mandoline: lock down the linux sandbox more.

mojo/runner/linux_sandbox.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "mojo/runner/linux_sandbox.h"
 
 #include <fcntl.h>
 #include <sys/syscall.h>
 
 #include "base/bind.h"
 #include "base/debug/leak_annotations.h"
 #include "base/posix/eintr_wrapper.h"
 #include "base/rand_util.h"
 #include "base/sys_info.h"
 #include "sandbox/linux/bpf_dsl/policy.h"
 #include "sandbox/linux/bpf_dsl/trap_registry.h"
+#include "sandbox/linux/seccomp-bpf-helpers/baseline_policy.h"
 #include "sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.h"
 #include "sandbox/linux/seccomp-bpf-helpers/syscall_sets.h"
 #include "sandbox/linux/seccomp-bpf/sandbox_bpf.h"
 #include "sandbox/linux/services/credentials.h"
 #include "sandbox/linux/services/namespace_sandbox.h"
 #include "sandbox/linux/services/proc_util.h"
 #include "sandbox/linux/services/thread_helpers.h"
 
 using sandbox::syscall_broker::BrokerFilePermission;
 
@@ skipping 28 matching lines @@
                                     static_cast<int>(args.args[2]));
       } else {
         return -EPERM;
       }
     default:
       RAW_CHECK(false);
       return -ENOSYS;
   }
 }
 
-class SandboxPolicy : public sandbox::bpf_dsl::Policy {
+class SandboxPolicy : public sandbox::BaselinePolicy {
  public:
   explicit SandboxPolicy(sandbox::syscall_broker::BrokerProcess* broker_process)
       : broker_process_(broker_process) {}
   ~SandboxPolicy() override {}
 
   // Overridden from sandbox::bpf_dsl::Policy:
   sandbox::bpf_dsl::ResultExpr EvaluateSyscall(int sysno) const override {
     // This policy is only advisory/for noticing FS access for the moment.
     switch (sysno) {
       case __NR_access:
       case __NR_open:
       case __NR_faccessat:
       case __NR_openat:
         return sandbox::bpf_dsl::Trap(SandboxSIGSYSHandler, broker_process_);
+      case __NR_ftruncate:
+      case __NR_getrlimit:
+      case __NR_sched_getaffinity:
+      case __NR_uname:
+        return sandbox::bpf_dsl::Allow();

[rickyz (no longer on Chrome), 2015/08/31 20:42:42]

ftruncate/getrlimit/uname look fine - for sched_getaffinity, we have a helper
that restricts it to being called on the current PID or TID:
https://code.google.com/p/chromium/codesearch#chromium/src/content/common/san...

This is kind of an extra layer to make sure that one process cannot mess with
another process (though this isn't really strictly necessary anymore now that
each process is in its own PID namespace).

     }
 
-    return sandbox::bpf_dsl::Allow();
+    return BaselinePolicy::EvaluateSyscall(sysno);
   }
 
  private:
   // Not owned.
   const sandbox::syscall_broker::BrokerProcess* broker_process_;
   DISALLOW_COPY_AND_ASSIGN(SandboxPolicy);
 };
 
 }  // namespace
 
@@ skipping 39 matching lines @@
   // The Broker is now bound to this process and should only be destroyed when
   // the process exits or is killed.
   ANNOTATE_LEAKING_OBJECT_PTR(broker_.release());
 }
 
 void LinuxSandbox::Seal() {
   proc_fd_.reset();
 }
 
 }  // namespace mandoline