Linux sandbox: restrict futex operations.

Linux sandbox: restrict futex operations.

First-pass at restricting futex operations. We ban FUTEX_CMP_REQUEUE_PI, as it is
not used throughout Chrome.

BUG=377392
R=mdempsky@chromium.org

Committed: https://src.chromium.org/viewvc/chrome?view=rev&revision=274934

[jln (very slow on Chromium), 2014-06-04 01:24:55]

Matthew, this may not be ready, but I wouldn't mind a sanity check.

[mdempsky, 2014-06-04 04:55:34]

https://codereview.chromium.org/314903002/diff/1/sandbox/linux/seccomp-bpf-he...
File sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.cc
(right):

https://codereview.chromium.org/314903002/diff/1/sandbox/linux/seccomp-bpf-he...
sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.cc:251: const
int banned_futex_bits =
kBannedFutexBits?

Also, I don't think this does what you meant? FUTEX_CMD_MASK is already
~(FUTEX_PRIVATE_FLAG | FUTEX_CLOCK_REALTIME), so ~(FUTEX_CMD_MASK |
FUTEX_PRIVATE_FLAG | FUTEX_CLOCK_REALTIME) == ~(~(FUTEX_PRIVATE_FLAG |
FUTEX_CLOCK_REALTIME) | FUTEX_PRIVATE_FLAG | FUTEX_CLOCK_REALTIME) == ~(~0) ==
0.

https://codereview.chromium.org/314903002/diff/1/sandbox/linux/seccomp-bpf-he...
sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.cc:257:
sandbox->Cond(1, ErrorCode::TP_32BIT, ErrorCode::OP_EQUAL,
Nit: Indent one more space.

[jln (very slow on Chromium), 2014-06-04 19:30:22]

PTAL!

https://codereview.chromium.org/314903002/diff/1/sandbox/linux/seccomp-bpf-he...
File sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.cc
(right):

https://codereview.chromium.org/314903002/diff/1/sandbox/linux/seccomp-bpf-he...
sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.cc:251: const
int banned_futex_bits =
On 2014/06/04 04:55:34, mdempsky wrote:
> kBannedFutexBits?
> 
> Also, I don't think this does what you meant? FUTEX_CMD_MASK is already
> ~(FUTEX_PRIVATE_FLAG | FUTEX_CLOCK_REALTIME), so ~(FUTEX_CMD_MASK |
> FUTEX_PRIVATE_FLAG | FUTEX_CLOCK_REALTIME) == ~(~(FUTEX_PRIVATE_FLAG |
> FUTEX_CLOCK_REALTIME) | FUTEX_PRIVATE_FLAG | FUTEX_CLOCK_REALTIME) == ~(~0) ==
> 0.

I think it's correct, but you're right that this should be a COMPILE_ASSERT
instead. Done.

https://codereview.chromium.org/314903002/diff/1/sandbox/linux/seccomp-bpf-he...
sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.cc:257:
sandbox->Cond(1, ErrorCode::TP_32BIT, ErrorCode::OP_EQUAL,
On 2014/06/04 04:55:34, mdempsky wrote:
> Nit: Indent one more space.

Done.

[jln (very slow on Chromium), 2014-06-04 19:31:08]

+ a few other folks FYI.

[mdempsky, 2014-06-04 19:56:36]

lgtm

[jln (very slow on Chromium), 2014-06-04 20:10:49]

The CQ bit was checked by jln@chromium.org

[jln (very slow on Chromium), 2014-06-04 20:10:59]

The CQ bit was unchecked by jln@chromium.org

[jln (very slow on Chromium), 2014-06-04 20:22:48]

The CQ bit was checked by jln@chromium.org

[commit-bot: I haz the power, 2014-06-04 20:24:02]

CQ is trying da patch. Follow status at
 https://chromium-status.appspot.com/cq/jln@chromium.org/314903002/60001

[Mark Seaborn, 2014-06-04 20:29:40]

https://codereview.chromium.org/314903002/diff/60001/sandbox/linux/seccomp-bp...
File sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.cc (right):

https://codereview.chromium.org/314903002/diff/60001/sandbox/linux/seccomp-bp...
sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.cc:170: static const char
kSeccompFutexError[] =
Nit: alignment is off here

[jln (very slow on Chromium), 2014-06-04 20:40:16]

https://codereview.chromium.org/314903002/diff/60001/sandbox/linux/seccomp-bp...
File sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.cc (right):

https://codereview.chromium.org/314903002/diff/60001/sandbox/linux/seccomp-bp...
sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.cc:170: static const char
kSeccompFutexError[] =
On 2014/06/04 20:29:41, Mark Seaborn wrote:
> Nit: alignment is off here

Done.

[jln (very slow on Chromium), 2014-06-04 22:25:53]

Committed patchset #4 manually as r274934 (presubmit successful).