Add SandboxBPFPolicy::InvalidSyscall() to simplify writing policies

Add SandboxBPFPolicy::InvalidSyscall() to simplify writing policies

Instead of requiring every BPF policy to check IsValidSyscallNumber()
and return a fixed value when it's true, provide an alternative entry
point and guarantee that EvaluateSyscall() will only be called for
valid syscall numbers.

Committed: https://src.chromium.org/viewvc/chrome?view=rev&revision=271256

[jln (very slow on Chromium), 2014-05-16 22:09:54]

Thanks, it's much saner to have the policy express what to do for invalid system
call than the previous complicated guesswork.

lgtm

[mdempsky, 2014-05-16 22:17:57]

The CQ bit was checked by mdempsky@chromium.org

[commit-bot: I haz the power, 2014-05-16 23:34:07]

CQ is trying da patch. Follow status at
 https://chromium-status.appspot.com/cq/mdempsky@chromium.org/293463002/1

[commit-bot: I haz the power, 2014-05-17 19:10:11]

Change committed as 271256

[mdempsky, 2014-05-19 18:52:17]

On 2014/05/17 19:10:11, I haz the power (commit-bot) wrote:
> Change committed as 271256

While looking at policies to cleanup after this change, I just noticed that most
of the production policies actually use Trap(SIGSYS_Handler) as the invalid
syscall number behavior instead of ErrorCode(ENOSYS), and this change silently
changed the behavior for those policies.

I plan on fixing those shortly anyway, but I thought I'd point it out now in
case you think we should instead revert this for now and re-land alongside
proper policy changes.

[jln (very slow on Chromium), 2014-05-19 19:05:49]

On 2014/05/19 18:52:17, mdempsky wrote:
> On 2014/05/17 19:10:11, I haz the power (commit-bot) wrote:
> > Change committed as 271256
> 
> While looking at policies to cleanup after this change, I just noticed that
most
> of the production policies actually use Trap(SIGSYS_Handler) as the invalid
> syscall number behavior instead of ErrorCode(ENOSYS), and this change silently
> changed the behavior for those policies.
> 
> I plan on fixing those shortly anyway, but I thought I'd point it out now in
> case you think we should instead revert this for now and re-land alongside
> proper policy changes.

It doesn't matter too much. ENOSYS is fine I think. It's in theory possible that
we would catch bugs with a crashing signal handlers, but it has been two years
no and we never have.

It's possible that on the upper end of the spectrum we could catch calling a
system call that is yet-unknown to us, but IIRC we have at least a few hundreds
syscall numbers as a buffer for what we consider valid syscall numbers.