Disable yama on 3.2 kernels with 32bit userland and 64bit kernel.

sandbox/linux/services/yama.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sandbox/linux/services/yama.h"
 
 #include <fcntl.h>
 #include <sys/prctl.h>
 #include <sys/stat.h>
 #include <sys/types.h>
 #include <unistd.h>
 
 #include "base/basictypes.h"
 #include "base/file_util.h"
 #include "base/files/scoped_file.h"
 #include "base/logging.h"
 #include "base/posix/eintr_wrapper.h"
+#include "base/strings/string_util.h"
+#include "base/sys_info.h"
 
 #if !defined(PR_SET_PTRACER_ANY)
 #define PR_SET_PTRACER_ANY ((unsigned long)-1)
 #endif
 
 #if !defined(PR_SET_PTRACER)
 #define PR_SET_PTRACER 0x59616d61
 #endif
 
 namespace sandbox {
 
 namespace {
 
 // Enable or disable the Yama ptracers restrictions.
 // Return false if Yama is not present on this kernel.
 bool SetYamaPtracersRestriction(bool enable_restrictions) {
+  if (enable_restrictions && Yama::HasLinux32Bug()) {

[Jorge Lucangeli Obes, 2014/07/08 04:14:28]

This doesn't really make sense. The problem is when trying to *disable* Yama
restrictions, not when trying to enable them.

You could argue that we should not enable the restrictions if we know we cannot
disable them, but I'd rather just adapt the tests and not this code. We're
making users less secure here.

+    return false;
+  }
+
   unsigned long set_ptracer_arg;
   if (enable_restrictions) {
     set_ptracer_arg = 0;
   } else {
     set_ptracer_arg = PR_SET_PTRACER_ANY;
   }
 
   const int ret = prctl(PR_SET_PTRACER, set_ptracer_arg);
   const int prctl_errno = errno;
 
@@ skipping 26 matching lines @@
 bool Yama::DisableYamaRestrictions() {
   return SetYamaPtracersRestriction(false /* enable_restrictions */);
 }
 
 // static
 int Yama::GetStatus() {
   if (!CanAccessProcFS()) {
     return 0;
   }
 
+  if (HasLinux32Bug()) {
+    return 0;

[Jorge Lucangeli Obes, 2014/07/08 04:14:28]

As above.

+  }
+
   static const char kPtraceScopePath[] = "/proc/sys/kernel/yama/ptrace_scope";
 
   base::ScopedFD yama_scope(HANDLE_EINTR(open(kPtraceScopePath, O_RDONLY)));
 
   if (!yama_scope.is_valid()) {
     const int open_errno = errno;
     DCHECK(ENOENT == open_errno);
     // The status is known, yama is not present.
     return STATUS_KNOWN;
   }
@@ skipping 16 matching lines @@
       return 0;
   }
 }
 
 // static
 bool Yama::IsPresent() { return GetStatus() & STATUS_PRESENT; }
 
 // static
 bool Yama::IsEnforcing() { return GetStatus() & STATUS_ENFORCING; }
 
+// static
+bool Yama::HasLinux32Bug() {
+#if defined(__i386__)
+  // On 3.2 kernels, yama doesn't work for 32bit binaries on 64bit kernels.

[Jorge Lucangeli Obes, 2014/07/08 04:14:28]

32-bit, 64-bit

+  // This is fixed in 3.4.
+  bool is_kernel_64bit =
+      base::SysInfo::OperatingSystemArchitecture() == "x86_64";
+  bool is_linux = base::SysInfo::OperatingSystemName() == "Linux";
+  bool is_3_dot_2 = StartsWithASCII(
+      base::SysInfo::OperatingSystemVersion(), "3.2", /*case_sensitive=*/false);

[Jorge Lucangeli Obes, 2014/07/08 04:14:28]

'false /* case_sensitive */'

[Nico, 2014/07/08 04:24:43]

This is somewhat common style:
https://code.google.com/p/chromium/codesearch#search/&q=%5C/%5C*.*%5Cw=%5C*&s...
(and even detected by clang-format; it omits the spaces in the comment when it
detects this)

+  if (is_kernel_64bit && is_linux && is_3_dot_2)
+    return true;
+#endif  // defined(__i386__)
+  return false;
+}
+
 }  // namespace sandbox