done.

+  // call for unknown |cmd|. So, instead, here we use syscall().
+#if defined(OS_NACL_NONSFI)
+  syscall(__NR_fcntl64, fd, cmd);
+#else
+  fcntl(fd, cmd);
+#endif
+}
+
 BPF_DEATH_TEST_C(NaClNonSfiSandboxTest,
                  fcntl_DUPFD,
                  DEATH_SEGV_MESSAGE(sandbox::GetErrorMessageContentForTests()),
                  nacl::nonsfi::NaClNonSfiBPFSandboxPolicy) {
-  fcntl(0, F_DUPFD);
+  DoFcntl(0, F_DUPFD);
 }
 
 BPF_DEATH_TEST_C(NaClNonSfiSandboxTest,
                  fcntl_DUPFD_CLOEXEC,
                  DEATH_SEGV_MESSAGE(sandbox::GetErrorMessageContentForTests()),
                  nacl::nonsfi::NaClNonSfiBPFSandboxPolicy) {
-  fcntl(0, F_DUPFD_CLOEXEC);
+  DoFcntl(0, F_DUPFD_CLOEXEC);
 }
 
 BPF_DEATH_TEST_C(NaClNonSfiSandboxTest,
                  FutexWithRequeuePriorityInheritence,
                  DEATH_SEGV_MESSAGE(
                      sandbox::GetFutexErrorMessageContentForTests()),
                  nacl::nonsfi::NaClNonSfiBPFSandboxPolicy) {
   syscall(__NR_futex, NULL, FUTEX_CMP_REQUEUE_PI, 0, NULL, NULL, 0);
   _exit(1);
 }
 
 BPF_DEATH_TEST_C(NaClNonSfiSandboxTest,
                  FutexWithRequeuePriorityInheritencePrivate,
                  DEATH_SEGV_MESSAGE(
                      sandbox::GetFutexErrorMessageContentForTests()),
                  nacl::nonsfi::NaClNonSfiBPFSandboxPolicy) {
   syscall(__NR_futex, NULL, FUTEX_CMP_REQUEUE_PI_PRIVATE, 0, NULL, NULL, 0);
   _exit(1);
 }
 
 BPF_TEST_C(NaClNonSfiSandboxTest,
            StartingAndJoiningThreadWorks,
            nacl::nonsfi::NaClNonSfiBPFSandboxPolicy) {
+#if defined(OS_NACL_NONSFI)
+  // base::Thread internally uses LazyInstance, which registers a callback to
+  // AtExitManager. However, in PNaCl toolchain build, it is not instantiated
+  // here, unlike host toolchain build (nacl_loader_unittests).

[Mark Seaborn, 2015/05/12 18:07:37]

Nit: by "here" do you mean "by the test runner"?

What's the difference that leads AtExitManager to be instantiated by the test
runner in the host toolchain build but not the PNaCl toolchain build?  Just
curious.

[hidehiko, 2015/05/13 05:43:15]

Done. The test runner for nacl_loader_unittests is base::LaunchUnitTest, though
it is gtest_main for this.

+  // Hence, declare it here so that the LazyInstance will work properly.
+  base::AtExitManager at_exit;
+#endif
+
   base::Thread thread("sandbox_tests");
   BPF_ASSERT(thread.Start());
   // |thread|'s destructor will join the thread.
 }
 
 BPF_DEATH_TEST_C(NaClNonSfiSandboxTest,
                  FutexWithUnlockPIPrivate,
                  DEATH_SEGV_MESSAGE(
                      sandbox::GetFutexErrorMessageContentForTests()),
                  nacl::nonsfi::NaClNonSfiBPFSandboxPolicy) {
   syscall(__NR_futex, NULL, FUTEX_UNLOCK_PI_PRIVATE, 0, NULL, NULL, 0);
   _exit(1);
 }
 
+void* DoMmap(int prot, int flags) {
+#if defined(OS_NACL_NONSFI)
+  // When PROT_EXEC is set, PNaCl toolchain's mmap() system call wrapper uses
+  // two system calls mmap2(2) and mprotect(2), so that we cannot test
+  // sandbox with the wrapper. Instead, here we use syscall().
+  return reinterpret_cast<void*>(
+      syscall(__NR_mmap2, NULL, getpagesize(), prot, flags, -1, 0));
+#else
+  return mmap(NULL, getpagesize(), prot, flags, -1, 0);
+#endif
+}
+
 void* DoAllowedAnonymousMmap() {
-  return mmap(NULL, getpagesize(), PROT_READ | PROT_WRITE,
-              MAP_ANONYMOUS | MAP_SHARED, -1, 0);
+  return DoMmap(PROT_READ | PROT_WRITE, MAP_ANONYMOUS | MAP_SHARED);
 }
 
 BPF_TEST_C(NaClNonSfiSandboxTest,
            mmap_allowed,
            nacl::nonsfi::NaClNonSfiBPFSandboxPolicy) {
   void* ptr = DoAllowedAnonymousMmap();
   BPF_ASSERT_NE(MAP_FAILED, ptr);
   BPF_ASSERT_EQ(0, munmap(ptr, getpagesize()));
 }
 
 BPF_DEATH_TEST_C(NaClNonSfiSandboxTest,
                  mmap_unallowed_flag,
                  DEATH_SEGV_MESSAGE(sandbox::GetErrorMessageContentForTests()),
                  nacl::nonsfi::NaClNonSfiBPFSandboxPolicy) {
-  mmap(NULL, getpagesize(), PROT_READ | PROT_WRITE,
-       MAP_ANONYMOUS | MAP_POPULATE, -1, 0);
+  DoMmap(PROT_READ | PROT_WRITE, MAP_ANONYMOUS | MAP_POPULATE);
 }
 
 BPF_DEATH_TEST_C(NaClNonSfiSandboxTest,
                  mmap_unallowed_prot,
                  DEATH_SEGV_MESSAGE(sandbox::GetErrorMessageContentForTests()),
                  nacl::nonsfi::NaClNonSfiBPFSandboxPolicy) {
-  mmap(NULL, getpagesize(), PROT_READ | PROT_GROWSDOWN,
-       MAP_ANONYMOUS, -1, 0);
+  DoMmap(PROT_READ | PROT_GROWSDOWN, MAP_ANONYMOUS);
 }
 
 BPF_DEATH_TEST_C(NaClNonSfiSandboxTest,
                  mmap_exec,
                  DEATH_SEGV_MESSAGE(sandbox::GetErrorMessageContentForTests()),
                  nacl::nonsfi::NaClNonSfiBPFSandboxPolicy) {
-  mmap(NULL, getpagesize(), PROT_EXEC, MAP_ANONYMOUS, -1, 0);
+  DoMmap(PROT_EXEC, MAP_ANONYMOUS);
 }
 
 BPF_DEATH_TEST_C(NaClNonSfiSandboxTest,
                  mmap_read_exec,
                  DEATH_SEGV_MESSAGE(sandbox::GetErrorMessageContentForTests()),
                  nacl::nonsfi::NaClNonSfiBPFSandboxPolicy) {
-  mmap(NULL, getpagesize(), PROT_READ | PROT_EXEC, MAP_ANONYMOUS, -1, 0);
+  DoMmap(PROT_READ | PROT_EXEC, MAP_ANONYMOUS);
 }
 
 BPF_DEATH_TEST_C(NaClNonSfiSandboxTest,
                  mmap_write_exec,
                  DEATH_SEGV_MESSAGE(sandbox::GetErrorMessageContentForTests()),
                  nacl::nonsfi::NaClNonSfiBPFSandboxPolicy) {
-  mmap(NULL, getpagesize(), PROT_WRITE | PROT_EXEC, MAP_ANONYMOUS, -1, 0);
+  DoMmap(PROT_WRITE | PROT_EXEC, MAP_ANONYMOUS);
 }
 
 BPF_DEATH_TEST_C(NaClNonSfiSandboxTest,
                  mmap_read_write_exec,
                  DEATH_SEGV_MESSAGE(sandbox::GetErrorMessageContentForTests()),
                  nacl::nonsfi::NaClNonSfiBPFSandboxPolicy) {
-  mmap(NULL, getpagesize(), PROT_READ | PROT_WRITE | PROT_EXEC,
-       MAP_ANONYMOUS, -1, 0);
+  DoMmap(PROT_READ | PROT_WRITE | PROT_EXEC, MAP_ANONYMOUS);
 }
 
 BPF_TEST_C(NaClNonSfiSandboxTest,
            mprotect_allowed,
            nacl::nonsfi::NaClNonSfiBPFSandboxPolicy) {
   void* ptr = DoAllowedAnonymousMmap();
   BPF_ASSERT_NE(MAP_FAILED, ptr);
   BPF_ASSERT_EQ(0, mprotect(ptr, getpagesize(), PROT_READ));
   BPF_ASSERT_EQ(0, munmap(ptr, getpagesize()));
 }
@@ skipping 10 matching lines @@
   mprotect(ptr, getpagesize(), PROT_READ | PROT_GROWSDOWN);
 }
 
 BPF_TEST_C(NaClNonSfiSandboxTest,
            brk,
            nacl::nonsfi::NaClNonSfiBPFSandboxPolicy) {
   char* next_brk = static_cast<char*>(sbrk(0)) + getpagesize();
   // The kernel interface must return zero for brk.
   BPF_ASSERT_EQ(0, syscall(__NR_brk, next_brk));
   // The libc wrapper translates it to ENOMEM.
+
+  // Note: PNaCl toolchain does not provide brk() system call wrapper.
+#if !defined(OS_NACL_NONSFI)
   errno = 0;
   BPF_ASSERT_EQ(-1, brk(next_brk));
   BPF_ASSERT_EQ(ENOMEM, errno);
+#endif
 }
 
 // clockid restrictions are mostly tested in sandbox/ with the
 // RestrictClockID() unittests. Some basic tests are duplicated here as
 // a precaution.
 
 void CheckClock(clockid_t clockid) {
   struct timespec ts;
   ts.tv_sec = ts.tv_nsec = -1;
   BPF_ASSERT_EQ(0, clock_gettime(clockid, &ts));
@@ skipping 53 matching lines @@
 RESTRICT_SYSCALL_EPERM_TEST(ptrace);
 RESTRICT_SYSCALL_EPERM_TEST(set_robust_list);
 #if defined(__i386__) || defined(__x86_64__)
 RESTRICT_SYSCALL_EPERM_TEST(time);
 #endif
 
 }  // namespace
 
 #endif  // !ADDRESS_SANITIZER && !THREAD_SANITIZER &&
         // !MEMORY_SANITIZER && !LEAK_SANITIZER