NonSFI sandbox: restrict futex(2) operations.

components/nacl/loader/nonsfi/nonsfi_sandbox.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "components/nacl/loader/nonsfi/nonsfi_sandbox.h"
 
 #include <errno.h>
 #include <fcntl.h>
+#include <linux/futex.h>
 #include <linux/net.h>
+#include <sys/mman.h>
 #include <sys/prctl.h>
 #include <sys/ptrace.h>
-#include <sys/mman.h>
 #include <sys/socket.h>
 #include <sys/syscall.h>
+#include <sys/time.h>
 
 #include "base/basictypes.h"
 #include "base/logging.h"
 #include "base/time/time.h"
 #include "build/build_config.h"
 #include "content/public/common/sandbox_init.h"
 #include "sandbox/linux/bpf_dsl/bpf_dsl.h"
 #include "sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.h"
 #include "sandbox/linux/seccomp-bpf/sandbox_bpf_policy.h"
 #include "sandbox/linux/services/linux_syscalls.h"
 
 #if defined(__arm__) && !defined(MAP_STACK)
 // Chrome OS Daisy (ARM) build environment has old headers.
 #define MAP_STACK 0x20000
 #endif
 
 using sandbox::CrashSIGSYS;
 using sandbox::CrashSIGSYSClone;
+using sandbox::CrashSIGSYSFutex;
 using sandbox::CrashSIGSYSPrctl;
 using sandbox::bpf_dsl::Allow;
 using sandbox::bpf_dsl::Arg;
+using sandbox::bpf_dsl::BoolExpr;
 using sandbox::bpf_dsl::Error;
 using sandbox::bpf_dsl::If;
 using sandbox::bpf_dsl::ResultExpr;
 
 // TODO(mdempsky): Make BoolExpr a standalone class so these operators can
 // be resolved via argument-dependent lookup.
 using sandbox::bpf_dsl::operator&&;
 using sandbox::bpf_dsl::operator||;
 
 namespace nacl {
@@ skipping 42 matching lines @@
 
 ResultExpr RestrictClone() {
   // We allow clone only for new thread creation.
   const Arg<int> flags(0);
   return If(flags == (CLONE_VM | CLONE_FS | CLONE_FILES | CLONE_SIGHAND |
                       CLONE_THREAD | CLONE_SYSVSEM | CLONE_SETTLS |
                       CLONE_PARENT_SETTID | CLONE_CHILD_CLEARTID),
             Allow()).Else(CrashSIGSYSClone());
 }
 
+ResultExpr RestrictFutexOperation() {
+  const int kAllowedFutexFlags = FUTEX_PRIVATE_FLAG | FUTEX_CLOCK_REALTIME;

[jln (very slow on Chromium), 2014/09/05 23:40:52]

Should I remove FUTEX_CLOCK_REALTIME?

[Mark Seaborn, 2014/09/06 00:36:47]

glibc might be using it.  I'm not sure.

It would be a very useful flag, except that the kernel seems to arbitrarily
disallow its use on the plain FUTEX_WAIT, which is unfortunate.

+  const int kOperationMask = ~kAllowedFutexFlags;
+  const int kAllowedFutexOperations[] = {
+      FUTEX_WAIT,        FUTEX_WAKE,    FUTEX_FD,          FUTEX_REQUEUE,

[Mark Seaborn, 2014/09/06 00:36:47]

Don't need FUTEX_FD.  The man page says "Because it was inherently racy,
FUTEX_FD has been removed from Linux 2.6.26 onward."

[jln (very slow on Chromium), 2014/09/06 00:45:37]

Done.

+      FUTEX_CMP_REQUEUE, FUTEX_WAKE_OP, FUTEX_WAIT_BITSET, FUTEX_WAKE_BITSET};
+
+  const Arg<int> op(1);
+
+  BoolExpr IsAllowedOp = (op & kOperationMask) == kAllowedFutexOperations[0];

[Mark Seaborn, 2014/09/06 00:36:47]

Style nit: shouldn't this be "is_allowed_op"?

[jln (very slow on Chromium), 2014/09/06 00:45:37]

Done.

+  for (size_t i = 1; i < arraysize(kAllowedFutexOperations); ++i) {
+    IsAllowedOp =
+        IsAllowedOp || ((op & kOperationMask) == kAllowedFutexOperations[i]);
+  }
+  return If(IsAllowedOp, Allow()).Else(CrashSIGSYSFutex());
+}
+
 ResultExpr RestrictPrctl() {
   // base::PlatformThread::SetName() uses PR_SET_NAME so we return
   // EPERM for it. Otherwise, we will raise SIGSYS.
   const Arg<int> option(0);
   return If(option == PR_SET_NAME, Error(EPERM)).Else(CrashSIGSYSPrctl());
 }
 
 #if defined(__i386__)
 ResultExpr RestrictSocketcall() {
   // We only allow socketpair, sendmsg, and recvmsg.
@@ skipping 99 matching lines @@
     case __NR_close:
     case __NR_dup:
     case __NR_dup2:
     case __NR_exit:
     case __NR_exit_group:
 #if defined(__i386__) || defined(__arm__)
     case __NR_fstat64:
 #elif defined(__x86_64__)
     case __NR_fstat:
 #endif
-    // TODO(hamaji): Allow only FUTEX_PRIVATE_FLAG.
-    case __NR_futex:
     // TODO(hamaji): Remove the need of gettid. Currently, this is
     // called from PlatformThread::CurrentId().
     case __NR_gettid:
     case __NR_gettimeofday:
     case __NR_munmap:
     case __NR_nanosleep:
     // TODO(hamaji): Remove the need of pipe. Currently, this is
     // called from base::MessagePumpLibevent::Init().
     case __NR_pipe:
     case __NR_poll:
@@ skipping 20 matching lines @@
       return RestrictClone();
 
 #if defined(__x86_64__)
     case __NR_fcntl:
 #endif
 #if defined(__i386__) || defined(__arm__)
     case __NR_fcntl64:
 #endif
       return RestrictFcntlCommands();
 
+    // TODO(hamaji): Allow only FUTEX_PRIVATE_FLAG.

[Mark Seaborn, 2014/09/06 00:36:47]

Move this comment into RestrictFutexOperation()?

[jln (very slow on Chromium), 2014/09/06 00:45:37]

Done.

+    case __NR_futex:
+      return RestrictFutexOperation();
+
 #if defined(__x86_64__)
     case __NR_mmap:
 #endif
 #if defined(__i386__) || defined(__arm__)
     case __NR_mmap2:
 #endif
       return RestrictMmap();
     case __NR_mprotect:
       return RestrictMprotect();
 
@@ skipping 38 matching lines @@
       scoped_ptr<sandbox::SandboxBPFPolicy>(
           new nacl::nonsfi::NaClNonSfiBPFSandboxPolicy()));
   if (!sandbox_is_initialized)
     return false;
   RunSandboxSanityChecks();
   return true;
 }
 
 }  // namespace nonsfi
 }  // namespace nacl