Linux sandbox: restrict *kill to the current process.

sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.cc

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.h"
 
 #include <errno.h>
 #include <fcntl.h>
 #include <fcntl.h>
 #include <linux/net.h>
@@ skipping 193 matching lines @@
          sandbox->Cond(0, ErrorCode::TP_32BIT, ErrorCode::OP_EQUAL,
                        SYS_SHUTDOWN, ErrorCode(ErrorCode::ERR_ALLOWED),
          sandbox->Cond(0, ErrorCode::TP_32BIT, ErrorCode::OP_EQUAL,
                        SYS_SENDMSG, ErrorCode(ErrorCode::ERR_ALLOWED),
          sandbox->Cond(0, ErrorCode::TP_32BIT, ErrorCode::OP_EQUAL,
                        SYS_RECVMSG, ErrorCode(ErrorCode::ERR_ALLOWED),
          ErrorCode(EPERM)))))))));
 }
 #endif
 
+ErrorCode RestrictKillTarget(pid_t target_pid, SandboxBPF* sandbox, int sysno) {
+  switch (sysno) {
+    case __NR_kill:
+    case __NR_tgkill:
+      return sandbox->Cond(0, ErrorCode::TP_32BIT, ErrorCode::OP_EQUAL,
+                           target_pid,
+                           ErrorCode(ErrorCode::ERR_ALLOWED),
+                           sandbox->Trap(SIGSYSKillFailure, NULL));
+    case __NR_tkill:
+      return sandbox->Trap(SIGSYSKillFailure, NULL);
+    default:
+      NOTREACHED();
+      return sandbox->Trap(CrashSIGSYS_Handler, NULL);
+  }
+}
+
 }  // namespace sandbox.