Non-SFI NaCl: Disallow fancy clock IDs

components/nacl/loader/nonsfi/nonsfi_sandbox.cc

Index: components/nacl/loader/nonsfi/nonsfi_sandbox.cc
diff --git a/components/nacl/loader/nonsfi/nonsfi_sandbox.cc b/components/nacl/loader/nonsfi/nonsfi_sandbox.cc
index 0e4550c5dee9eec964720529f34cfb67ce2dbc3c..8d42150fe9a26004368bfcaa1dde6d759019c029 100644
--- a/components/nacl/loader/nonsfi/nonsfi_sandbox.cc
+++ b/components/nacl/loader/nonsfi/nonsfi_sandbox.cc
@@ -73,6 +73,25 @@ ErrorCode RestrictFcntlCommands(SandboxBPF* sb) {
          sb->Trap(sandbox::CrashSIGSYS_Handler, NULL))));
 }
 
+ErrorCode RestrictClockID(SandboxBPF* sb) {
+  // We allow accessing only CLOCK_MONOTONIC, CLOCK_PROCESS_CPUTIME_ID,
+  // CLOCK_REALTIME, and CLOCK_THREAD_CPUTIME_ID.

[Mark Seaborn, 2014/05/20 21:21:30]

Maybe also say: "Don't allow reading the clocks of other processes by specifying
their PIDs."

It's not obvious the syscalls allow that.  I don't think there are even any
#defines for that in the kernel headers.  (glibc has
sysdeps/unix/sysv/linux/kernel-posix-cpu-timers.h, which #defines
MAKE_PROCESS_CPUCLOCK and CPUCLOCK_*.)

[mdempsky, 2014/05/20 23:02:51]

Done.

+  COMPILE_ASSERT(4 == sizeof(clockid_t), clockid_is_not_32bit);
+  return sb->Cond(0, ErrorCode::TP_32BIT,
+                  ErrorCode::OP_EQUAL, CLOCK_MONOTONIC,
+                  ErrorCode(ErrorCode::ERR_ALLOWED),
+         sb->Cond(0, ErrorCode::TP_32BIT,
+                  ErrorCode::OP_EQUAL, CLOCK_PROCESS_CPUTIME_ID,
+                  ErrorCode(ErrorCode::ERR_ALLOWED),
+         sb->Cond(0, ErrorCode::TP_32BIT,
+                  ErrorCode::OP_EQUAL, CLOCK_REALTIME,
+                  ErrorCode(ErrorCode::ERR_ALLOWED),
+         sb->Cond(0, ErrorCode::TP_32BIT,
+                  ErrorCode::OP_EQUAL, CLOCK_THREAD_CPUTIME_ID,
+                  ErrorCode(ErrorCode::ERR_ALLOWED),
+         sb->Trap(sandbox::CrashSIGSYS_Handler, NULL)))));
+}
+
 ErrorCode RestrictClone(SandboxBPF* sb) {
   // We allow clone only for new thread creation.
   return sb->Cond(0, ErrorCode::TP_32BIT, ErrorCode::OP_EQUAL,
@@ -212,9 +231,6 @@ ErrorCode NaClNonSfiBPFSandboxPolicy::EvaluateSyscall(SandboxBPF* sb,
 #elif defined(__x86_64__)
     case __NR_lseek:
 #endif
-    // NaCl runtime exposes clock_gettime and clock_getres to untrusted code.
-    case __NR_clock_getres:
-    case __NR_clock_gettime:
     case __NR_close:
     case __NR_dup:
     case __NR_dup2:
@@ -252,6 +268,10 @@ ErrorCode NaClNonSfiBPFSandboxPolicy::EvaluateSyscall(SandboxBPF* sb,
 #endif
       return ErrorCode(ErrorCode::ERR_ALLOWED);
 
+    case __NR_clock_getres:
+    case __NR_clock_gettime:
+      return RestrictClockID(sb);
+
     case __NR_clone:
       return RestrictClone(sb);