Non-SFI mode: Sandbox support for NaCl async-signals.

components/nacl/loader/nonsfi/nonsfi_sandbox_unittest.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Sanitizers internally use some syscalls which non-SFI NaCl disallows.
 #if !defined(ADDRESS_SANITIZER) && !defined(THREAD_SANITIZER) && \
     !defined(MEMORY_SANITIZER) && !defined(LEAK_SANITIZER)
 
 #include "components/nacl/loader/nonsfi/nonsfi_sandbox.h"
 
@@ skipping 623 matching lines @@
   clock_gettime(CLOCK_MONOTONIC_RAW, &ts);
 }
 
 BPF_DEATH_TEST_C(NaClNonSfiSandboxTest,
                  invalid_syscall_crash,
                  DEATH_SEGV_MESSAGE(sandbox::GetErrorMessageContentForTests()),
                  nacl::nonsfi::NaClNonSfiBPFSandboxPolicy) {
   sandbox::Syscall::InvalidCall();
 }
 
+// The following tests check for several restrictions in tgkill(). A delegate is
+// needed to be able to call getpid() from inside the process that will be
+// sandboxed, but before the sandbox is installed.
+template<void(*callback)(int pid, int tid)>
+class TgkillDelegate : public sandbox::BPFTesterDelegate {
+ public:
+  TgkillDelegate() {}
+  ~TgkillDelegate() override {}
+
+  scoped_ptr<sandbox::bpf_dsl::Policy> GetSandboxBPFPolicy() override {
+    // These two values must be obtained when running in the sandboxed process.
+    // They cannot be set in the constructor and are also not available from
+    // within |RunTestFunction|.
+    pid_ = getpid();
+    tid_ = syscall(__NR_gettid);
+
+    return scoped_ptr<sandbox::bpf_dsl::Policy>(
+        new nacl::nonsfi::NaClNonSfiBPFSandboxPolicy());
+  }
+
+  void RunTestFunction() override {
+    callback(pid_, tid_);
+  }
+
+  int pid_;
+  int tid_;
+
+ private:
+  DISALLOW_COPY_AND_ASSIGN(TgkillDelegate);
+};
+
+void BPF_TEST_D_tgkill_with_invalid_signal(int pid, int tid) {
+  syscall(__NR_tgkill, pid, tid, SIGKILL);
+}
+
+BPF_DEATH_TEST_D(NaClNonSfiSandboxTest,
+                 tgkill_with_invalid_signal,
+                 DEATH_SEGV_MESSAGE(sandbox::GetErrorMessageContentForTests()),
+                 TgkillDelegate<BPF_TEST_D_tgkill_with_invalid_signal>);
+
+void BPF_TEST_D_tgkill_with_invalid_tgid(int pid, int tid) {
+  syscall(__NR_tgkill, 1, tid, LINUX_SIGUSR1);
+}
+
+BPF_DEATH_TEST_D(NaClNonSfiSandboxTest,
+                 tgkill_with_invalid_tgid,
+                 DEATH_SEGV_MESSAGE(sandbox::GetErrorMessageContentForTests()),
+                 TgkillDelegate<BPF_TEST_D_tgkill_with_invalid_tgid>);
+
+void BPF_TEST_D_tgkill_with_negative_tgid(int pid, int tid) {
+  syscall(__NR_tgkill, pid, -1, LINUX_SIGUSR1);
+}
+
+BPF_DEATH_TEST_D(NaClNonSfiSandboxTest,
+                 tgkill_with_negative_tgid,
+                 DEATH_SEGV_MESSAGE(sandbox::GetErrorMessageContentForTests()),
+                 TgkillDelegate<BPF_TEST_D_tgkill_with_negative_tgid>);
+
+void BPF_TEST_D_tgkill_with_invalid_tid(int pid, int tid) {
+  BPF_ASSERT_EQ(-1, syscall(__NR_tgkill, pid, 1, LINUX_SIGUSR1));
+  BPF_ASSERT_EQ(ESRCH, errno);
+}
+
+BPF_TEST_D(NaClNonSfiSandboxTest,
+           tgkill_with_invalid_tid,
+           TgkillDelegate<BPF_TEST_D_tgkill_with_invalid_tid>);
+
 // The following test cases check if syscalls return EPERM regardless
 // of arguments.
 #define RESTRICT_SYSCALL_EPERM_TEST(name)                      \
   BPF_TEST_C(NaClNonSfiSandboxTest,                            \
              name##_EPERM,                                     \
              nacl::nonsfi::NaClNonSfiBPFSandboxPolicy) {       \
     errno = 0;                                                 \
     BPF_ASSERT_EQ(-1, syscall(__NR_##name, 0, 0, 0, 0, 0, 0)); \
     BPF_ASSERT_EQ(EPERM, errno);                               \
   }
@@ skipping 15 matching lines @@
 RESTRICT_SYSCALL_EPERM_TEST(ptrace);
 RESTRICT_SYSCALL_EPERM_TEST(set_robust_list);
 #if defined(__i386__) || defined(__x86_64__)
 RESTRICT_SYSCALL_EPERM_TEST(time);
 #endif
 
 }  // namespace
 
 #endif  // !ADDRESS_SANITIZER && !THREAD_SANITIZER &&
         // !MEMORY_SANITIZER && !LEAK_SANITIZER