mandoline: lock down the linux sandbox more.

mandoline: lock down the linux sandbox more.

Previously, the mandoline sandbox allowed all system calls except for
access()/open()/faccessat()/openat(). This patch now uses the baseline
sandboxing policy (which will error on many common syscalls and will
crash on unwhitelisted calls). Added a few syscalls that we need for the
compositor to the explicit allow list.

BUG=492524
Committed: https://crrev.com/6b21046b63481355378258b8a37d029a6a742ca1
Cr-Commit-Position: refs/heads/master@{#346469}

[Elliot Glaysher, 2015-08-31 19:28:27]

erg@chromium.org changed reviewers:
+ rickyz@chromium.org

[Elliot Glaysher, 2015-08-31 19:28:27]

Should ftruncate be proxied?

Should I try to lock down the other three calls to the parameters that what we
actually use?

[rickyz (no longer on Chrome), 2015-08-31 20:42:43]

lgtm

If you haven't been looking at
https://code.google.com/p/chromium/codesearch#chromium/src/content/common/san...
already, that has our current GPU sandbox policy, which might include some
future problem points.

https://codereview.chromium.org/1318063006/diff/1/mojo/runner/linux_sandbox.cc
File mojo/runner/linux_sandbox.cc (right):

https://codereview.chromium.org/1318063006/diff/1/mojo/runner/linux_sandbox.c...
mojo/runner/linux_sandbox.cc:85: return sandbox::bpf_dsl::Allow();
ftruncate/getrlimit/uname look fine - for sched_getaffinity, we have a helper
that restricts it to being called on the current PID or TID:
https://code.google.com/p/chromium/codesearch#chromium/src/content/common/san...

This is kind of an extra layer to make sure that one process cannot mess with
another process (though this isn't really strictly necessary anymore now that
each process is in its own PID namespace).

[Elliot Glaysher, 2015-08-31 20:48:16]

erg@chromium.org changed reviewers:
+ ben@chromium.org

[Elliot Glaysher, 2015-08-31 20:48:16]

ben: owners stamp

[Ben Goodger (Google), 2015-08-31 20:53:09]

lgtm

[Elliot Glaysher, 2015-08-31 20:57:13]

The CQ bit was checked by erg@chromium.org

[Elliot Glaysher, 2015-08-31 20:57:14]

The patchset sent to the CQ was uploaded after l-g-t-m from rickyz@chromium.org
Link to the patchset: https://codereview.chromium.org/1318063006/#ps20001
(title: "Restrict getaffinity.")

[commit-bot: I haz the power, 2015-08-31 20:57:23]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1318063006/20001
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1318063006/20001

[commit-bot: I haz the power, 2015-08-31 21:11:23]

Committed patchset #2 (id:20001)

[commit-bot: I haz the power, 2015-08-31 21:12:05]

Patchset 2 (id:??) landed as
https://crrev.com/6b21046b63481355378258b8a37d029a6a742ca1
Cr-Commit-Position: refs/heads/master@{#346469}