Non-SFI NaCl: CLOCK_SYSTEM_TRACE fails gracefully on Chrome OS

components/nacl/loader/nonsfi/nonsfi_sandbox_unittest.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // ASan internally uses some syscalls which non-SFI NaCl disallows.
 // Seccomp-BPF tests die under TSan v2. See http://crbug.com/356588
 #if !defined(ADDRESS_SANITIZER) && !defined(THREAD_SANITIZER)
 
 #include "components/nacl/loader/nonsfi/nonsfi_sandbox.h"
 
@@ skipping 13 matching lines @@
 #include <sys/wait.h>
 #include <time.h>
 #include <unistd.h>
 
 #include "base/bind.h"
 #include "base/callback.h"
 #include "base/compiler_specific.h"
 #include "base/files/scoped_file.h"
 #include "base/logging.h"
 #include "base/posix/eintr_wrapper.h"
+#include "base/time/time.h"
 #include "sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.h"
 #include "sandbox/linux/seccomp-bpf/bpf_tests.h"
+#include "sandbox/linux/services/linux_syscalls.h"
 #include "third_party/lss/linux_syscall_support.h"  // for MAKE_PROCESS_CPUCLOCK
 
 namespace {
 
 void DoPipe(base::ScopedFD* fds) {
   int tmp_fds[2];
   BPF_ASSERT_EQ(0, pipe(tmp_fds));
   fds[0].reset(tmp_fds[0]);
   fds[1].reset(tmp_fds[1]);
 }
@@ skipping 365 matching lines @@
 }
 
 BPF_DEATH_TEST_C(NaClNonSfiSandboxTest,
                  clock_gettime_crash_monotonic_raw,
                  DEATH_MESSAGE(sandbox::GetErrorMessageContentForTests()),
                  nacl::nonsfi::NaClNonSfiBPFSandboxPolicy) {
   struct timespec ts;
   clock_gettime(CLOCK_MONOTONIC_RAW, &ts);
 }
 
+#if defined(OS_CHROMEOS)
+BPF_TEST_C(NaClNonSfiSandboxTest,
+           clock_gettime_eperm_system_trace,
+           nacl::nonsfi::NaClNonSfiBPFSandboxPolicy) {
+  struct timespec ts = {};
+  BPF_ASSERT_EQ(-1, clock_gettime(base::TimeTicks::kClockSystemTrace, &ts));
+  BPF_ASSERT_EQ(EPERM, errno);
+}
+#else
+BPF_DEATH_TEST_C(NaClNonSfiSandboxTest,
+                 clock_gettime_crash_system_trace,
+                 DEATH_MESSAGE(sandbox::GetErrorMessageContentForTests()),
+                 nacl::nonsfi::NaClNonSfiBPFSandboxPolicy) {
+  struct timespec ts;
+  clock_gettime(base::TimeTicks::kClockSystemTrace, &ts);
+}
+#endif
+
 BPF_DEATH_TEST_C(NaClNonSfiSandboxTest,
                  clock_gettime_crash_cpu_clock,
                  DEATH_MESSAGE(sandbox::GetErrorMessageContentForTests()),
                  nacl::nonsfi::NaClNonSfiBPFSandboxPolicy) {
   // We can't use clock_getcpuclockid() because it's not implemented in newlib,
   // and it might not work inside the sandbox anyway.
   const pid_t kInitPID = 1;
   const clockid_t kInitCPUClockID =
       MAKE_PROCESS_CPUCLOCK(kInitPID, CPUCLOCK_SCHED);
 
@@ skipping 27 matching lines @@
 RESTRICT_SYSCALL_EPERM_TEST(open);
 RESTRICT_SYSCALL_EPERM_TEST(ptrace);
 RESTRICT_SYSCALL_EPERM_TEST(set_robust_list);
 #if defined(__i386__) || defined(__x86_64__)
 RESTRICT_SYSCALL_EPERM_TEST(time);
 #endif
 
 }  // namespace
 
 #endif  // !ADDRESS_SANITIZER && !THREAD_SANITIZER