Linux Sandbox: run all BaselinePolicy tests with sanitizers.

sandbox/linux/seccomp-bpf-helpers/baseline_policy.cc

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sandbox/linux/seccomp-bpf-helpers/baseline_policy.h"
 
 #include <errno.h>
 #include <sys/mman.h>
 #include <sys/socket.h>
 #include <sys/syscall.h>
@@ skipping 68 matching lines @@
          SyscallSets::IsArmPciConfig(sysno) ||
 #endif
          SyscallSets::IsTimer(sysno);
 }
 
 // |fs_denied_errno| is the errno return for denied filesystem access.
 ErrorCode EvaluateSyscallImpl(int fs_denied_errno,
                               pid_t current_pid,
                               SandboxBPF* sandbox,
                               int sysno) {
-#if defined(ADDRESS_SANITIZER)
+#if defined(ADDRESS_SANITIZER) || defined(THREAD_SANITIZER) || \
+    defined(MEMORY_SANITIZER)
+  // TCGETS is required by the sanitizers on failure.
+  if (sysno == __NR_ioctl) {
+    return RestrictIoctl(sandbox);
+  }
+
+  if (sysno == __NR_sched_getaffinity) {
+    return ErrorCode(ErrorCode::ERR_ALLOWED);
+  }
+
   if (sysno == __NR_sigaltstack) {
     // Required for better stack overflow detection in ASan. Disallowed in

[mdempsky, 2014/05/21 00:11:13]

Is this needed for tsan/msan too?  If so, update the comment?

[jln (very slow on Chromium), 2014/05/21 00:14:41]

It's (afaik) not a strict requirement for TSAN/MSAN.

Technically speaking, TSAN never even runs with seccomp-bpf enabled (yet).

I just thought I would prevent explosion of the number of policies by having
only one modification for all the sanitizers.

     // non-ASan builds.
     return ErrorCode(ErrorCode::ERR_ALLOWED);
   }
-#endif
+#endif  // defined(ADDRESS_SANITIZER) || defined(THREAD_SANITIZER) ||
+        // defined(MEMORY_SANITIZER)
+
   if (IsBaselinePolicyAllowed(sysno)) {
     return ErrorCode(ErrorCode::ERR_ALLOWED);
   }
 
   if (sysno == __NR_clone) {
     return RestrictCloneToThreadsAndEPERMFork(sandbox);
   }
 
-#if defined(__x86_64__) || defined(__arm__)
-  if (sysno == __NR_socketpair) {
-    // Only allow AF_UNIX, PF_UNIX. Crash if anything else is seen.
-    COMPILE_ASSERT(AF_UNIX == PF_UNIX, af_unix_pf_unix_different);
-    return sandbox->Cond(0, ErrorCode::TP_32BIT, ErrorCode::OP_EQUAL, AF_UNIX,
-                         ErrorCode(ErrorCode::ERR_ALLOWED),
-                         sandbox->Trap(CrashSIGSYS_Handler, NULL));
-  }
+  if (sysno == __NR_fcntl)
+    return RestrictFcntlCommands(sandbox);
+
+#if defined(__i386__) || defined(__arm__)
+  if (sysno == __NR_fcntl64)
+    return RestrictFcntlCommands(sandbox);
 #endif
 
   if (sysno == __NR_madvise) {
     // Only allow MADV_DONTNEED (aka MADV_FREE).
     return sandbox->Cond(2, ErrorCode::TP_32BIT,
                          ErrorCode::OP_EQUAL, MADV_DONTNEED,
                          ErrorCode(ErrorCode::ERR_ALLOWED),
                          ErrorCode(EPERM));
   }
 
 #if defined(__i386__) || defined(__x86_64__)
   if (sysno == __NR_mmap)
     return RestrictMmapFlags(sandbox);
 #endif
 
 #if defined(__i386__) || defined(__arm__)
   if (sysno == __NR_mmap2)
     return RestrictMmapFlags(sandbox);
 #endif
 
   if (sysno == __NR_mprotect)
     return RestrictMprotectFlags(sandbox);
 
-  if (sysno == __NR_fcntl)
-    return RestrictFcntlCommands(sandbox);
-
-#if defined(__i386__) || defined(__arm__)
-  if (sysno == __NR_fcntl64)
-    return RestrictFcntlCommands(sandbox);
+#if defined(__x86_64__) || defined(__arm__)
+  if (sysno == __NR_socketpair) {
+    // Only allow AF_UNIX, PF_UNIX. Crash if anything else is seen.
+    COMPILE_ASSERT(AF_UNIX == PF_UNIX, af_unix_pf_unix_different);
+    return sandbox->Cond(0, ErrorCode::TP_32BIT, ErrorCode::OP_EQUAL, AF_UNIX,
+                         ErrorCode(ErrorCode::ERR_ALLOWED),
+                         sandbox->Trap(CrashSIGSYS_Handler, NULL));
+  }
 #endif
 
   if (SyscallSets::IsKill(sysno)) {
     return RestrictKillTarget(current_pid, sandbox, sysno);
   }
 
   if (SyscallSets::IsFileSystem(sysno) ||
       SyscallSets::IsCurrentDirectory(sysno)) {
     return ErrorCode(fs_denied_errno);
   }
@@ skipping 43 matching lines @@
 ErrorCode BaselinePolicy::EvaluateSyscall(SandboxBPF* sandbox,
                                           int sysno) const {
   // Make sure that this policy is used in the creating process.
   if (1 == sysno) {
     DCHECK_EQ(syscall(__NR_getpid), current_pid_);
   }
   return EvaluateSyscallImpl(fs_denied_errno_, current_pid_, sandbox, sysno);
 }
 
 }  // namespace sandbox.