Non-SFI NaCl: Disallow fancy clock IDs

components/nacl/loader/nonsfi/nonsfi_sandbox_unittest.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // ASan internally uses some syscalls which non-SFI NaCl disallows.
 // Seccomp-BPF tests die under TSan v2. See http://crbug.com/356588
 #if !defined(ADDRESS_SANITIZER) && !defined(THREAD_SANITIZER)
 
 #include "components/nacl/loader/nonsfi/nonsfi_sandbox.h"
 
 #include <errno.h>
 #include <fcntl.h>
 #include <pthread.h>
 #include <sched.h>
 #include <signal.h>
 #include <stdlib.h>
 #include <string.h>
 #include <sys/mman.h>
 #include <sys/prctl.h>
 #include <sys/ptrace.h>
 #include <sys/socket.h>
 #include <sys/syscall.h>
 #include <sys/types.h>
 #include <sys/wait.h>
+#include <time.h>
 #include <unistd.h>
 
 #include "base/bind.h"
 #include "base/callback.h"
 #include "base/compiler_specific.h"
 #include "base/files/scoped_file.h"
 #include "base/logging.h"
 #include "base/posix/eintr_wrapper.h"
 #include "sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.h"
 #include "sandbox/linux/seccomp-bpf/bpf_tests.h"
@@ skipping 349 matching lines @@
            nacl::nonsfi::NaClNonSfiBPFSandboxPolicy) {
   char* next_brk = static_cast<char*>(sbrk(0)) + getpagesize();
   // The kernel interface must return zero for brk.
   BPF_ASSERT_EQ(0, syscall(__NR_brk, next_brk));
   // The libc wrapper translates it to ENOMEM.
   errno = 0;
   BPF_ASSERT_EQ(-1, brk(next_brk));
   BPF_ASSERT_EQ(ENOMEM, errno);
 }
 
+void CheckClock(clockid_t clockid) {
+  struct timespec ts;
+  ts.tv_sec = ts.tv_nsec = -1;
+  BPF_ASSERT_EQ(0, clock_gettime(clockid, &ts));
+  BPF_ASSERT_LE(0, ts.tv_sec);
+  BPF_ASSERT_LE(0, ts.tv_nsec);
+}
+
+BPF_TEST_C(NaClNonSfiSandboxTest,
+           clock_gettime_allowed,
+           nacl::nonsfi::NaClNonSfiBPFSandboxPolicy) {
+  CheckClock(CLOCK_MONOTONIC);
+  CheckClock(CLOCK_PROCESS_CPUTIME_ID);
+  CheckClock(CLOCK_REALTIME);
+  CheckClock(CLOCK_THREAD_CPUTIME_ID);
+}
+
+BPF_DEATH_TEST_C(NaClNonSfiSandboxTest,
+                 clock_gettime_crash_monotonic_raw,
+                 DEATH_MESSAGE(sandbox::GetErrorMessageContentForTests()),
+                 nacl::nonsfi::NaClNonSfiBPFSandboxPolicy) {
+  struct timespec ts;
+  clock_gettime(CLOCK_MONOTONIC_RAW, &ts);
+}
+
+// We need this test delegate so we can compute the clock ID for the init

[Mark Seaborn, 2014/05/20 21:21:30]

You might also test this by constructing the clock ID manually, as glibc's
MAKE_PROCESS_CPUCLOCK macro does, from the current PID.

When we switch to building this with newlib, we simply won't have a working
clock_getcpuclockid() to test this against.  It would be good to prepare for
that switch.

We could continue running the tests against glibc as well as newlib, but that's
not perfect.

[mdempsky, 2014/05/20 23:02:51]

Done.  I found that LSS has the same MAKE_PROCESS_CPUCLOCK() macro, so I went
ahead and reused that here.  This also let us use the simpler BPF_DEATH_TEST_C
macro instead.

+// process's CPU clock before enabling the seccomp-BPF policy.
+class ClockGetTimeCrashCPUClockDelegate : public sandbox::BPFTesterDelegate {
+ public:
+  ClockGetTimeCrashCPUClockDelegate() {
+    const pid_t kInitPID = 1;
+    CHECK_EQ(0, clock_getcpuclockid(kInitPID, &init_clock_id_));
+  }
+
+  virtual scoped_ptr<sandbox::SandboxBPFPolicy> GetSandboxBPFPolicy() OVERRIDE {
+    return scoped_ptr<sandbox::SandboxBPFPolicy>(
+        new nacl::nonsfi::NaClNonSfiBPFSandboxPolicy);
+  }
+
+  virtual void RunTestFunction() OVERRIDE {
+    struct timespec ts;
+    clock_gettime(init_clock_id_, &ts);
+  }
+
+ private:
+  clockid_t init_clock_id_;
+};
+
+BPF_DEATH_TEST_D(NaClNonSfiSandboxTest,
+                 clock_gettime_crash_cpu_clock,
+                 DEATH_MESSAGE(sandbox::GetErrorMessageContentForTests()),
+                 ClockGetTimeCrashCPUClockDelegate);
+
 // The following test cases check if syscalls return EPERM regardless
 // of arguments.
 #define RESTRICT_SYSCALL_EPERM_TEST(name)                      \
   BPF_TEST_C(NaClNonSfiSandboxTest,                            \
              name##_EPERM,                                     \
              nacl::nonsfi::NaClNonSfiBPFSandboxPolicy) {       \
     errno = 0;                                                 \
     BPF_ASSERT_EQ(-1, syscall(__NR_##name, 0, 0, 0, 0, 0, 0)); \
     BPF_ASSERT_EQ(EPERM, errno);                               \
   }
@@ skipping 13 matching lines @@
 RESTRICT_SYSCALL_EPERM_TEST(open);
 RESTRICT_SYSCALL_EPERM_TEST(ptrace);
 RESTRICT_SYSCALL_EPERM_TEST(set_robust_list);
 #if defined(__i386__) || defined(__x86_64__)
 RESTRICT_SYSCALL_EPERM_TEST(time);
 #endif
 
 }  // namespace
 
 #endif  // !ADDRESS_SANITIZER && !THREAD_SANITIZER