Add PTHREAD_PRIO_INHERIT to POSIX Locks

sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.cc

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.h"
 
 #include <errno.h>
 #include <fcntl.h>
 #include <fcntl.h>
 #include <linux/net.h>
 #include <sched.h>
 #include <signal.h>
 #include <stdint.h>
 #include <sys/mman.h>
 #include <sys/prctl.h>
 #include <sys/resource.h>
 #include <sys/stat.h>
 #include <sys/time.h>
 #include <sys/types.h>
 #include <time.h>
 #include <unistd.h>
 
 #include "base/logging.h"
 #include "base/macros.h"
+#include "base/synchronization/lock.h"
 #include "build/build_config.h"
 #include "sandbox/linux/bpf_dsl/bpf_dsl.h"
+#include "sandbox/linux/bpf_dsl/bpf_dsl_impl.h"
 #include "sandbox/linux/bpf_dsl/seccomp_macros.h"
 #include "sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.h"
 #include "sandbox/linux/seccomp-bpf/sandbox_bpf.h"
 #include "sandbox/linux/system_headers/linux_futex.h"
 #include "sandbox/linux/system_headers/linux_syscalls.h"
 #include "sandbox/linux/system_headers/linux_time.h"
 
 // PNaCl toolchain does not provide sys/ioctl.h header.
 #if !defined(OS_NACL_NONSFI)
 #include <sys/ioctl.h>
@@ skipping 21 matching lines @@
 
 #endif  // defined(OS_ANDROID)
 
 #if defined(__arm__) && !defined(MAP_STACK)
 #define MAP_STACK 0x20000  // Daisy build environment has old headers.
 #endif
 
 #if defined(__mips__) && !defined(MAP_STACK)
 #define MAP_STACK 0x40000
 #endif
+
+#define CASES SANDBOX_BPF_DSL_CASES
+
+using sandbox::bpf_dsl::Allow;
+using sandbox::bpf_dsl::Arg;
+using sandbox::bpf_dsl::BoolExpr;
+using sandbox::bpf_dsl::Error;
+using sandbox::bpf_dsl::If;
+using sandbox::bpf_dsl::Kill;
+using sandbox::bpf_dsl::ResultExpr;
+
+namespace sandbox {
+
 namespace {
 
 inline bool IsArchitectureX86_64() {
 #if defined(__x86_64__)
   return true;
 #else
   return false;
 #endif
 }
 
@@ skipping 14 matching lines @@
 }
 
 inline bool IsArchitectureMips() {
 #if defined(__mips__)
   return true;
 #else
   return false;
 #endif
 }
 
+// Default case for futexes since they occur twice, once when priority
+// inheritance is disallowed and again for the disallowed futex op.
+inline sandbox::bpf_dsl::ResultExpr DisallowFutexOp() {
 // Ubuntu's version of glibc has a race condition in sem_post that can cause
 // it to call futex(2) with bogus op arguments. To workaround this, we need
 // to allow those futex(2) calls to fail with EINVAL, instead of crashing the
 // process. See crbug.com/598471.
-inline bool IsBuggyGlibcSemPost() {
 #if defined(LIBC_GLIBC) && !defined(OS_CHROMEOS)
-  return true;
+  return Error(EINVAL);
 #else
-  return false;
+  return CrashSIGSYSFutex();
 #endif
 }
 
-}  // namespace.
-
-#define CASES SANDBOX_BPF_DSL_CASES
-
-using sandbox::bpf_dsl::Allow;
-using sandbox::bpf_dsl::Arg;
-using sandbox::bpf_dsl::BoolExpr;
-using sandbox::bpf_dsl::Error;
-using sandbox::bpf_dsl::If;
-using sandbox::bpf_dsl::ResultExpr;
-
-namespace sandbox {
+}  // namespace
 
 #if !defined(OS_NACL_NONSFI)
 // Allow Glibc's and Android pthread creation flags, crash on any other
 // thread creation attempts and EPERM attempts to use neither
 // CLONE_VM, nor CLONE_THREAD, which includes all fork() implementations.
 ResultExpr RestrictCloneToThreadsAndEPERMFork() {
   const Arg<unsigned long> flags(0);
 
   // TODO(mdempsky): Extend DSL to support (flags & ~mask1) == mask2.
   const uint64_t kAndroidCloneMask = CLONE_VM | CLONE_FS | CLONE_FILES |
@@ skipping 123 matching lines @@
       NOTREACHED();
       return CrashSIGSYS();
   }
 }
 
 ResultExpr RestrictFutex() {
   const uint64_t kAllowedFutexFlags = FUTEX_PRIVATE_FLAG | FUTEX_CLOCK_REALTIME;
   const Arg<int> op(1);
   return Switch(op & ~kAllowedFutexFlags)
       .CASES((FUTEX_WAIT, FUTEX_WAKE, FUTEX_REQUEUE, FUTEX_CMP_REQUEUE,
-              FUTEX_WAKE_OP, FUTEX_WAIT_BITSET, FUTEX_WAKE_BITSET),
-             Allow())
-      .Default(IsBuggyGlibcSemPost() ? Error(EINVAL) : CrashSIGSYSFutex());
+              FUTEX_WAKE_OP, FUTEX_WAIT_BITSET, FUTEX_WAKE_BITSET), Allow())
+#if PRIORITY_INHERITANCE_LOCKS_POSSIBLE()
+      .CASES((FUTEX_LOCK_PI, FUTEX_UNLOCK_PI, FUTEX_WAIT_REQUEUE_PI,
+              FUTEX_CMP_REQUEUE_PI),
+             base::Lock::PriorityInheritanceAvailable()
+                 ? Allow()
+                 : DisallowFutexOp())
+#endif
+      .Default(DisallowFutexOp());
 }
 
 ResultExpr RestrictGetSetpriority(pid_t target_pid) {
   const Arg<int> which(0);
   const Arg<int> who(1);
   return If(which == PRIO_PROCESS,
             Switch(who).CASES((0, target_pid), Allow()).Default(Error(EPERM)))
       .Else(CrashSIGSYS());
 }
 
@@ skipping 42 matching lines @@
               CLOCK_MONOTONIC_COARSE,
               CLOCK_PROCESS_CPUTIME_ID,
               CLOCK_REALTIME,
               CLOCK_REALTIME_COARSE,
               CLOCK_THREAD_CPUTIME_ID),
              Allow())
       .Default(CrashSIGSYS());
 }
 
 }  // namespace sandbox.