Non-SFI NaCl: Disallow mmap with PROT_EXEC

components/nacl/loader/nonsfi/nonsfi_sandbox.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "components/nacl/loader/nonsfi/nonsfi_sandbox.h"
 
 #include <errno.h>
 #include <fcntl.h>
 #include <linux/net.h>
 #include <sys/prctl.h>
@@ skipping 92 matching lines @@
          sb->Cond(0, ErrorCode::TP_32BIT, ErrorCode::OP_EQUAL,
                   SYS_RECVMSG,
                   ErrorCode(ErrorCode::ERR_ALLOWED),
          sb->Cond(0, ErrorCode::TP_32BIT, ErrorCode::OP_EQUAL,
                   SYS_SHUTDOWN,
                   ErrorCode(ErrorCode::ERR_ALLOWED),
                   sb->Trap(sandbox::CrashSIGSYS_Handler, NULL)))));
 }
 #endif
 
-ErrorCode RestrictMemoryProtection(SandboxBPF* sb, int argno) {
-  // TODO(jln, keescook, drewry): Limit the use of mmap/mprotect by
-  // adding some features to linux kernel.
+ErrorCode RestrictMprotect(SandboxBPF* sb) {
+  // TODO(jln, keescook, drewry): Limit the use of mprotect by adding
+  // some features to linux kernel.
   const uint32_t denied_mask = ~(PROT_READ | PROT_WRITE | PROT_EXEC);
-  return sb->Cond(argno, ErrorCode::TP_32BIT,
+  return sb->Cond(2, ErrorCode::TP_32BIT,
                   ErrorCode::OP_HAS_ANY_BITS,
                   denied_mask,
          sb->Trap(sandbox::CrashSIGSYS_Handler, NULL),
                   ErrorCode(ErrorCode::ERR_ALLOWED));
 }
 
 ErrorCode RestrictMmap(SandboxBPF* sb) {
   const uint32_t denied_flag_mask = ~(MAP_SHARED | MAP_PRIVATE |
                                       MAP_ANONYMOUS | MAP_STACK | MAP_FIXED);
-  // TODO(hamaji): Disallow RWX mmap.
+  // When PROT_EXEC is specified, IRT mmap of Non-SFI NaCl helper
+  // calls mmap without PROT_EXEC and then add PROT_EXEC by mprotect,

[Mark Seaborn, 2014/04/26 00:26:01]

"adds"

[hamaji, 2014/04/26 02:13:25]

Done.

+  // so we do not need to allow PROT_EXEC in mmap.
+  const uint32_t denied_prot_mask = ~(PROT_READ | PROT_WRITE);
   return sb->Cond(3, ErrorCode::TP_32BIT,
                   ErrorCode::OP_HAS_ANY_BITS,
                   denied_flag_mask,
-         sb->Trap(sandbox::CrashSIGSYS_Handler, NULL),
-                  RestrictMemoryProtection(sb, 2));
+                  sb->Trap(sandbox::CrashSIGSYS_Handler, NULL),
+         sb->Cond(2, ErrorCode::TP_32BIT,
+                  ErrorCode::OP_HAS_ANY_BITS,
+                  denied_prot_mask,
+                  sb->Trap(sandbox::CrashSIGSYS_Handler, NULL),
+                  ErrorCode(ErrorCode::ERR_ALLOWED)));
 }
 
 ErrorCode RestrictSocketpair(SandboxBPF* sb) {
   // Only allow AF_UNIX, PF_UNIX. Crash if anything else is seen.
   COMPILE_ASSERT(AF_UNIX == PF_UNIX, af_unix_pf_unix_different);
   return sb->Cond(0, ErrorCode::TP_32BIT,
                   ErrorCode::OP_EQUAL, AF_UNIX,
                   ErrorCode(ErrorCode::ERR_ALLOWED),
          sb->Trap(sandbox::CrashSIGSYS_Handler, NULL));
 }
@@ skipping 117 matching lines @@
       return RestrictFcntlCommands(sb);
 
 #if defined(__x86_64__)
     case __NR_mmap:
 #endif
 #if defined(__i386__) || defined(__arm__)
     case __NR_mmap2:
 #endif
       return RestrictMmap(sb);
     case __NR_mprotect:
-      return RestrictMemoryProtection(sb, 2);
+      return RestrictMprotect(sb);
 
     case __NR_prctl:
       return RestrictPrctl(sb);
 
 #if defined(__i386__)
     case __NR_socketcall:
       return RestrictSocketcall(sb);
 #endif
 #if defined(__x86_64__) || defined(__arm__)
     case __NR_recvmsg:
@@ skipping 25 matching lines @@
       scoped_ptr<sandbox::SandboxBPFPolicy>(
           new nacl::nonsfi::NaClNonSfiBPFSandboxPolicy()));
   if (!sandbox_is_initialized)
     return false;
   RunSandboxSanityChecks();
   return true;
 }
 
 }  // namespace nonsfi
 }  // namespace nacl