sandbox/linux: refactor bpf_dsl dependency on die.h

sandbox/linux: refactor bpf_dsl dependency on die.h

This CL changes the bpf_dsl "Kill" builtin function to simply map to
SECCOMP_RET_KILL, rather than to a trap handler.  Additionally, it
changes the default PolicyCompiler behavior for handling impossible
conditions to use this behavior.

However, it also adds SetPanicFunc as a way to override this default
behavior, and SandboxBPF uses this to maintain Chrome's historical
behavior of printing an error message with SANDBOX_DIE.

Arguably the Policy object should actually be responsible for
providing a Panic function, but that change will require modifying
existing Policy classes elsewhere in the Chromium source tree, so
I'll look into that in a followup CL.

BUG=449357
Committed: https://crrev.com/e7883acd4d078cc668d639f2a98c02b2cd106335
Cr-Commit-Position: refs/heads/master@{#344574}

[mdempsky, 2015-08-19 22:51:50]

mdempsky@chromium.org changed reviewers:
+ rickyz@chromium.org

[rickyz (no longer on Chrome), 2015-08-19 23:25:10]

https://codereview.chromium.org/1302043002/diff/20001/sandbox/linux/bpf_dsl/p...
File sandbox/linux/bpf_dsl/policy_compiler.cc (right):

https://codereview.chromium.org/1302043002/diff/20001/sandbox/linux/bpf_dsl/p...
sandbox/linux/bpf_dsl/policy_compiler.cc:61: LOG(FATAL) << "bpf_dsl panic: " <<
reinterpret_cast<const char*>(aux);
Should we default to something async signal safe like SANDBOX_DIE? Though at
that point, do we really need Panic to be overridable? All the usages would be
basically the same thing, right?

[mdempsky, 2015-08-19 23:33:31]

https://codereview.chromium.org/1302043002/diff/20001/sandbox/linux/bpf_dsl/p...
File sandbox/linux/bpf_dsl/policy_compiler.cc (right):

https://codereview.chromium.org/1302043002/diff/20001/sandbox/linux/bpf_dsl/p...
sandbox/linux/bpf_dsl/policy_compiler.cc:61: LOG(FATAL) << "bpf_dsl panic: " <<
reinterpret_cast<const char*>(aux);
On 2015/08/19 23:25:10, rickyz wrote:
> Should we default to something async signal safe like SANDBOX_DIE? Though at
> that point, do we really need Panic to be overridable? All the usages would be
> basically the same thing, right?

The problem with defaulting to SANDBOX_DIE is it's in seccomp-bpf, and the point
of this CL is breaking the dependency from bpf_dsl on seccomp-bpf.

We could move seccomp-bpf/die.h into bpf_dsl or services maybe, but it depends
on seccomp-bpf/syscall.h; so we'd need to move that too.

It would be nice to make it async signal safe though.  Maybe I should just
write() to STDERR_FILENO directly as the default instead of LOG(FATAL) (assuming
you don't have any good idea on using SANDBOX_DIE without cycles).

[mdempsky, 2015-08-20 16:19:58]

rickyz: PTAL

Slightly simpler solution just using SECCOMP_RET_KILL by default instead of a
trap handler.

[rickyz (no longer on Chrome), 2015-08-20 17:55:26]

lgtm

Oh oops, I should have read the CL description more carefully - SECCOMP_RET_KILL
looks like a good default.

[mdempsky, 2015-08-20 17:56:05]

The CQ bit was checked by mdempsky@chromium.org

[commit-bot: I haz the power, 2015-08-20 17:56:50]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1302043002/40001
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1302043002/40001

[mdempsky, 2015-08-20 18:03:40]

On 2015/08/20 17:55:26, rickyz wrote:
> Oh oops, I should have read the CL description more carefully

No problem, thanks for the review!

[commit-bot: I haz the power, 2015-08-20 18:54:48]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2015-08-20 18:54:49]

Try jobs failed on following builders:
  linux_chromium_asan_rel_ng on tryserver.chromium.linux (JOB_FAILED,
http://build.chromium.org/p/tryserver.chromium.linux/builders/linux_chromium_...)

[mdempsky, 2015-08-20 19:24:48]

The CQ bit was checked by mdempsky@chromium.org

[commit-bot: I haz the power, 2015-08-20 19:26:14]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1302043002/40001
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1302043002/40001

[commit-bot: I haz the power, 2015-08-20 20:17:54]

Committed patchset #3 (id:40001)

[commit-bot: I haz the power, 2015-08-20 20:18:49]

Patchset 3 (id:??) landed as
https://crrev.com/e7883acd4d078cc668d639f2a98c02b2cd106335
Cr-Commit-Position: refs/heads/master@{#344574}