mandoline: lock down the linux sandbox more.

mojo/runner/linux_sandbox.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "mojo/runner/linux_sandbox.h"
 
 #include <fcntl.h>
 #include <sys/syscall.h>
 
 #include "base/bind.h"
 #include "base/debug/leak_annotations.h"
 #include "base/posix/eintr_wrapper.h"
 #include "base/rand_util.h"
 #include "base/sys_info.h"
 #include "sandbox/linux/bpf_dsl/policy.h"
 #include "sandbox/linux/bpf_dsl/trap_registry.h"
+#include "sandbox/linux/seccomp-bpf-helpers/baseline_policy.h"
 #include "sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.h"
+#include "sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.h"
 #include "sandbox/linux/seccomp-bpf-helpers/syscall_sets.h"
 #include "sandbox/linux/seccomp-bpf/sandbox_bpf.h"
 #include "sandbox/linux/services/credentials.h"
 #include "sandbox/linux/services/namespace_sandbox.h"
 #include "sandbox/linux/services/proc_util.h"
 #include "sandbox/linux/services/thread_helpers.h"
 
 using sandbox::syscall_broker::BrokerFilePermission;
 
 namespace mandoline {
@@ skipping 27 matching lines @@
                                     static_cast<int>(args.args[2]));
       } else {
         return -EPERM;
       }
     default:
       RAW_CHECK(false);
       return -ENOSYS;
   }
 }
 
-class SandboxPolicy : public sandbox::bpf_dsl::Policy {
+class SandboxPolicy : public sandbox::BaselinePolicy {
  public:
   explicit SandboxPolicy(sandbox::syscall_broker::BrokerProcess* broker_process)
       : broker_process_(broker_process) {}
   ~SandboxPolicy() override {}
 
   // Overridden from sandbox::bpf_dsl::Policy:
   sandbox::bpf_dsl::ResultExpr EvaluateSyscall(int sysno) const override {
     // This policy is only advisory/for noticing FS access for the moment.
     switch (sysno) {
       case __NR_access:
       case __NR_open:
       case __NR_faccessat:
       case __NR_openat:
         return sandbox::bpf_dsl::Trap(SandboxSIGSYSHandler, broker_process_);
+      case __NR_sched_getaffinity:
+        return sandbox::RestrictSchedTarget(policy_pid(), sysno);
+      case __NR_ftruncate:
+      case __NR_getrlimit:
+      case __NR_uname:
+        return sandbox::bpf_dsl::Allow();
     }
 
-    return sandbox::bpf_dsl::Allow();
+    return BaselinePolicy::EvaluateSyscall(sysno);
   }
 
  private:
   // Not owned.
   const sandbox::syscall_broker::BrokerProcess* broker_process_;
   DISALLOW_COPY_AND_ASSIGN(SandboxPolicy);
 };
 
 }  // namespace
 
@@ skipping 39 matching lines @@
   // The Broker is now bound to this process and should only be destroyed when
   // the process exits or is killed.
   ANNOTATE_LEAKING_OBJECT_PTR(broker_.release());
 }
 
 void LinuxSandbox::Seal() {
   proc_fd_.reset();
 }
 
 }  // namespace mandoline