Bootstrap Sandbox: Ensure swap_integer messages are read-only.

sandbox/mac/os_compatibility.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sandbox/mac/os_compatibility.h"
 
 #include <servers/bootstrap.h>
 #include <unistd.h>
 
 #include "base/mac/mac_util.h"
@@ skipping 25 matching lines @@
   mach_msg_header_t Head;
   NDR_record_t NDR;
   name_t servicename;
   pid_t targetpid;
   uuid_t instanceid;
   uint64_t flags;
 };
 
 // look_up2_reply_10_7 is the same as the 10_6 version.
 
+// Verified from:
+//   launchd-329.3.3 (10.6.8)
+//   launchd-392.39 (10.7.5)
+//   launchd-442.26.2 (10.8.5)
+//   launchd-842.1.4 (10.9.0)
+typedef int vproc_gsk_t;  // Defined as an enum in liblaunch/vproc_priv.h.
+struct swap_integer_request_10_6 {
+  mach_msg_header_t Head;
+  NDR_record_t NDR;
+  vproc_gsk_t inkey;
+  vproc_gsk_t outkey;
+  int64_t inval;
+};
+
 // TODO(rsesek): Libc provides strnlen() starting in 10.7.
 size_t strnlen(const char* str, size_t maxlen) {
   size_t len = 0;
   for (; len < maxlen; ++len, ++str) {
     if (*str == '\0')
       break;
   }
   return len;
 }
 
@@ skipping 14 matching lines @@
   reply->Head.msgh_size = sizeof(R);
   reply->Head.msgh_bits =
       MACH_MSGH_BITS_REMOTE(MACH_MSG_TYPE_MOVE_SEND_ONCE) |
       MACH_MSGH_BITS_COMPLEX;
   reply->msgh_body.msgh_descriptor_count = 1;
   reply->service_port.name = port;
   reply->service_port.disposition = MACH_MSG_TYPE_PORT_SEND;
   reply->service_port.type = MACH_MSG_PORT_DESCRIPTOR;
 }
 
+template <typename R>
+bool LaunchdSwapIntegerIsGetOnly(const mach_msg_header_t* header) {
+  const R* request = reinterpret_cast<const R*>(header);
+  return request->inkey == 0 && request->inval == 0 && request->outkey != 0;

[Mark Mentovai, 2014/05/15 22:36:56]

OK, although request->inval doesn’t matter if request->inkey is 0.

[Robert Sesek, 2014/05/15 22:54:17]

Yes, I was being pedantic in case they accidentally don't check the right thing.

+}
+
 }  // namespace
 
 const LaunchdCompatibilityShim GetLaunchdCompatibilityShim() {
   LaunchdCompatibilityShim shim = {
     .msg_id_look_up2 = 404,
     .msg_id_swap_integer = 416,
-    .look_up2_fill_reply = &LaunchdLookUp2FillReply<look_up2_reply_10_6>
+    .look_up2_fill_reply = &LaunchdLookUp2FillReply<look_up2_reply_10_6>,
+    .swap_integer_is_get_only =
+        &LaunchdSwapIntegerIsGetOnly<swap_integer_request_10_6>,
   };
 
   if (base::mac::IsOSSnowLeopard()) {
     shim.look_up2_get_request_name =
         &LaunchdLookUp2GetRequestName<look_up2_request_10_6>;
   } else if (base::mac::IsOSLionOrLater() &&
              !base::mac::IsOSLaterThanMavericks_DontCallThis()) {
     shim.look_up2_get_request_name =
         &LaunchdLookUp2GetRequestName<look_up2_request_10_7>;
   } else {
     DLOG(ERROR) << "Unknown OS, using launchd compatibility shim from 10.7.";
     shim.look_up2_get_request_name =
         &LaunchdLookUp2GetRequestName<look_up2_request_10_7>;
   }
 
   return shim;
 }
 
 }  // namespace sandbox