Disable yama on 3.2 kernels with 32bit userland and 64bit kernel.

sandbox/linux/services/yama_unittests.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <errno.h>
 #include <fcntl.h>
 #include <sys/ptrace.h>
 #include <sys/stat.h>
 #include <sys/types.h>
 #include <unistd.h>
 
 #include "base/bind.h"
 #include "base/compiler_specific.h"
 #include "base/posix/eintr_wrapper.h"
 #include "sandbox/linux/services/scoped_process.h"
 #include "sandbox/linux/services/yama.h"
 #include "sandbox/linux/tests/unit_tests.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 namespace sandbox {
 
 namespace {
 
+bool HasLinux32Bug() {
+#if defined(__i386__)
+  // On 3.2 kernels, yama doesn't work for 32bit binaries on 64bit kernels.

[Jorge Lucangeli Obes, 2014/07/08 04:57:14]

Yama, 32-bit, 64-bit

[Nico, 2014/07/08 05:00:47]

I had fixed the 32bit/64bit thing (see patch set 3). Fixed Yama now too.

+  // This is fixed in 3.4.
+  bool is_kernel_64bit =
+      base::SysInfo::OperatingSystemArchitecture() == "x86_64";
+  bool is_linux = base::SysInfo::OperatingSystemName() == "Linux";
+  bool is_3_dot_2 = StartsWithASCII(
+      base::SysInfo::OperatingSystemVersion(), "3.2", /*case_sensitive=*/false);
+  if (is_kernel_64bit && is_linux && is_3_dot_2)
+    return true;
+#endif  // defined(__i386__)
+  return false;
+}
+
 bool CanPtrace(pid_t pid) {
   int ret;
   ret = ptrace(PTRACE_ATTACH, pid, NULL, NULL);
   if (ret == -1) {
     CHECK_EQ(EPERM, errno);
     return false;
   }
   // Wait for the process to be stopped so that it can be detached.
   siginfo_t process_info;
   int wait_ret = HANDLE_EINTR(waitid(P_PID, pid, &process_info, WSTOPPED));
@@ skipping 71 matching lines @@
 // Attempts to enable or disable Yama restrictions.
 void SetYamaRestrictions(bool enable_restriction) {
   if (enable_restriction) {
     Yama::RestrictPtracersToAncestors();
   } else {
     Yama::DisableYamaRestrictions();
   }
 }
 
 TEST(Yama, RestrictPtraceWorks) {
+  if (HasLinux32Bug())
+    return;
+
   ScopedProcess process1(base::Bind(&SetYamaRestrictions, true));
   ASSERT_TRUE(process1.WaitForClosureToRun());
 
   if (Yama::IsEnforcing()) {
     // A sibling process cannot ptrace process1.
     ASSERT_FALSE(CanSubProcessPtrace(process1.GetPid()));
   }
 
   if (!(Yama::GetStatus() & Yama::STATUS_STRICT_ENFORCING)) {
     // However, parent can ptrace process1.
     ASSERT_TRUE(CanPtrace(process1.GetPid()));
 
     // A sibling can ptrace process2 which disables any Yama protection.
     ScopedProcess process2(base::Bind(&SetYamaRestrictions, false));
     ASSERT_TRUE(process2.WaitForClosureToRun());
     ASSERT_TRUE(CanSubProcessPtrace(process2.GetPid()));
   }
 }
 
 void DoNothing() {}
 
 SANDBOX_TEST(Yama, RestrictPtraceIsDefault) {
-  if (!Yama::IsPresent())
+  if (!Yama::IsPresent() || HasLinux32Bug())
     return;
 
   CHECK(Yama::DisableYamaRestrictions());
   ScopedProcess process1(base::Bind(&DoNothing));
 
   if (Yama::IsEnforcing()) {
     // Check that process1 is protected by Yama, even though it has
     // been created from a process that disabled Yama.
     CHECK(!CanSubProcessPtrace(process1.GetPid()));
   }
 }
 
 }  // namespace
 
 }  // namespace sandbox