Linux sandbox: restrict *kill to the current process.

sandbox/linux/seccomp-bpf-helpers/baseline_policy.cc

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sandbox/linux/seccomp-bpf-helpers/baseline_policy.h"
 
 #include <errno.h>
 #include <sys/mman.h>
+#include <sys/socket.h>
+#include <sys/syscall.h>
 #include <sys/types.h>
-#include <sys/socket.h>
+#include <unistd.h>
 
 #include "base/logging.h"
 #include "build/build_config.h"
 #include "sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.h"
 #include "sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.h"
 #include "sandbox/linux/seccomp-bpf-helpers/syscall_sets.h"
 #include "sandbox/linux/seccomp-bpf/sandbox_bpf.h"
 #include "sandbox/linux/seccomp-bpf/sandbox_bpf_policy.h"
 #include "sandbox/linux/services/linux_syscalls.h"
 
@@ skipping 14 matching lines @@
          SyscallSets::IsAllowedGettime(sysno) ||
          SyscallSets::IsAllowedPrctl(sysno) ||
          SyscallSets::IsAllowedProcessStartOrDeath(sysno) ||
          SyscallSets::IsAllowedSignalHandling(sysno) ||
          SyscallSets::IsFutex(sysno) ||
          SyscallSets::IsGetSimpleId(sysno) ||
          SyscallSets::IsKernelInternalApi(sysno) ||
 #if defined(__arm__)
          SyscallSets::IsArmPrivate(sysno) ||
 #endif
-         SyscallSets::IsKill(sysno) ||
          SyscallSets::IsAllowedOperationOnFd(sysno);
 }
 
 // System calls that will trigger the crashing SIGSYS handler.
 bool IsBaselinePolicyWatched(int sysno) {
   return SyscallSets::IsAdminOperation(sysno) ||
          SyscallSets::IsAdvancedScheduler(sysno) ||
          SyscallSets::IsAdvancedTimer(sysno) ||
          SyscallSets::IsAsyncIo(sysno) ||
          SyscallSets::IsDebug(sysno) ||
          SyscallSets::IsEventFd(sysno) ||
          SyscallSets::IsExtendedAttributes(sysno) ||
          SyscallSets::IsFaNotify(sysno) ||
          SyscallSets::IsFsControl(sysno) ||
          SyscallSets::IsGlobalFSViewChange(sysno) ||
          SyscallSets::IsGlobalProcessEnvironment(sysno) ||
          SyscallSets::IsGlobalSystemStatus(sysno) ||
          SyscallSets::IsInotify(sysno) ||
          SyscallSets::IsKernelModule(sysno) ||
          SyscallSets::IsKeyManagement(sysno) ||
+         SyscallSets::IsKill(sysno) ||
          SyscallSets::IsMessageQueue(sysno) ||
          SyscallSets::IsMisc(sysno) ||
 #if defined(__x86_64__)
          SyscallSets::IsNetworkSocketInformation(sysno) ||
 #endif
          SyscallSets::IsNuma(sysno) ||
          SyscallSets::IsProcessGroupOrSession(sysno) ||
 #if defined(__i386__)
          SyscallSets::IsSocketCall(sysno) ||
 #endif
 #if defined(__arm__)
          SyscallSets::IsArmPciConfig(sysno) ||
 #endif
          SyscallSets::IsTimer(sysno);
 }
 
 // |fs_denied_errno| is the errno return for denied filesystem access.
-ErrorCode EvaluateSyscallImpl(int fs_denied_errno, SandboxBPF* sandbox,
+ErrorCode EvaluateSyscallImpl(int fs_denied_errno,
+                              pid_t current_pid,
+                              SandboxBPF* sandbox,
                               int sysno) {
   if (IsBaselinePolicyAllowed(sysno)) {
     return ErrorCode(ErrorCode::ERR_ALLOWED);
   }
 
 #if defined(__x86_64__) || defined(__arm__)
   if (sysno == __NR_socketpair) {
     // Only allow AF_UNIX, PF_UNIX. Crash if anything else is seen.
     COMPILE_ASSERT(AF_UNIX == PF_UNIX, af_unix_pf_unix_different);
     return sandbox->Cond(0, ErrorCode::TP_32BIT, ErrorCode::OP_EQUAL, AF_UNIX,
@@ skipping 24 matching lines @@
     return RestrictMprotectFlags(sandbox);
 
   if (sysno == __NR_fcntl)
     return RestrictFcntlCommands(sandbox);
 
 #if defined(__i386__) || defined(__arm__)
   if (sysno == __NR_fcntl64)
     return RestrictFcntlCommands(sandbox);
 #endif
 
+  if (SyscallSets::IsKill(sysno)) {
+    return RestrictKillTarget(current_pid, sandbox, sysno);
+  }
+
   if (SyscallSets::IsFileSystem(sysno) ||
       SyscallSets::IsCurrentDirectory(sysno)) {
     return ErrorCode(fs_denied_errno);
   }
 
   if (SyscallSets::IsAnySystemV(sysno)) {
     return ErrorCode(EPERM);
   }
 
   if (SyscallSets::IsUmask(sysno) ||
       SyscallSets::IsDeniedFileSystemAccessViaFd(sysno) ||
       SyscallSets::IsDeniedGetOrModifySocket(sysno) ||
       SyscallSets::IsProcessPrivilegeChange(sysno)) {
     return ErrorCode(EPERM);
   }
 
 #if defined(__i386__)
   if (SyscallSets::IsSocketCall(sysno))
     return RestrictSocketcallCommand(sandbox);
 #endif
 
   if (IsBaselinePolicyWatched(sysno)) {
     // Previously unseen syscalls. TODO(jln): some of these should
     // be denied gracefully right away.
     return sandbox->Trap(CrashSIGSYS_Handler, NULL);
   }
+
   // In any other case crash the program with our SIGSYS handler.
   return sandbox->Trap(CrashSIGSYS_Handler, NULL);
 }
 
 }  // namespace.
 
 // Unfortunately C++03 doesn't allow delegated constructors.
 // Call other constructor when C++11 lands.
 BaselinePolicy::BaselinePolicy()
-    : fs_denied_errno_(EPERM) {}
+    : fs_denied_errno_(EPERM), current_pid_(syscall(__NR_getpid)) {}
 
 BaselinePolicy::BaselinePolicy(int fs_denied_errno)
-    : fs_denied_errno_(fs_denied_errno) {}
+    : fs_denied_errno_(fs_denied_errno), current_pid_(syscall(__NR_getpid)) {}
 
-BaselinePolicy::~BaselinePolicy() {}
+BaselinePolicy::~BaselinePolicy() {
+  // Make sure that this policy is created, used and destroyed by a single
+  // process.
+  DCHECK_EQ(syscall(__NR_getpid), current_pid_);
+}
 
 ErrorCode BaselinePolicy::EvaluateSyscall(SandboxBPF* sandbox,
                                           int sysno) const {
-  return EvaluateSyscallImpl(fs_denied_errno_, sandbox, sysno);
+  // Make sure that this policy is used in the creating process.
+  if (1 == sysno) {
+    DCHECK_EQ(syscall(__NR_getpid), current_pid_);
+  }
+  return EvaluateSyscallImpl(fs_denied_errno_, current_pid_, sandbox, sysno);
 }
 
 }  // namespace sandbox.