Allow the seccomp sandbox to be enabled, even if the suid sandbox has...

sandbox/linux/seccomp/sandbox_impl.h

 #ifndef SANDBOX_IMPL_H__
 #define SANDBOX_IMPL_H__
 
 #include <asm/ldt.h>
 #include <errno.h>
 #include <fcntl.h>
 #include <limits.h>
 #include <linux/prctl.h>
 #include <linux/unistd.h>
 #include <netinet/in.h>
@@ skipping 31 matching lines @@
 class Sandbox {
   // TODO(markus): restrict access to our private file handles
  public:
   enum { kMaxThreads = 100 };
 
 
   // There are a lot of reasons why the Seccomp sandbox might not be available.
   // This could be because the kernel does not support Seccomp mode, or it
   // could be because we fail to successfully rewrite all system call entry
   // points.
-  static int supportsSeccompSandbox() asm("SupportsSeccompSandbox");
+  // "proc_fd" should be a file descriptor for "/proc", or -1 if not provided
+  // by the caller.
+  static int supportsSeccompSandbox(int proc_fd)
+                                          asm("SupportsSeccompSandbox");
+
+  // The sandbox needs to be able to access "/proc/self/maps". If this file
+  // is not accessible when "startSandbox()" gets called, the caller can
+  // provide an already opened file descriptor by calling "setProcSelfMaps()".
+  // The sandbox becomes the newer owner of this file descriptor and will
+  // eventually close it when "startSandbox()" executes.
+  static void setProcSelfMaps(int proc_self_maps)
+                                          asm("SeccompSandboxSetProcSelfMaps");
 
   // This is the main public entry point. It finds all system calls that
   // need rewriting, sets up the resources needed by the sandbox, and
   // enters Seccomp mode.
-  static void startSandbox() asm("StartSeccompSandbox");
+  static void startSandbox()              asm("StartSeccompSandbox");
 
  private:
 // syscall_table.c has to be implemented in C, as C++ does not support
 // designated initializers for arrays. The only other alternative would be
 // to have a source code generator for this table.
 //
 // We would still like the C source file to include our header file. This
 // requires some define statements to transform C++ specific constructs to
 // something that is palatable to a C compiler.
 #define STATIC static
@@ skipping 514 matching lines @@
   ;
 
   // Return a secure memory structure that can be used by a newly created
   // thread.
   static SecureMem::Args* getSecureMem();
 
   // This functions runs in the trusted process at startup and finds all the
   // memory mappings that existed when the sandbox was first enabled. Going
   // forward, all these mappings are off-limits for operations such as
   // mmap(), munmap(), and mprotect().
-  static void  initializeProtectedMap(int fd);
+  static int   initializeProtectedMap(int fd);
 
   // Helper functions that allows the trusted process to get access to
   // "/proc/self/maps" in the sandbox.
-  static void  snapshotMemoryMappings(int processFd);
+  static void  snapshotMemoryMappings(int processFd, int proc_self_maps);
 
   // Main loop for the trusted process.
-  static void  trustedProcess(int parentProc, int processFdPub, int sandboxFd,
-                              int cloneFd, SecureMem::Args* secureArena)
+  static void  trustedProcess(int parentMapsFd, int processFdPub,
+                              int sandboxFd, int cloneFd,
+                              SecureMem::Args* secureArena)
                                                      __attribute__((noreturn));
 
   // Fork()s of the trusted process.
   static SecureMem::Args* createTrustedProcess(int processFdPub, int sandboxFd,
                                                int cloneFdPub, int cloneFd);
 
   // Creates the trusted thread for the initial thread, then enables
   // Seccomp mode.
   static void  createTrustedThread(int processFdPub, int cloneFdPub,
                                    SecureMem::Args* secureMem);
 
+  static int   proc_self_maps_;
   static enum SandboxStatus {
     STATUS_UNKNOWN, STATUS_UNSUPPORTED, STATUS_AVAILABLE, STATUS_ENABLED
   }            status_;
   static int   pid_;
   static int   processFdPub_;
   static int   cloneFdPub_;
 
   #ifdef __i386__
   struct SocketCallArgInfo;
   static const struct SocketCallArgInfo socketCallArgInfo[];
@@ skipping 12 matching lines @@
   static ProtectedMap                  protectedMap_;
   static std::vector<SecureMem::Args*> secureMemPool_;
 };
 
 } // namespace
 
 using playground::Sandbox;
 #endif // __cplusplus
 
 #endif // SANDBOX_IMPL_H__