[Android] Permit sched_getparam(), pwrite64(), and getsockopt() under Seccomp.

content/common/sandbox_linux/android/sandbox_bpf_base_policy_android.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/common/sandbox_linux/android/sandbox_bpf_base_policy_android.h"
 
 #include <errno.h>
 #include <fcntl.h>
 #include <linux/net.h>
 #include <sys/socket.h>
@@ skipping 64 matching lines @@
     // File system access cannot be restricted with seccomp-bpf on Android,
     // since the JVM classloader and other Framework features require file
     // access. It may be possible to restrict the filesystem with SELinux.
     // Currently we rely on the app/service UID isolation to create a
     // filesystem "sandbox".
 #if !defined(ARCH_CPU_ARM64)
     case __NR_open:
 #endif
     case __NR_openat:
     case __NR_pread64:
+    case __NR_pwrite64:
     case __NR_rt_sigtimedwait:
+    case __NR_sched_getparam:

[mdempsky, 2016/02/17 21:54:52]

It is possible/reasonable to restrict which pids can be used with
sched_getparam?

[Robert Sesek, 2016/02/17 22:50:11]

No, because Bionic passes a TID to this in its pthreads implementation, and it's
used on newly created threads in certain instances. It'd be nice to be able to
restrict this to 0, but sadly, no.

     case __NR_setpriority:
     case __NR_set_tid_address:
     case __NR_sigaltstack:
 #if defined(__i386__) || defined(__arm__)
     case __NR_ugetrlimit:
 #else
     case __NR_getrlimit:
 #endif
     case __NR_uname:
 
     // Permit socket operations so that renderers can connect to logd and
     // debuggerd. The arguments to socket() are further restricted below.
     // Note that on i386, both of these calls map to __NR_socketcall, which
     // is demultiplexed below.
 #if defined(__x86_64__) || defined(__arm__) || defined(__aarch64__) || \
       defined(__mips__)
+    case __NR_getsockopt:
+    case __NR_connect:
     case __NR_socket:
-    case __NR_connect:
 #endif
 
     // Ptrace is allowed so the Breakpad Microdumper can fork in a renderer
     // and then ptrace the parent.
     case __NR_ptrace:
       override_and_allow = true;
       break;
   }
 
 #if defined(__x86_64__) || defined(__arm__) || defined(__aarch64__) || \
       defined(__mips__)
   if (sysno == __NR_socket) {
     const Arg<int> domain(0);
     const Arg<int> type(1);
     const Arg<int> protocol(2);
     return If(RestrictSocketArguments(domain, type, protocol), Allow())
            .Else(Error(EPERM));
   }
 #elif defined(__i386__)
   if (sysno == __NR_socketcall) {
     const Arg<int> socketcall(0);
     const Arg<int> domain(1);
     const Arg<int> type(2);
     const Arg<int> protocol(3);
     return If(socketcall == SYS_CONNECT, Allow())
            .ElseIf(AllOf(socketcall == SYS_SOCKET,
                          RestrictSocketArguments(domain, type, protocol)),
                    Allow())
+           .ElseIf(socketcall == SYS_GETSOCKOPT, Allow())
            .Else(Error(EPERM));
   }
 #endif
 
   if (override_and_allow)
     return Allow();
 
   return SandboxBPFBasePolicy::EvaluateSyscall(sysno);
 }
 
 }  // namespace content