Merge 274934 "Linux sandbox: restrict futex operations."

sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.cc

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.h"
 
 #include <errno.h>
 #include <fcntl.h>
 #include <fcntl.h>
+#include <linux/futex.h>
 #include <linux/net.h>
 #include <sched.h>
 #include <signal.h>
 #include <sys/ioctl.h>
 #include <sys/mman.h>
 #include <sys/prctl.h>
 #include <sys/stat.h>
 #include <sys/types.h>
 #include <unistd.h>
 
 #include "base/basictypes.h"
 #include "base/logging.h"
+#include "base/macros.h"
 #include "build/build_config.h"
 #include "sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.h"
 #include "sandbox/linux/seccomp-bpf/linux_seccomp.h"
 #include "sandbox/linux/seccomp-bpf/sandbox_bpf.h"
+#include "sandbox/linux/services/android_futex.h"
 
 #if defined(OS_ANDROID)
 #if !defined(F_DUPFD_CLOEXEC)
 #define F_DUPFD_CLOEXEC (F_LINUX_SPECIFIC_BASE + 6)
 #endif
 #endif
 
 #if defined(__arm__) && !defined(MAP_STACK)
 #define MAP_STACK 0x20000  // Daisy build environment has old headers.
 #endif
@@ skipping 203 matching lines @@
                            ErrorCode(ErrorCode::ERR_ALLOWED),
                            sandbox->Trap(SIGSYSKillFailure, NULL));
     case __NR_tkill:
       return sandbox->Trap(SIGSYSKillFailure, NULL);
     default:
       NOTREACHED();
       return sandbox->Trap(CrashSIGSYS_Handler, NULL);
   }
 }
 
+ErrorCode RestrictFutex(SandboxBPF* sandbox) {
+  // In futex.c, the kernel does "int cmd = op & FUTEX_CMD_MASK;". We need to
+  // make sure that the combination below will cover every way to get
+  // FUTEX_CMP_REQUEUE_PI.
+  const int kBannedFutexBits =
+      ~(FUTEX_CMD_MASK | FUTEX_PRIVATE_FLAG | FUTEX_CLOCK_REALTIME);
+  COMPILE_ASSERT(0 == kBannedFutexBits,
+                 need_to_explicitly_blacklist_more_bits);
+
+  return sandbox->Cond(1, ErrorCode::TP_32BIT, ErrorCode::OP_EQUAL,
+                       FUTEX_CMP_REQUEUE_PI,
+                       sandbox->Trap(SIGSYSFutexFailure, NULL),
+         sandbox->Cond(1, ErrorCode::TP_32BIT, ErrorCode::OP_EQUAL,
+                       FUTEX_CMP_REQUEUE_PI_PRIVATE,
+                       sandbox->Trap(SIGSYSFutexFailure, NULL),
+         sandbox->Cond(1, ErrorCode::TP_32BIT, ErrorCode::OP_EQUAL,
+                       FUTEX_CMP_REQUEUE_PI | FUTEX_CLOCK_REALTIME,
+                       sandbox->Trap(SIGSYSFutexFailure, NULL),
+         sandbox->Cond(1, ErrorCode::TP_32BIT, ErrorCode::OP_EQUAL,
+                       FUTEX_CMP_REQUEUE_PI_PRIVATE | FUTEX_CLOCK_REALTIME,
+                       sandbox->Trap(SIGSYSFutexFailure, NULL),
+         ErrorCode(ErrorCode::ERR_ALLOWED)))));
+}
+
 }  // namespace sandbox.