Linux sandbox: restrict futex operations.

sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.cc

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.h"
 
 #include <errno.h>
 #include <fcntl.h>
 #include <fcntl.h>
+#include <linux/futex.h>
 #include <linux/net.h>
 #include <sched.h>
 #include <signal.h>
 #include <sys/ioctl.h>
 #include <sys/mman.h>
 #include <sys/prctl.h>
 #include <sys/stat.h>
 #include <sys/types.h>
 #include <unistd.h>
 
@@ skipping 219 matching lines @@
                            ErrorCode(ErrorCode::ERR_ALLOWED),
                            sandbox->Trap(SIGSYSKillFailure, NULL));
     case __NR_tkill:
       return sandbox->Trap(SIGSYSKillFailure, NULL);
     default:
       NOTREACHED();
       return sandbox->Trap(CrashSIGSYS_Handler, NULL);
   }
 }
 
+ErrorCode RestrictFutex(SandboxBPF* sandbox) {
+  const int banned_futex_bits =

[mdempsky, 2014/06/04 04:55:34]

kBannedFutexBits?

Also, I don't think this does what you meant? FUTEX_CMD_MASK is already
~(FUTEX_PRIVATE_FLAG | FUTEX_CLOCK_REALTIME), so ~(FUTEX_CMD_MASK |
FUTEX_PRIVATE_FLAG | FUTEX_CLOCK_REALTIME) == ~(~(FUTEX_PRIVATE_FLAG |
FUTEX_CLOCK_REALTIME) | FUTEX_PRIVATE_FLAG | FUTEX_CLOCK_REALTIME) == ~(~0) ==
0.

[jln (very slow on Chromium), 2014/06/04 19:30:23]

I think it's correct, but you're right that this should be a COMPILE_ASSERT
instead. Done.

+      ~(FUTEX_CMD_MASK | FUTEX_PRIVATE_FLAG | FUTEX_CLOCK_REALTIME);
+
+  return sandbox->Cond(1, ErrorCode::TP_32BIT, ErrorCode::OP_HAS_ANY_BITS,
+                       banned_futex_bits,
+                       sandbox->Trap(CrashSIGSYS_Handler, NULL),
+        sandbox->Cond(1, ErrorCode::TP_32BIT, ErrorCode::OP_EQUAL,

[mdempsky, 2014/06/04 04:55:34]

Nit: Indent one more space.

[jln (very slow on Chromium), 2014/06/04 19:30:23]

Done.

+                       FUTEX_CMP_REQUEUE_PI,
+                       sandbox->Trap(CrashSIGSYS_Handler, NULL),
+         sandbox->Cond(1, ErrorCode::TP_32BIT, ErrorCode::OP_EQUAL,
+                       FUTEX_CMP_REQUEUE_PI_PRIVATE,
+                       sandbox->Trap(CrashSIGSYS_Handler, NULL),
+         sandbox->Cond(1, ErrorCode::TP_32BIT, ErrorCode::OP_EQUAL,
+                       FUTEX_CMP_REQUEUE_PI | FUTEX_CLOCK_REALTIME,
+                       sandbox->Trap(CrashSIGSYS_Handler, NULL),
+         sandbox->Cond(1, ErrorCode::TP_32BIT, ErrorCode::OP_EQUAL,
+                       FUTEX_CMP_REQUEUE_PI_PRIVATE | FUTEX_CLOCK_REALTIME,
+                       sandbox->Trap(CrashSIGSYS_Handler, NULL),
+         ErrorCode(ErrorCode::ERR_ALLOWED))))));
+}
+
 }  // namespace sandbox.