Allow the seccomp sandbox to be enabled, even if the suid sandbox has...

sandbox/linux/seccomp/socketcall.cc

 #include "debug.h"
 #include "sandbox_impl.h"
 
 namespace playground {
 
 #if defined(__NR_socket)
 
 ssize_t Sandbox::sandbox_recvfrom(int sockfd, void* buf, size_t len, int flags,
                                   void* from, socklen_t* fromlen) {
   Debug::syscall(__NR_recvfrom, "Executing handler");
@@ skipping 186 matching lines @@
   long rc;
   SysCalls sys;
   if (write(sys, processFdPub(), &request, sizeof(request)) !=
       sizeof(request) ||
       read(sys, threadFdPub(), &rc, sizeof(rc)) != sizeof(rc)) {
     die("Failed to forward getsockopt() request [sandbox]");
   }
   return static_cast<int>(rc);
 }
 
-bool Sandbox::process_recvfrom(int parentProc, int sandboxFd, int threadFdPub,
-                               int threadFd, SecureMem::Args* mem) {
+bool Sandbox::process_recvfrom(int parentMapsFd, int sandboxFd,
+                               int threadFdPub, int threadFd,
+                               SecureMem::Args* mem) {
   // Read request
   RecvFrom recvfrom_req;
   SysCalls sys;
   if (read(sys, sandboxFd, &recvfrom_req, sizeof(recvfrom_req)) !=
       sizeof(recvfrom_req)) {
     die("Failed to read parameters for recvfrom() [process]");
   }
 
   // Unsupported flag encountered. Deny the call.
   if (recvfrom_req.flags &
       ~(MSG_DONTWAIT|MSG_OOB|MSG_PEEK|MSG_TRUNC|MSG_WAITALL)) {
     SecureMem::abandonSystemCall(threadFd, -EINVAL);
     return false;
   }
 
   // While we do not anticipate any particular need to receive data on
   // unconnected sockets, there is no particular risk in doing so.
   SecureMem::sendSystemCall(threadFdPub, false, -1, mem,
                             __NR_recvfrom, recvfrom_req.sockfd,
                             recvfrom_req.buf, recvfrom_req.len,
                             recvfrom_req.flags, recvfrom_req.from,
                             recvfrom_req.fromlen);
   return true;
 }
 
-bool Sandbox::process_recvmsg(int parentProc, int sandboxFd, int threadFdPub,
+bool Sandbox::process_recvmsg(int parentMapsFd, int sandboxFd, int threadFdPub,
                               int threadFd, SecureMem::Args* mem) {
   // Read request
   RecvMsg  recvmsg_req;
   SysCalls sys;
   if (read(sys, sandboxFd, &recvmsg_req, sizeof(recvmsg_req)) !=
       sizeof(recvmsg_req)) {
     die("Failed to read parameters for recvmsg() [process]");
   }
 
   // Unsupported flag encountered. Deny the call.
   if (recvmsg_req.flags &
       ~(MSG_DONTWAIT|MSG_OOB|MSG_PEEK|MSG_TRUNC|MSG_WAITALL)) {
     SecureMem::abandonSystemCall(threadFd, -EINVAL);
     return false;
   }
 
   // Receiving messages is general not security critical.
   SecureMem::sendSystemCall(threadFdPub, false, -1, mem,
                             __NR_recvmsg, recvmsg_req.sockfd,
                             recvmsg_req.msg, recvmsg_req.flags);
   return true;
 }
 
-bool Sandbox::process_sendmsg(int parentProc, int sandboxFd, int threadFdPub,
+bool Sandbox::process_sendmsg(int parentMapsFd, int sandboxFd, int threadFdPub,
                               int threadFd, SecureMem::Args* mem) {
   // Read request
   struct {
     SendMsg sendmsg_req;
     struct msghdr   msg;
   } __attribute__((packed)) data;
   SysCalls sys;
   if (read(sys, sandboxFd, &data, sizeof(data)) != sizeof(data)) {
     die("Failed to read parameters for sendmsg() [process]");
   }
@@ skipping 31 matching lines @@
     do {
       if (cmsg->cmsg_level != SOL_SOCKET ||
           cmsg->cmsg_type != SCM_RIGHTS) {
         goto deny;
       }
     } while ((cmsg = CMSG_NXTHDR(&data.msg, cmsg)) != NULL);
   }
 
   // This must be a locked system call, because we have to ensure that the
   // untrusted code does not tamper with the msghdr after we have examined it.
-  SecureMem::lockSystemCall(parentProc, mem);
+  SecureMem::lockSystemCall(parentMapsFd, mem);
   if (sizeof(extra) > 0) {
     if (data.msg.msg_namelen > 0) {
       data.msg.msg_name = mem->pathname + sizeof(struct msghdr);
     }
     if (data.msg.msg_controllen > 0) {
       data.msg.msg_control = mem->pathname + sizeof(struct msghdr) +
                              data.msg.msg_namelen;
     }
     memcpy(mem->pathname + sizeof(struct msghdr), extra, sizeof(extra));
   }
   memcpy(mem->pathname, &data.msg, sizeof(struct msghdr));
-  SecureMem::sendSystemCall(threadFdPub, true, parentProc, mem,
+  SecureMem::sendSystemCall(threadFdPub, true, parentMapsFd, mem,
                             __NR_sendmsg, data.sendmsg_req.sockfd,
                             mem->pathname - (char*)mem + (char*)mem->self,
                             data.sendmsg_req.flags);
   return true;
 }
 
-bool Sandbox::process_sendto(int parentProc, int sandboxFd, int threadFdPub,
+bool Sandbox::process_sendto(int parentMapsFd, int sandboxFd, int threadFdPub,
                              int threadFd, SecureMem::Args* mem) {
   // Read request
   SendTo   sendto_req;
   SysCalls sys;
   if (read(sys, sandboxFd, &sendto_req, sizeof(sendto_req)) !=
       sizeof(sendto_req)) {
     die("Failed to read parameters for sendto() [process]");
   }
 
   // The sandbox does not allow sending to arbitrary addresses.
@@ skipping 12 matching lines @@
   // Sending data on a connected socket is similar to calling write().
   // Allow it.
   SecureMem::sendSystemCall(threadFdPub, false, -1, mem,
                             __NR_sendto, sendto_req.sockfd,
                             sendto_req.buf, sendto_req.len,
                             sendto_req.flags, sendto_req.to,
                             sendto_req.tolen);
   return true;
 }
 
-bool Sandbox::process_setsockopt(int parentProc, int sandboxFd,
+bool Sandbox::process_setsockopt(int parentMapsFd, int sandboxFd,
                                  int threadFdPub, int threadFd,
                                  SecureMem::Args* mem) {
   // Read request
   SetSockOpt setsockopt_req;
   SysCalls sys;
   if (read(sys, sandboxFd, &setsockopt_req, sizeof(setsockopt_req)) !=
       sizeof(setsockopt_req)) {
     die("Failed to read parameters for setsockopt() [process]");
   }
 
@@ skipping 43 matching lines @@
           break;
       }
       break;
     default:
       break;
   }
   SecureMem::abandonSystemCall(threadFd, -EINVAL);
   return false;
 }
 
-bool Sandbox::process_getsockopt(int parentProc, int sandboxFd,
+bool Sandbox::process_getsockopt(int parentMapsFd, int sandboxFd,
                                  int threadFdPub, int threadFd,
                                  SecureMem::Args* mem) {
   // Read request
   GetSockOpt getsockopt_req;
   SysCalls sys;
   if (read(sys, sandboxFd, &getsockopt_req, sizeof(getsockopt_req)) !=
       sizeof(getsockopt_req)) {
     die("Failed to read parameters for getsockopt() [process]");
   }
 
@@ skipping 262 matching lines @@
   // Send request to trusted process and collect response from trusted thread.
   long rc;
   ssize_t len                     = sizeof(struct Request) + numExtraData;
   if (write(sys, processFdPub(), data, len) != len ||
       read(sys, threadFdPub(), &rc, sizeof(rc)) != sizeof(rc)) {
     die("Failed to forward socketcall() request [sandbox]");
   }
   return static_cast<int>(rc);
 }
 
-bool Sandbox::process_socketcall(int parentProc, int sandboxFd,
+bool Sandbox::process_socketcall(int parentMapsFd, int sandboxFd,
                                  int threadFdPub, int threadFd,
                                  SecureMem::Args* mem) {
   // Read request
   SocketCall socketcall_req;
   SysCalls sys;
   if (read(sys, sandboxFd, &socketcall_req, sizeof(socketcall_req)) !=
       sizeof(socketcall_req)) {
     die("Failed to read parameters for socketcall() [process]");
   }
 
@@ skipping 97 matching lines @@
         goto deny;
       }
       // Sending data on a connected socket is similar to calling write().
       // Allow it.
 
     accept_complex:
       // The parameter block contains potentially security critical information
       // that should not be tampered with after it has been inspected. Copy it
       // into the write-protected securely shared memory before telling the
       // trusted thread to execute the socket call.
-      SecureMem::lockSystemCall(parentProc, mem);
+      SecureMem::lockSystemCall(parentMapsFd, mem);
       memcpy(mem->pathname, &socketcall_req.args, sizeof(socketcall_req.args));
-      SecureMem::sendSystemCall(threadFdPub, true, parentProc, mem,
+      SecureMem::sendSystemCall(threadFdPub, true, parentMapsFd, mem,
                                 __NR_socketcall, socketcall_req.call,
                                 mem->pathname - (char*)mem + (char*)mem->self);
       return true;
     case SYS_RECVFROM:
       // While we do not anticipate any particular need to receive data on
       // unconnected sockets, there is no particular risk in doing so.
       // Fall through
     case SYS_RECV:
       if (socketcall_req.args.recv.flags &
           ~(MSG_DONTWAIT|MSG_OOB|MSG_PEEK|MSG_TRUNC|MSG_WAITALL)) {
@@ skipping 123 matching lines @@
           if (cmsg->cmsg_level != SOL_SOCKET ||
               cmsg->cmsg_type != SCM_RIGHTS) {
             goto deny;
           }
         } while ((cmsg = CMSG_NXTHDR(msg, cmsg)) != NULL);
       }
 
       // This must be a locked system call, because we have to ensure that
       // the untrusted code does not tamper with the msghdr after we have
       // examined it.
-      SecureMem::lockSystemCall(parentProc, mem);
+      SecureMem::lockSystemCall(parentMapsFd, mem);
       socketcall_req.args.sendmsg.msg =
           reinterpret_cast<struct msghdr*>(mem->pathname +
                                            sizeof(socketcall_req.args) -
                                            (char*)mem + (char*)mem->self);
       memcpy(mem->pathname, &socketcall_req.args, sizeof(socketcall_req.args));
       if (numSendmsgExtra) {
         if (msg->msg_namelen > 0) {
           msg->msg_name = const_cast<struct msghdr*>(
               socketcall_req.args.sendmsg.msg) + 1;
         }
         if (msg->msg_controllen > 0) {
           msg->msg_control = (char *)(
               socketcall_req.args.sendmsg.msg + 1) + msg->msg_namelen;
         }
         memcpy(mem->pathname + sizeof(socketcall_req.args) + sizeof(*msg),
                sendmsgExtra, numSendmsgExtra);
       }
       memcpy(mem->pathname + sizeof(socketcall_req.args), msg, sizeof(*msg));
-      SecureMem::sendSystemCall(threadFdPub, true, parentProc, mem,
+      SecureMem::sendSystemCall(threadFdPub, true, parentMapsFd, mem,
                                 __NR_socketcall, socketcall_req.call,
                                 mem->pathname - (char*)mem + (char*)mem->self);
       return true;
     }
     case SYS_RECVMSG:
       // Receiving messages is general not security critical.
       if (socketcall_req.args.recvmsg.flags &
           ~(MSG_DONTWAIT|MSG_OOB|MSG_PEEK|MSG_TRUNC|MSG_WAITALL)) {
         goto deny;
       }
       goto accept_complex;
     default:
     deny:
       SecureMem::abandonSystemCall(threadFd, rc);
       return false;
   }
 }
 
 #endif
 
 } // namespace