Linux sandbox: restrict futex operations.

sandbox/linux/seccomp-bpf-helpers/baseline_policy.cc

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sandbox/linux/seccomp-bpf-helpers/baseline_policy.h"
 
 #include <errno.h>
 #include <sys/mman.h>
 #include <sys/socket.h>
 #include <sys/syscall.h>
@@ skipping 14 matching lines @@
 
 namespace sandbox {
 
 namespace {
 
 bool IsBaselinePolicyAllowed(int sysno) {
   return SyscallSets::IsAllowedAddressSpaceAccess(sysno) ||
          SyscallSets::IsAllowedBasicScheduler(sysno) ||
          SyscallSets::IsAllowedEpoll(sysno) ||
          SyscallSets::IsAllowedFileSystemAccessViaFd(sysno) ||
+         SyscallSets::IsAllowedFutex(sysno) ||
          SyscallSets::IsAllowedGeneralIo(sysno) ||
          SyscallSets::IsAllowedGetOrModifySocket(sysno) ||
          SyscallSets::IsAllowedGettime(sysno) ||
          SyscallSets::IsAllowedPrctl(sysno) ||
          SyscallSets::IsAllowedProcessStartOrDeath(sysno) ||
          SyscallSets::IsAllowedSignalHandling(sysno) ||
-         SyscallSets::IsFutex(sysno) ||
          SyscallSets::IsGetSimpleId(sysno) ||
          SyscallSets::IsKernelInternalApi(sysno) ||
 #if defined(__arm__)
          SyscallSets::IsArmPrivate(sysno) ||
 #endif
          SyscallSets::IsAllowedOperationOnFd(sysno);
 }
 
 // System calls that will trigger the crashing SIGSYS handler.
 bool IsBaselinePolicyWatched(int sysno) {
@@ skipping 62 matching lines @@
   }
 
   if (sysno == __NR_fcntl)
     return RestrictFcntlCommands(sandbox);
 
 #if defined(__i386__) || defined(__arm__)
   if (sysno == __NR_fcntl64)
     return RestrictFcntlCommands(sandbox);
 #endif
 
+  if (sysno == __NR_futex)
+    return RestrictFutex(sandbox);
+
   if (sysno == __NR_madvise) {
     // Only allow MADV_DONTNEED (aka MADV_FREE).
     return sandbox->Cond(2, ErrorCode::TP_32BIT,
                          ErrorCode::OP_EQUAL, MADV_DONTNEED,
                          ErrorCode(ErrorCode::ERR_ALLOWED),
                          ErrorCode(EPERM));
   }
 
 #if defined(__i386__) || defined(__x86_64__)
   if (sysno == __NR_mmap)
@@ skipping 72 matching lines @@
 ErrorCode BaselinePolicy::EvaluateSyscall(SandboxBPF* sandbox,
                                           int sysno) const {
   // Make sure that this policy is used in the creating process.
   if (1 == sysno) {
     DCHECK_EQ(syscall(__NR_getpid), current_pid_);
   }
   return EvaluateSyscallImpl(fs_denied_errno_, current_pid_, sandbox, sysno);
 }
 
 }  // namespace sandbox.