Non-SFI NaCl: Disallow fancy clock IDs

components/nacl/loader/nonsfi/nonsfi_sandbox.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "components/nacl/loader/nonsfi/nonsfi_sandbox.h"
 
 #include <errno.h>
 #include <fcntl.h>
 #include <linux/net.h>
 #include <sys/prctl.h>
@@ skipping 55 matching lines @@
                   ErrorCode(ErrorCode::ERR_ALLOWED),
          sb->Cond(1, ErrorCode::TP_32BIT,
                   ErrorCode::OP_EQUAL, F_SETFL,
                   sb->Cond(2, mask_long_type,
                            ErrorCode::OP_HAS_ANY_BITS, denied_mask,
                            sb->Trap(sandbox::CrashSIGSYS_Handler, NULL),
                            ErrorCode(ErrorCode::ERR_ALLOWED)),
          sb->Trap(sandbox::CrashSIGSYS_Handler, NULL))));
 }
 
+ErrorCode RestrictClockID(SandboxBPF* sb) {
+  // We allow accessing only CLOCK_MONOTONIC, CLOCK_PROCESS_CPUTIME_ID,
+  // CLOCK_REALTIME, and CLOCK_THREAD_CPUTIME_ID.

[Mark Seaborn, 2014/05/20 21:21:30]

Maybe also say: "Don't allow reading the clocks of other processes by specifying
their PIDs."

It's not obvious the syscalls allow that.  I don't think there are even any
#defines for that in the kernel headers.  (glibc has
sysdeps/unix/sysv/linux/kernel-posix-cpu-timers.h, which #defines
MAKE_PROCESS_CPUCLOCK and CPUCLOCK_*.)

[mdempsky, 2014/05/20 23:02:51]

Done.

+  COMPILE_ASSERT(4 == sizeof(clockid_t), clockid_is_not_32bit);
+  return sb->Cond(0, ErrorCode::TP_32BIT,
+                  ErrorCode::OP_EQUAL, CLOCK_MONOTONIC,
+                  ErrorCode(ErrorCode::ERR_ALLOWED),
+         sb->Cond(0, ErrorCode::TP_32BIT,
+                  ErrorCode::OP_EQUAL, CLOCK_PROCESS_CPUTIME_ID,
+                  ErrorCode(ErrorCode::ERR_ALLOWED),
+         sb->Cond(0, ErrorCode::TP_32BIT,
+                  ErrorCode::OP_EQUAL, CLOCK_REALTIME,
+                  ErrorCode(ErrorCode::ERR_ALLOWED),
+         sb->Cond(0, ErrorCode::TP_32BIT,
+                  ErrorCode::OP_EQUAL, CLOCK_THREAD_CPUTIME_ID,
+                  ErrorCode(ErrorCode::ERR_ALLOWED),
+         sb->Trap(sandbox::CrashSIGSYS_Handler, NULL)))));
+}
+
 ErrorCode RestrictClone(SandboxBPF* sb) {
   // We allow clone only for new thread creation.
   return sb->Cond(0, ErrorCode::TP_32BIT, ErrorCode::OP_EQUAL,
                   CLONE_VM | CLONE_FS | CLONE_FILES | CLONE_SIGHAND |
                   CLONE_THREAD | CLONE_SYSVSEM | CLONE_SETTLS |
                   CLONE_PARENT_SETTID | CLONE_CHILD_CLEARTID,
                   ErrorCode(ErrorCode::ERR_ALLOWED),
          sb->Trap(sandbox::SIGSYSCloneFailure, NULL));
 }
 
@@ skipping 119 matching lines @@
 
 ErrorCode NaClNonSfiBPFSandboxPolicy::EvaluateSyscall(SandboxBPF* sb,
                                                       int sysno) const {
   switch (sysno) {
     // Allowed syscalls.
 #if defined(__i386__) || defined(__arm__)
     case __NR__llseek:
 #elif defined(__x86_64__)
     case __NR_lseek:
 #endif
-    // NaCl runtime exposes clock_gettime and clock_getres to untrusted code.
-    case __NR_clock_getres:
-    case __NR_clock_gettime:
     case __NR_close:
     case __NR_dup:
     case __NR_dup2:
     case __NR_exit:
     case __NR_exit_group:
 #if defined(__i386__) || defined(__arm__)
     case __NR_fstat64:
 #elif defined(__x86_64__)
     case __NR_fstat:
 #endif
@@ skipping 17 matching lines @@
     // __NR_times needed as clock() is called by CommandBufferHelper, which is
     // used by NaCl applications that use Pepper's 3D interfaces.
     // See crbug.com/264856 for details.
     case __NR_times:
     case __NR_write:
 #if defined(__arm__)
     case __ARM_NR_cacheflush:
 #endif
       return ErrorCode(ErrorCode::ERR_ALLOWED);
 
+    case __NR_clock_getres:
+    case __NR_clock_gettime:
+      return RestrictClockID(sb);
+
     case __NR_clone:
       return RestrictClone(sb);
 
 #if defined(__x86_64__)
     case __NR_fcntl:
 #endif
 #if defined(__i386__) || defined(__arm__)
     case __NR_fcntl64:
 #endif
       return RestrictFcntlCommands(sb);
@@ skipping 45 matching lines @@
       scoped_ptr<sandbox::SandboxBPFPolicy>(
           new nacl::nonsfi::NaClNonSfiBPFSandboxPolicy()));
   if (!sandbox_is_initialized)
     return false;
   RunSandboxSanityChecks();
   return true;
 }
 
 }  // namespace nonsfi
 }  // namespace nacl