[Android] Permit sched_getparam(), pwrite64(), and getsockopt() under Seccomp.

[Android] Permit sched_getparam(), pwrite64(), and getsockopt() under Seccomp.

BUG=586056
R=mdempsky@chromium.org

Committed: https://crrev.com/d4b0dfa615601cc18ba31c58ae5c53203126567d
Cr-Commit-Position: refs/heads/master@{#376045}

[mdempsky, 2016-02-17 21:54:52]

I checked the bug and didn't see any explanation what the three syscalls are
needed for specifically.  Did I miss something?  If not, could you add a quick
explanation either to the CL description or the issue?

https://codereview.chromium.org/1705243002/diff/1/content/common/sandbox_linu...
File content/common/sandbox_linux/android/sandbox_bpf_base_policy_android.cc
(right):

https://codereview.chromium.org/1705243002/diff/1/content/common/sandbox_linu...
content/common/sandbox_linux/android/sandbox_bpf_base_policy_android.cc:87: case
__NR_sched_getparam:
It is possible/reasonable to restrict which pids can be used with
sched_getparam?

[Robert Sesek, 2016-02-17 22:50:11]

On 2016/02/17 21:54:52, mdempsky wrote:
> I checked the bug and didn't see any explanation what the three syscalls are
> needed for specifically.  Did I miss something?  If not, could you add a quick
> explanation either to the CL description or the issue?

The analysis I was able to produce is here:
https://code.google.com/p/chromium/issues/detail?id=586056#c9 (and comment 8).

In my testing, I haven't been able to reproduce these crashes, so I can't get
better stack traces. I did just post a new comment on the bug with references to
where these things are used in the framework.

https://codereview.chromium.org/1705243002/diff/1/content/common/sandbox_linu...
File content/common/sandbox_linux/android/sandbox_bpf_base_policy_android.cc
(right):

https://codereview.chromium.org/1705243002/diff/1/content/common/sandbox_linu...
content/common/sandbox_linux/android/sandbox_bpf_base_policy_android.cc:87: case
__NR_sched_getparam:
On 2016/02/17 21:54:52, mdempsky wrote:
> It is possible/reasonable to restrict which pids can be used with
> sched_getparam?

No, because Bionic passes a TID to this in its pthreads implementation, and it's
used on newly created threads in certain instances. It'd be nice to be able to
restrict this to 0, but sadly, no.

[mdempsky, 2016-02-17 22:52:04]

lgtm

[Robert Sesek, 2016-02-17 23:10:45]

The CQ bit was checked by rsesek@chromium.org

[commit-bot: I haz the power, 2016-02-17 23:12:50]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1705243002/1
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1705243002/1

[commit-bot: I haz the power, 2016-02-18 00:14:36]

Committed patchset #1 (id:1)

[commit-bot: I haz the power, 2016-02-18 00:15:34]

Description was changed from

==========
[Android] Permit sched_getparam(), pwrite64(), and getsockopt() under Seccomp.

BUG=586056
R=mdempsky@chromium.org
==========

to

==========
[Android] Permit sched_getparam(), pwrite64(), and getsockopt() under Seccomp.

BUG=586056
R=mdempsky@chromium.org

Committed: https://crrev.com/d4b0dfa615601cc18ba31c58ae5c53203126567d
Cr-Commit-Position: refs/heads/master@{#376045}
==========

[commit-bot: I haz the power, 2016-02-18 00:15:35]

Patchset 1 (id:??) landed as
https://crrev.com/d4b0dfa615601cc18ba31c58ae5c53203126567d
Cr-Commit-Position: refs/heads/master@{#376045}