add restricted filesystem access to sel_ldr

src/trusted/service_runtime/sys_fdio.c

 /*
  * Copyright (c) 2013 The Native Client Authors. All rights reserved.
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  */
 
 #include "native_client/src/trusted/service_runtime/sys_fdio.h"
 
 #include <string.h>
 
@@ skipping 117 matching lines @@
   ssize_t         getdents_ret;
   uintptr_t       sysaddr;
   struct NaClDesc *ndp;
 
   NaClLog(3,
           ("Entered NaClSysGetdents(0x%08"NACL_PRIxPTR", "
            "%d, 0x%08"NACL_PRIx32", "
            "%"NACL_PRIuS"[0x%"NACL_PRIxS"])\n"),
           (uintptr_t) natp, d, dirp, count, count);
 
-  if (!NaClAclBypassChecks) {
+  if (!NaClAclBypassChecks && NaClRootFolder == NULL) {

[jtolds, 2015/06/25 23:05:05]

definitely worried the most about Getdents here. Do I need to look for ".." dir
entries or anything and remap them if it's the untrusted root?

[Mark Seaborn, 2015/06/25 23:55:09]

The ".." entries reported by getdents() don't convey any authority, they just
reveal inode numbers.  So for security it's not essential to hide or remap them.

Programs might get confused if inode numbers are reported inconsistently, though
maybe that's not very likely.  Hiding/remapping inode numbers would just be
useful optional functionality to avoid that sort of problem.

     /*
      * Filesystem access is disabled, so disable the getdents() syscall.
      * We do this for security hardening, though it should be redundant,
      * because untrusted code should not be able to open any directory
      * descriptors (i.e. descriptors with a non-trivial Getdents()
      * implementation).
      */
     return -NACL_ABI_EACCES;
   }
 
@@ skipping 260 matching lines @@
   ndp = NaClAppGetDesc(nap, d);
   if (NULL == ndp) {
     NaClLog(4, "bad desc\n");
     retval = -NACL_ABI_EBADF;
     goto cleanup;
   }
 
   retval = (*((struct NaClDescVtbl const *) ndp->base.vtbl)->
             Fstat)(ndp, &result);
   if (0 == retval) {
-    if (!NaClAclBypassChecks) {
+    if (!NaClAclBypassChecks && NaClRootFolder == NULL) {
       result.nacl_abi_st_ino = NACL_FAKE_INODE_NUM;
     }
     if (!NaClCopyOutToUser(nap, nasp, &result, sizeof result)) {
       retval = -NACL_ABI_EFAULT;
     }
   }
 
   NaClDescUnref(ndp);
 cleanup:
   return retval;
 }