Bootstrap Sandbox: Ensure swap_integer messages are read-only.

sandbox/mac/launchd_interception_server.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sandbox/mac/launchd_interception_server.h"
 
 #include <bsm/libbsm.h>
 #include <servers/bootstrap.h>
 
 #include "base/logging.h"
@@ skipping 213 matching lines @@
     compat_shim_.look_up2_fill_reply(reply, result_port);
     SendReply(reply);
   } else {
     NOTREACHED();
   }
 }
 
 void LaunchdInterceptionServer::HandleSwapInteger(mach_msg_header_t* request,
                                                   mach_msg_header_t* reply,
                                                   pid_t sender_pid) {
-  // TODO(rsesek): Crack the message and ensure that the swap is only being
-  // used to get the value of a VPROC key, and do not allow setting it.
-  VLOG(2) << "Forwarding vproc swap message #" << request->msgh_id;
-  ForwardMessage(request, reply);
+  // Only allow getting information out of launchd. Do not allow setting
+  // values. Two commonly observed values that are retrieved are
+  // VPROC_GSK_MGR_PID and VPROC_GSK_TRANSACTIONS_ENABLED.
+  if (compat_shim_.swap_integer_is_get_only(request)) {
+    VLOG(2) << "Forwarding vproc swap_integer message.";
+    ForwardMessage(request, reply);
+  } else {
+    VLOG(2) << "Rejecting non-read-only swap_integer message.";
+    RejectMessage(request, reply, BOOTSTRAP_NOT_PRIVILEGED);
+  }
 }
 
 void LaunchdInterceptionServer::SendReply(mach_msg_header_t* reply) {
   kern_return_t kr = mach_msg(reply, MACH_SEND_MSG, reply->msgh_size, 0,
       MACH_PORT_NULL, MACH_MSG_TIMEOUT_NONE, MACH_PORT_NULL);
   if (kr != KERN_SUCCESS) {
     MACH_LOG(ERROR, kr) << "Unable to send intercepted reply message.";
   }
 }
 
@@ skipping 16 matching lines @@
   mig_reply_error_t* error_reply = reinterpret_cast<mig_reply_error_t*>(reply);
   error_reply->Head.msgh_size = sizeof(mig_reply_error_t);
   error_reply->Head.msgh_bits =
       MACH_MSGH_BITS_REMOTE(MACH_MSG_TYPE_MOVE_SEND_ONCE);
   error_reply->NDR = NDR_record;
   error_reply->RetCode = error_code;
   SendReply(&error_reply->Head);
 }
 
 }  // namespace sandbox