Non-SFI NaCl: Disallow fancy clock IDs

components/nacl/loader/nonsfi/nonsfi_sandbox_unittest.cc

Index: components/nacl/loader/nonsfi/nonsfi_sandbox_unittest.cc
diff --git a/components/nacl/loader/nonsfi/nonsfi_sandbox_unittest.cc b/components/nacl/loader/nonsfi/nonsfi_sandbox_unittest.cc
index febbcd927057d65610c5624915b6fb740e79af44..1a41e887c3d7dc7e19b20818123ba67af1847756 100644
--- a/components/nacl/loader/nonsfi/nonsfi_sandbox_unittest.cc
+++ b/components/nacl/loader/nonsfi/nonsfi_sandbox_unittest.cc
@@ -22,6 +22,7 @@
 #include <sys/syscall.h>
 #include <sys/types.h>
 #include <sys/wait.h>
+#include <time.h>
 #include <unistd.h>
 
 #include "base/bind.h"
@@ -391,6 +392,59 @@ BPF_TEST_C(NaClNonSfiSandboxTest,
   BPF_ASSERT_EQ(ENOMEM, errno);
 }
 
+void CheckClock(clockid_t clockid) {
+  struct timespec ts;
+  ts.tv_sec = ts.tv_nsec = -1;
+  BPF_ASSERT_EQ(0, clock_gettime(clockid, &ts));
+  BPF_ASSERT_LE(0, ts.tv_sec);
+  BPF_ASSERT_LE(0, ts.tv_nsec);
+}
+
+BPF_TEST_C(NaClNonSfiSandboxTest,
+           clock_gettime_allowed,
+           nacl::nonsfi::NaClNonSfiBPFSandboxPolicy) {
+  CheckClock(CLOCK_MONOTONIC);
+  CheckClock(CLOCK_PROCESS_CPUTIME_ID);
+  CheckClock(CLOCK_REALTIME);
+  CheckClock(CLOCK_THREAD_CPUTIME_ID);
+}
+
+BPF_DEATH_TEST_C(NaClNonSfiSandboxTest,
+                 clock_gettime_crash_monotonic_raw,
+                 DEATH_MESSAGE(sandbox::GetErrorMessageContentForTests()),
+                 nacl::nonsfi::NaClNonSfiBPFSandboxPolicy) {
+  struct timespec ts;
+  clock_gettime(CLOCK_MONOTONIC_RAW, &ts);
+}
+
+// We need this test delegate so we can compute the clock ID for the init

[Mark Seaborn, 2014/05/20 21:21:30]

You might also test this by constructing the clock ID manually, as glibc's
MAKE_PROCESS_CPUCLOCK macro does, from the current PID.

When we switch to building this with newlib, we simply won't have a working
clock_getcpuclockid() to test this against.  It would be good to prepare for
that switch.

We could continue running the tests against glibc as well as newlib, but that's
not perfect.

[mdempsky, 2014/05/20 23:02:51]

Done.  I found that LSS has the same MAKE_PROCESS_CPUCLOCK() macro, so I went
ahead and reused that here.  This also let us use the simpler BPF_DEATH_TEST_C
macro instead.

+// process's CPU clock before enabling the seccomp-BPF policy.
+class ClockGetTimeCrashCPUClockDelegate : public sandbox::BPFTesterDelegate {
+ public:
+  ClockGetTimeCrashCPUClockDelegate() {
+    const pid_t kInitPID = 1;
+    CHECK_EQ(0, clock_getcpuclockid(kInitPID, &init_clock_id_));
+  }
+
+  virtual scoped_ptr<sandbox::SandboxBPFPolicy> GetSandboxBPFPolicy() OVERRIDE {
+    return scoped_ptr<sandbox::SandboxBPFPolicy>(
+        new nacl::nonsfi::NaClNonSfiBPFSandboxPolicy);
+  }
+
+  virtual void RunTestFunction() OVERRIDE {
+    struct timespec ts;
+    clock_gettime(init_clock_id_, &ts);
+  }
+
+ private:
+  clockid_t init_clock_id_;
+};
+
+BPF_DEATH_TEST_D(NaClNonSfiSandboxTest,
+                 clock_gettime_crash_cpu_clock,
+                 DEATH_MESSAGE(sandbox::GetErrorMessageContentForTests()),
+                 ClockGetTimeCrashCPUClockDelegate);
+
 // The following test cases check if syscalls return EPERM regardless
 // of arguments.
 #define RESTRICT_SYSCALL_EPERM_TEST(name)                      \