bpf_dsl: support arbitrary (arg & mask) == val expressions

sandbox/linux/bpf_dsl/bpf_dsl_unittest.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sandbox/linux/bpf_dsl/bpf_dsl.h"
 
 #include <errno.h>
 #include <netinet/in.h>
 #include <sys/socket.h>
 #include <sys/utsname.h>
@@ skipping 14 matching lines @@
 namespace sandbox {
 namespace bpf_dsl {
 namespace {
 
 // Type safe stubs for tested system calls.
 class Stubs {
  public:
   static int getpgid(pid_t pid) { return Syscall::Call(__NR_getpgid, pid); }
   static int setuid(uid_t uid) { return Syscall::Call(__NR_setuid, uid); }
   static int setgid(gid_t gid) { return Syscall::Call(__NR_setgid, gid); }
+  static int setpgid(pid_t pid, pid_t pgid) {
+    return Syscall::Call(__NR_setpgid, pid, pgid);
+  }
 
   static int uname(struct utsname* buf) {
     return Syscall::Call(__NR_uname, buf);
   }
 
   static int setresuid(uid_t ruid, uid_t euid, uid_t suid) {
     return Syscall::Call(__NR_setresuid, ruid, euid, suid);
   }
 
 #if !defined(ARCH_CPU_X86)
@@ skipping 160 matching lines @@
   virtual ~MaskingPolicy() {}
   virtual ResultExpr EvaluateSyscall(int sysno) const OVERRIDE {
     if (sysno == __NR_setuid) {
       const Arg<uid_t> uid(0);
       return If((uid & 0xf) == 0, Error(EINVAL)).Else(Error(EACCES));
     }
     if (sysno == __NR_setgid) {
       const Arg<gid_t> gid(0);
       return If((gid & 0xf0) == 0xf0, Error(EINVAL)).Else(Error(EACCES));
     }
+    if (sysno == __NR_setpgid) {
+      const Arg<pid_t> pid(0);
+      return If((pid & 0xa5) == 0xa0, Error(EINVAL)).Else(Error(EACCES));
+    }
     return Allow();
   }
 
  private:
   DISALLOW_COPY_AND_ASSIGN(MaskingPolicy);
 };
 
 BPF_TEST_C(BPFDSL, MaskTest, MaskingPolicy) {
   for (uid_t uid = 0; uid < 0x100; ++uid) {
     const int expect_errno = (uid & 0xf) == 0 ? EINVAL : EACCES;
     ASSERT_SYSCALL_RESULT(-expect_errno, setuid, uid);
   }
 
   for (gid_t gid = 0; gid < 0x100; ++gid) {
     const int expect_errno = (gid & 0xf0) == 0xf0 ? EINVAL : EACCES;
     ASSERT_SYSCALL_RESULT(-expect_errno, setgid, gid);
   }
+
+  for (pid_t pid = 0; pid < 0x100; ++pid) {
+    const int expect_errno = (pid & 0xa5) == 0xa0 ? EINVAL : EACCES;
+    ASSERT_SYSCALL_RESULT(-expect_errno, setpgid, pid, 0);
+  }
 }
 
 class ElseIfPolicy : public SandboxBPFDSLPolicy {
  public:
   ElseIfPolicy() {}
   virtual ~ElseIfPolicy() {}
   virtual ResultExpr EvaluateSyscall(int sysno) const OVERRIDE {
     if (sysno == __NR_setuid) {
       const Arg<uid_t> uid(0);
       return If((uid & 0xfff) == 0, Error(0))
@@ skipping 17 matching lines @@
   ASSERT_SYSCALL_RESULT(-EEXIST, setuid, 0x0011);
   ASSERT_SYSCALL_RESULT(-EEXIST, setuid, 0x0022);
 
   ASSERT_SYSCALL_RESULT(-EACCES, setuid, 0x0111);
   ASSERT_SYSCALL_RESULT(-EACCES, setuid, 0x0222);
 }
 
 }  // namespace
 }  // namespace bpf_dsl
 }  // namespace sandbox