Non-SFI NaCl: Disallow epoll family and allow poll instead

components/nacl/loader/nonsfi/nonsfi_sandbox.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "components/nacl/loader/nonsfi/nonsfi_sandbox.h"
 
 #include <errno.h>
 #include <fcntl.h>
 #include <linux/net.h>
 #include <sys/prctl.h>
@@ skipping 125 matching lines @@
   // Only allow AF_UNIX, PF_UNIX. Crash if anything else is seen.
   COMPILE_ASSERT(AF_UNIX == PF_UNIX, af_unix_pf_unix_different);
   return sb->Cond(0, ErrorCode::TP_32BIT,
                   ErrorCode::OP_EQUAL, AF_UNIX,
                   ErrorCode(ErrorCode::ERR_ALLOWED),
          sb->Trap(sandbox::CrashSIGSYS_Handler, NULL));
 }
 
 bool IsGracefullyDenied(int sysno) {
   switch (sysno) {
+    // libevent tries this first and then falls back to poll if
+    // epoll_create fails.
+    case __NR_epoll_create:
     // third_party/libevent uses them, but we can just return -1 from
     // them as it is just checking getuid() != geteuid() and
     // getgid() != getegid()
 #if defined(__i386__) || defined(__arm__)
     case __NR_getegid32:
     case __NR_geteuid32:
     case __NR_getgid32:
     case __NR_getuid32:
 #elif defined(__x86_64__)
     case __NR_getegid:
@@ skipping 53 matching lines @@
     case __NR__llseek:
 #elif defined(__x86_64__)
     case __NR_lseek:
 #endif
     // NaCl runtime exposes clock_gettime and clock_getres to untrusted code.
     case __NR_clock_getres:
     case __NR_clock_gettime:
     case __NR_close:
     case __NR_dup:
     case __NR_dup2:
-    case __NR_epoll_create:
-    case __NR_epoll_ctl:
-    case __NR_epoll_wait:
     case __NR_exit:
     case __NR_exit_group:
 #if defined(__i386__) || defined(__arm__)
     case __NR_fstat64:
 #elif defined(__x86_64__)
     case __NR_fstat:
 #endif
     // TODO(hamaji): Allow only FUTEX_PRIVATE_FLAG.
     case __NR_futex:
     // TODO(hamaji): Remove the need of gettid. Currently, this is
     // called from PlatformThread::CurrentId().
     case __NR_gettid:
     case __NR_gettimeofday:
     case __NR_munmap:
     case __NR_nanosleep:
     // TODO(hamaji): Remove the need of pipe. Currently, this is
     // called from base::MessagePumpLibevent::Init().
     case __NR_pipe:
+    case __NR_poll:
     case __NR_pread64:
     case __NR_pwrite64:
     case __NR_read:
     case __NR_restart_syscall:
     case __NR_sched_yield:
     // __NR_times needed as clock() is called by CommandBufferHelper, which is
     // used by NaCl applications that use Pepper's 3D interfaces.
     // See crbug.com/264856 for details.
     case __NR_times:
     case __NR_write:
@@ skipping 60 matching lines @@
       scoped_ptr<sandbox::SandboxBPFPolicy>(
           new nacl::nonsfi::NaClNonSfiBPFSandboxPolicy()));
   if (!sandbox_is_initialized)
     return false;
   RunSandboxSanityChecks();
   return true;
 }
 
 }  // namespace nonsfi
 }  // namespace nacl