Non-SFI NaCl: Disallow mmap with PROT_EXEC

components/nacl/loader/nonsfi/nonsfi_sandbox_unittest.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // ASan internally uses some syscalls which non-SFI NaCl disallows.
 // Seccomp-BPF tests die under TSan v2. See http://crbug.com/356588
 #if !defined(ADDRESS_SANITIZER) && !defined(THREAD_SANITIZER)
 
 #include "components/nacl/loader/nonsfi/nonsfi_sandbox.h"
 
@@ skipping 287 matching lines @@
        MAP_ANONYMOUS | MAP_POPULATE, -1, 0);
 }
 
 BPF_DEATH_TEST(NaClNonSfiSandboxTest, mmap_unallowed_prot,
                DEATH_MESSAGE(sandbox::GetErrorMessageContentForTests()),
                nacl::nonsfi::NaClNonSfiBPFSandboxPolicy::EvaluateSyscallImpl) {
   mmap(NULL, getpagesize(), PROT_READ | PROT_GROWSDOWN,
        MAP_ANONYMOUS, -1, 0);
 }
 
-// TODO(hamaji): Disallow RWX mmap.
-#if 0
+BPF_DEATH_TEST(NaClNonSfiSandboxTest, mmap_exec,
+               DEATH_MESSAGE(sandbox::GetErrorMessageContentForTests()),
+               nacl::nonsfi::NaClNonSfiBPFSandboxPolicy::EvaluateSyscallImpl) {
+  mmap(NULL, getpagesize(), PROT_EXEC, MAP_ANONYMOUS, -1, 0);
+}

[jln (very slow on Chromium), 2014/04/24 16:46:38]

Do you mind adding another test with PROT_EXEC | PROT_WRITE for instance?

Generating BPF filters with bitmasks is notoriously difficult, so I wouldn't
mind a bit more testing or the protections / flags.

[hamaji, 2014/04/25 01:44:47]

Added cases for RX and WX.

+
 BPF_DEATH_TEST(NaClNonSfiSandboxTest, mmap_rwx,
                DEATH_MESSAGE(sandbox::GetErrorMessageContentForTests()),
                nacl::nonsfi::NaClNonSfiBPFSandboxPolicy::EvaluateSyscallImpl) {
   mmap(NULL, getpagesize(), PROT_READ | PROT_WRITE | PROT_EXEC,
        MAP_ANONYMOUS, -1, 0);
 }
-#endif
 
 BPF_TEST(NaClNonSfiSandboxTest, mprotect_allowed,
          nacl::nonsfi::NaClNonSfiBPFSandboxPolicy::EvaluateSyscallImpl) {
   void* ptr = DoAllowedAnonymousMmap();
   BPF_ASSERT_NE(MAP_FAILED, ptr);
   BPF_ASSERT_EQ(0, mprotect(ptr, getpagesize(), PROT_READ));
   BPF_ASSERT_EQ(0, munmap(ptr, getpagesize()));
 }
 
 BPF_DEATH_TEST(NaClNonSfiSandboxTest, mprotect_unallowed_prot,
@@ skipping 135 matching lines @@
          nacl::nonsfi::NaClNonSfiBPFSandboxPolicy::EvaluateSyscallImpl) {
   errno = 0;
   BPF_ASSERT_EQ(-1, syscall(__NR_time));
   BPF_ASSERT_EQ(EPERM, errno);
 }
 #endif
 
 }  // namespace
 
 #endif  // !ADDRESS_SANITIZER && !THREAD_SANITIZER