Disable yama on 3.2 kernels with 32bit userland and 64bit kernel.

sandbox/linux/services/yama.cc

Index: sandbox/linux/services/yama.cc
diff --git a/sandbox/linux/services/yama.cc b/sandbox/linux/services/yama.cc
index 49e1b36aab3c015e4bc1ca46a35740c28742a386..8f5d1c867f86cf2c2518f804de9cd82374243585 100644
--- a/sandbox/linux/services/yama.cc
+++ b/sandbox/linux/services/yama.cc
@@ -15,6 +15,8 @@
 #include "base/files/scoped_file.h"
 #include "base/logging.h"
 #include "base/posix/eintr_wrapper.h"
+#include "base/strings/string_util.h"
+#include "base/sys_info.h"
 
 #if !defined(PR_SET_PTRACER_ANY)
 #define PR_SET_PTRACER_ANY ((unsigned long)-1)
@@ -31,6 +33,10 @@ namespace {
 // Enable or disable the Yama ptracers restrictions.
 // Return false if Yama is not present on this kernel.
 bool SetYamaPtracersRestriction(bool enable_restrictions) {
+  if (enable_restrictions && Yama::HasLinux32Bug()) {

[Jorge Lucangeli Obes, 2014/07/08 04:14:28]

This doesn't really make sense. The problem is when trying to *disable* Yama
restrictions, not when trying to enable them.

You could argue that we should not enable the restrictions if we know we cannot
disable them, but I'd rather just adapt the tests and not this code. We're
making users less secure here.

+    return false;
+  }
+
   unsigned long set_ptracer_arg;
   if (enable_restrictions) {
     set_ptracer_arg = 0;
@@ -77,6 +83,10 @@ int Yama::GetStatus() {
     return 0;
   }
 
+  if (HasLinux32Bug()) {
+    return 0;

[Jorge Lucangeli Obes, 2014/07/08 04:14:28]

As above.

+  }
+
   static const char kPtraceScopePath[] = "/proc/sys/kernel/yama/ptrace_scope";
 
   base::ScopedFD yama_scope(HANDLE_EINTR(open(kPtraceScopePath, O_RDONLY)));
@@ -113,4 +123,20 @@ bool Yama::IsPresent() { return GetStatus() & STATUS_PRESENT; }
 // static
 bool Yama::IsEnforcing() { return GetStatus() & STATUS_ENFORCING; }
 
+// static
+bool Yama::HasLinux32Bug() {
+#if defined(__i386__)
+  // On 3.2 kernels, yama doesn't work for 32bit binaries on 64bit kernels.

[Jorge Lucangeli Obes, 2014/07/08 04:14:28]

32-bit, 64-bit

+  // This is fixed in 3.4.
+  bool is_kernel_64bit =
+      base::SysInfo::OperatingSystemArchitecture() == "x86_64";
+  bool is_linux = base::SysInfo::OperatingSystemName() == "Linux";
+  bool is_3_dot_2 = StartsWithASCII(
+      base::SysInfo::OperatingSystemVersion(), "3.2", /*case_sensitive=*/false);

[Jorge Lucangeli Obes, 2014/07/08 04:14:28]

'false /* case_sensitive */'

[Nico, 2014/07/08 04:24:43]

This is somewhat common style:
https://code.google.com/p/chromium/codesearch#search/&q=%5C/%5C*.*%5Cw=%5C*&s...
(and even detected by clang-format; it omits the spaces in the comment when it
detects this)

+  if (is_kernel_64bit && is_linux && is_3_dot_2)
+    return true;
+#endif  // defined(__i386__)
+  return false;
+}
+
 }  // namespace sandbox