[M57 Merge] Fix socket restrictions in the Android seccomp policy.

content/common/sandbox_linux/android/sandbox_bpf_base_policy_android.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/common/sandbox_linux/android/sandbox_bpf_base_policy_android.h"
 
 #include <errno.h>
 #include <fcntl.h>
 #include <linux/net.h>
 #include <sys/socket.h>
@@ skipping 20 matching lines @@
 namespace content {
 
 #ifndef SOCK_CLOEXEC
 #define SOCK_CLOEXEC O_CLOEXEC
 #endif
 
 #ifndef SOCK_NONBLOCK
 #define SOCK_NONBLOCK O_NONBLOCK
 #endif
 
+#define CASES SANDBOX_BPF_DSL_CASES
+
 namespace {
 
 #if !defined(__i386__)
 // Restricts the arguments to sys_socket() to AF_UNIX. Returns a BoolExpr that
 // evaluates to true if the syscall should be allowed.
 BoolExpr RestrictSocketArguments(const Arg<int>& domain,
                                  const Arg<int>& type,
                                  const Arg<int>& protocol) {
   const int kSockFlags = SOCK_CLOEXEC | SOCK_NONBLOCK;
   return AllOf(domain == AF_UNIX,
@@ skipping 119 matching lines @@
     return If(RestrictSocketArguments(domain, type, protocol), Allow())
            .Else(Error(EPERM));
   }
 
   // https://crbug.com/655300
   if (sysno == __NR_getsockname) {
     // Rather than blocking with SIGSYS, just return an error. This is not
     // documented to be a valid errno, but we will use it anyways.
     return Error(EPERM);
   }
+
+  // https://crbug.com/682488
+  if (sysno == __NR_setsockopt) {
+    // The baseline policy applies other restrictions to setsockopt.
+    const Arg<int> level(1);
+    const Arg<int> option(2);
+    return If(AllOf(level == SOL_SOCKET, option == SO_SNDTIMEO), Allow())
+           .Else(SandboxBPFBasePolicy::EvaluateSyscall(sysno));
+  }
 #elif defined(__i386__)
   if (sysno == __NR_socketcall) {
+    // The baseline policy allows other socketcall sub-calls.
     const Arg<int> socketcall(0);
-    const Arg<int> domain(1);
-    const Arg<int> type(2);
-    const Arg<int> protocol(3);
-    return If(socketcall == SYS_CONNECT, Allow())
-           .ElseIf(socketcall == SYS_SOCKET, Allow())
-           .ElseIf(socketcall == SYS_GETSOCKOPT, Allow())
-           .Else(Error(EPERM));
+    return Switch(socketcall)
+        .CASES((SYS_CONNECT,
+                SYS_SOCKET,
+                SYS_SETSOCKOPT,
+                SYS_GETSOCKOPT),
+               Allow())
+        .Default(SandboxBPFBasePolicy::EvaluateSyscall(sysno));
   }
 #endif
 
   if (override_and_allow)
     return Allow();
 
   return SandboxBPFBasePolicy::EvaluateSyscall(sysno);
 }
 
 }  // namespace content