Restrict mmap(2) flags for x64.

content/common/sandbox_seccomp_bpf_linux.cc

Index: content/common/sandbox_seccomp_bpf_linux.cc
===================================================================
--- content/common/sandbox_seccomp_bpf_linux.cc	(revision 200134)
+++ content/common/sandbox_seccomp_bpf_linux.cc	(working copy)
@@ -658,16 +658,16 @@
   switch (sysno) {
     case __NR_brk:
     case __NR_mlock:
+    case __NR_mprotect:
+    case __NR_munlock:
+    case __NR_munmap:
+      return true;
 #if defined(__i386__) || defined(__x86_64__)
-    case __NR_mmap:   // TODO(jln): to restrict flags.
+    case __NR_mmap:
 #endif
 #if defined(__i386__) || defined(__arm__)
     case __NR_mmap2:
 #endif
-    case __NR_mprotect:
-    case __NR_munlock:
-    case __NR_munmap:
-      return true;
     case __NR_madvise:
     case __NR_mincore:
     case __NR_mlockall:
@@ -1236,6 +1236,16 @@
   }
 }
 
+ErrorCode RestrictMmapFlags(Sandbox *sandbox) {
+  // These flags are allowed. Significantly, we don't permit MAP_HUGETLB, or
+  // the newer flags such as MAP_POPULATE.
+  uint32_t mask = ~(MAP_SHARED | MAP_PRIVATE | MAP_ANONYMOUS | MAP_STACK |
+                    MAP_NORESERVE | MAP_FIXED);
+  return sandbox->Cond(3, ErrorCode::TP_32BIT, ErrorCode::OP_HAS_ANY_BITS,
+                       mask, sandbox->Trap(CrashSIGSYS_Handler, NULL),
+                       ErrorCode(ErrorCode::ERR_ALLOWED));
+}
+
 ErrorCode BaselinePolicy(Sandbox *sandbox, int sysno) {
 #if defined(__x86_64__) || defined(__arm__)
   if (sysno == __NR_socketpair) {
@@ -1246,12 +1256,24 @@
                          sandbox->Trap(CrashSIGSYS_Handler, NULL));
   }
 #endif
-  if (sysno == __NR_madvise) {
+  switch (sysno) {
+  case __NR_madvise:
     // Only allow MADV_DONTNEED (aka MADV_FREE).
     return sandbox->Cond(2, ErrorCode::TP_32BIT,
                          ErrorCode::OP_EQUAL, MADV_DONTNEED,
                          ErrorCode(ErrorCode::ERR_ALLOWED),
                          ErrorCode(EPERM));
+#if defined(__x86_64__)

[jln (very slow on Chromium), 2013/05/15 20:03:52]

Arg, had missed one important nit:

#ifdef are really only used in this file for when things can't compile. Not to
define the policy. Use IsArchitectureArm() etc to define the policy instead.

Currently, this is very confusing!

+  case __NR_mmap:
+    return RestrictMmapFlags(sandbox);
+#elif defined(__i386__)
+  case __NR_mmap:
+    return ErrorCode(ErrorCode::ERR_ALLOWED);
+#endif
+#if defined(__i386__) || defined(__arm__)
+  case __NR_mmap2:
+    return ErrorCode(ErrorCode::ERR_ALLOWED);
+#endif
   }
 
   if (IsBaselinePolicyAllowed(sysno)) {