Linux sandbox: restrict futex operations.

sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.cc

Index: sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.cc
diff --git a/sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.cc b/sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.cc
index 29c591035972264ed4765f6dde198591c4efb881..121babebe7f48f11a9fc242e5450f30da58bb748 100644
--- a/sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.cc
+++ b/sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.cc
@@ -7,6 +7,7 @@
 #include <errno.h>
 #include <fcntl.h>
 #include <fcntl.h>
+#include <linux/futex.h>
 #include <linux/net.h>
 #include <sched.h>
 #include <signal.h>
@@ -246,4 +247,26 @@ ErrorCode RestrictKillTarget(pid_t target_pid, SandboxBPF* sandbox, int sysno) {
   }
 }
 
+ErrorCode RestrictFutex(SandboxBPF* sandbox) {
+  const int banned_futex_bits =

[mdempsky, 2014/06/04 04:55:34]

kBannedFutexBits?

Also, I don't think this does what you meant? FUTEX_CMD_MASK is already
~(FUTEX_PRIVATE_FLAG | FUTEX_CLOCK_REALTIME), so ~(FUTEX_CMD_MASK |
FUTEX_PRIVATE_FLAG | FUTEX_CLOCK_REALTIME) == ~(~(FUTEX_PRIVATE_FLAG |
FUTEX_CLOCK_REALTIME) | FUTEX_PRIVATE_FLAG | FUTEX_CLOCK_REALTIME) == ~(~0) ==
0.

[jln (very slow on Chromium), 2014/06/04 19:30:23]

I think it's correct, but you're right that this should be a COMPILE_ASSERT
instead. Done.

+      ~(FUTEX_CMD_MASK | FUTEX_PRIVATE_FLAG | FUTEX_CLOCK_REALTIME);
+
+  return sandbox->Cond(1, ErrorCode::TP_32BIT, ErrorCode::OP_HAS_ANY_BITS,
+                       banned_futex_bits,
+                       sandbox->Trap(CrashSIGSYS_Handler, NULL),
+        sandbox->Cond(1, ErrorCode::TP_32BIT, ErrorCode::OP_EQUAL,

[mdempsky, 2014/06/04 04:55:34]

Nit: Indent one more space.

[jln (very slow on Chromium), 2014/06/04 19:30:23]

Done.

+                       FUTEX_CMP_REQUEUE_PI,
+                       sandbox->Trap(CrashSIGSYS_Handler, NULL),
+         sandbox->Cond(1, ErrorCode::TP_32BIT, ErrorCode::OP_EQUAL,
+                       FUTEX_CMP_REQUEUE_PI_PRIVATE,
+                       sandbox->Trap(CrashSIGSYS_Handler, NULL),
+         sandbox->Cond(1, ErrorCode::TP_32BIT, ErrorCode::OP_EQUAL,
+                       FUTEX_CMP_REQUEUE_PI | FUTEX_CLOCK_REALTIME,
+                       sandbox->Trap(CrashSIGSYS_Handler, NULL),
+         sandbox->Cond(1, ErrorCode::TP_32BIT, ErrorCode::OP_EQUAL,
+                       FUTEX_CMP_REQUEUE_PI_PRIVATE | FUTEX_CLOCK_REALTIME,
+                       sandbox->Trap(CrashSIGSYS_Handler, NULL),
+         ErrorCode(ErrorCode::ERR_ALLOWED))))));
+}
+
 }  // namespace sandbox.