Linux sandbox: disallow fork() and *kill for ASAN

sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.cc

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.h"
 
 #include <errno.h>
 #include <fcntl.h>
 #include <fcntl.h>
 #include <linux/net.h>
@@ skipping 17 matching lines @@
 #define F_DUPFD_CLOEXEC (F_LINUX_SPECIFIC_BASE + 6)
 #endif
 #endif
 
 #if defined(__arm__) && !defined(MAP_STACK)
 #define MAP_STACK 0x20000  // Daisy build environment has old headers.
 #endif
 
 namespace {
 
-inline bool RunningOnASAN() {
-#if defined(ADDRESS_SANITIZER)
-  return true;
-#else
-  return false;
-#endif
-}
-
 inline bool IsArchitectureX86_64() {
 #if defined(__x86_64__)
   return true;
 #else
   return false;
 #endif
 }
 
 inline bool IsArchitectureI386() {
 #if defined(__i386__)
   return true;
 #else
   return false;
 #endif
 }
 
 }  // namespace.
 
 namespace sandbox {
 
 ErrorCode RestrictCloneToThreadsAndEPERMFork(SandboxBPF* sandbox) {
   // Glibc's pthread.
-  // TODO(jln): fix this on ASAN.
-  if (!RunningOnASAN()) {
-    return sandbox->Cond(0, ErrorCode::TP_32BIT, ErrorCode::OP_EQUAL,
-                         CLONE_VM | CLONE_FS | CLONE_FILES | CLONE_SIGHAND |
-                         CLONE_THREAD | CLONE_SYSVSEM | CLONE_SETTLS |
-                         CLONE_PARENT_SETTID | CLONE_CHILD_CLEARTID,
-                         ErrorCode(ErrorCode::ERR_ALLOWED),
-           sandbox->Cond(0, ErrorCode::TP_32BIT, ErrorCode::OP_EQUAL,
-                         CLONE_PARENT_SETTID | SIGCHLD,
-                         ErrorCode(EPERM),
-           // ARM
-           sandbox->Cond(0, ErrorCode::TP_32BIT, ErrorCode::OP_EQUAL,
-                         CLONE_CHILD_SETTID | CLONE_CHILD_CLEARTID | SIGCHLD,
-                         ErrorCode(EPERM),
-           sandbox->Trap(SIGSYSCloneFailure, NULL))));
-  } else {
-    return ErrorCode(ErrorCode::ERR_ALLOWED);
-  }
+  return sandbox->Cond(0, ErrorCode::TP_32BIT, ErrorCode::OP_EQUAL,
+                       CLONE_VM | CLONE_FS | CLONE_FILES | CLONE_SIGHAND |
+                       CLONE_THREAD | CLONE_SYSVSEM | CLONE_SETTLS |
+                       CLONE_PARENT_SETTID | CLONE_CHILD_CLEARTID,
+                       ErrorCode(ErrorCode::ERR_ALLOWED),
+         sandbox->Cond(0, ErrorCode::TP_32BIT, ErrorCode::OP_EQUAL,
+                       CLONE_PARENT_SETTID | SIGCHLD,
+                       ErrorCode(EPERM),
+         // ARM
+         sandbox->Cond(0, ErrorCode::TP_32BIT, ErrorCode::OP_EQUAL,
+                       CLONE_CHILD_SETTID | CLONE_CHILD_CLEARTID | SIGCHLD,
+                       ErrorCode(EPERM),
+         sandbox->Trap(SIGSYSCloneFailure, NULL))));
 }
 
 ErrorCode RestrictPrctl(SandboxBPF* sandbox) {
   // Will need to add seccomp compositing in the future. PR_SET_PTRACER is
   // used by breakpad but not needed anymore.
   return sandbox->Cond(0, ErrorCode::TP_32BIT, ErrorCode::OP_EQUAL,
                        PR_SET_NAME, ErrorCode(ErrorCode::ERR_ALLOWED),
          sandbox->Cond(0, ErrorCode::TP_32BIT, ErrorCode::OP_EQUAL,
                        PR_SET_DUMPABLE, ErrorCode(ErrorCode::ERR_ALLOWED),
          sandbox->Cond(0, ErrorCode::TP_32BIT, ErrorCode::OP_EQUAL,
@@ skipping 110 matching lines @@
                        SYS_SHUTDOWN, ErrorCode(ErrorCode::ERR_ALLOWED),
          sandbox->Cond(0, ErrorCode::TP_32BIT, ErrorCode::OP_EQUAL,
                        SYS_SENDMSG, ErrorCode(ErrorCode::ERR_ALLOWED),
          sandbox->Cond(0, ErrorCode::TP_32BIT, ErrorCode::OP_EQUAL,
                        SYS_RECVMSG, ErrorCode(ErrorCode::ERR_ALLOWED),
          ErrorCode(EPERM)))))))));
 }
 #endif
 
 ErrorCode RestrictKillTarget(pid_t target_pid, SandboxBPF* sandbox, int sysno) {
-  if (!RunningOnASAN()) {
-    switch (sysno) {
-      case __NR_kill:
-      case __NR_tgkill:
-        return sandbox->Cond(0,
-                             ErrorCode::TP_32BIT,
-                             ErrorCode::OP_EQUAL,
-                             target_pid,
-                             ErrorCode(ErrorCode::ERR_ALLOWED),
-                             sandbox->Trap(SIGSYSKillFailure, NULL));
-      case __NR_tkill:
-        return sandbox->Trap(SIGSYSKillFailure, NULL);
-      default:
-        NOTREACHED();
-        return sandbox->Trap(CrashSIGSYS_Handler, NULL);
-    }
-  } else {
-    switch (sysno) {
-      case __NR_kill:
-      case __NR_tgkill:
-      case __NR_tkill:
-        // On ASAN, fork() is not properly denied. This could lead to the
-        // strange failures we're observing with this policy on ASAN.
-        // TODO(jln): fix this.
-        return ErrorCode(ErrorCode::ERR_ALLOWED);
-      default:
-        NOTREACHED();
-        return sandbox->Trap(CrashSIGSYS_Handler, NULL);
-    }
+  switch (sysno) {
+    case __NR_kill:
+    case __NR_tgkill:
+      return sandbox->Cond(0,
+                           ErrorCode::TP_32BIT,
+                           ErrorCode::OP_EQUAL,
+                           target_pid,
+                           ErrorCode(ErrorCode::ERR_ALLOWED),
+                           sandbox->Trap(SIGSYSKillFailure, NULL));
+    case __NR_tkill:
+      return sandbox->Trap(SIGSYSKillFailure, NULL);
+    default:
+      NOTREACHED();
+      return sandbox->Trap(CrashSIGSYS_Handler, NULL);
   }
 }
 
 }  // namespace sandbox.