sandbox: Avoid ~(flag1 | flag2 | ...) expressions

components/nacl/loader/nonsfi/nonsfi_sandbox.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "components/nacl/loader/nonsfi/nonsfi_sandbox.h"
 
 #include <errno.h>
 #include <fcntl.h>
 #include <linux/futex.h>
 #include <linux/net.h>
@@ skipping 43 matching lines @@
   // We allow following cases:
   // 1. F_SETFD + FD_CLOEXEC: libevent's epoll_init uses this.
   // 2. F_GETFL: Used by SetNonBlocking in
   // message_pump_libevent.cc and Channel::ChannelImpl::CreatePipe
   // in ipc_channel_posix.cc. Note that the latter does not work
   // with EPERM.
   // 3. F_SETFL: Used by evutil_make_socket_nonblocking in
   // libevent and SetNonBlocking. As the latter mix O_NONBLOCK to
   // the return value of F_GETFL, so we need to allow O_ACCMODE in
   // addition to O_NONBLOCK.
-  const unsigned long denied_mask = ~(O_ACCMODE | O_NONBLOCK);
+  const unsigned long kAllowedMask = O_ACCMODE | O_NONBLOCK;

[jln (very slow on Chromium), 2014/09/23 21:04:30]

uint64 for consistency ?

[mdempsky, 2014/09/23 21:17:16]

Done.

   return If((cmd == F_SETFD && long_arg == FD_CLOEXEC) || cmd == F_GETFL ||
-                (cmd == F_SETFL && (long_arg & denied_mask) == 0),
+                (cmd == F_SETFL && (long_arg & ~kAllowedMask) == 0),
             Allow()).Else(CrashSIGSYS());
 }
 
 ResultExpr RestrictClone() {
   // We allow clone only for new thread creation.
   const Arg<int> flags(0);
   return If(flags == (CLONE_VM | CLONE_FS | CLONE_FILES | CLONE_SIGHAND |
                       CLONE_THREAD | CLONE_SYSVSEM | CLONE_SETTLS |
                       CLONE_PARENT_SETTID | CLONE_CHILD_CLEARTID),
             Allow()).Else(CrashSIGSYSClone());
 }
 
 ResultExpr RestrictFutexOperation() {
   // TODO(hamaji): Allow only FUTEX_PRIVATE_FLAG futexes.
-  const int kAllowedFutexFlags = FUTEX_PRIVATE_FLAG | FUTEX_CLOCK_REALTIME;
-  const int kOperationMask = ~kAllowedFutexFlags;
+  const uint64_t kAllowedFutexFlags = FUTEX_PRIVATE_FLAG | FUTEX_CLOCK_REALTIME;
   const Arg<int> op(1);
-  return Switch(op & kOperationMask)
+  return Switch(op & ~kAllowedFutexFlags)
       .CASES((FUTEX_WAIT,
               FUTEX_WAKE,
               FUTEX_REQUEUE,
               FUTEX_CMP_REQUEUE,
               FUTEX_WAKE_OP,
               FUTEX_WAIT_BITSET,
               FUTEX_WAKE_BITSET),
              Allow())
       .Default(CrashSIGSYSFutex());
 }
@@ skipping 11 matching lines @@
   const Arg<int> call(0);
   return If(call == SYS_SOCKETPAIR || call == SYS_SHUTDOWN ||
                 call == SYS_SENDMSG || call == SYS_RECVMSG,
             Allow()).Else(CrashSIGSYS());
 }
 #endif
 
 ResultExpr RestrictMprotect() {
   // TODO(jln, keescook, drewry): Limit the use of mprotect by adding
   // some features to linux kernel.
-  const uint32_t denied_mask = ~(PROT_READ | PROT_WRITE | PROT_EXEC);
+  const uint64_t kAllowedMask = PROT_READ | PROT_WRITE | PROT_EXEC;
   const Arg<int> prot(2);
-  return If((prot & denied_mask) == 0, Allow()).Else(CrashSIGSYS());
+  return If((prot & ~kAllowedMask) == 0, Allow()).Else(CrashSIGSYS());
 }
 
 ResultExpr RestrictMmap() {
-  const uint32_t denied_flag_mask = ~(MAP_SHARED | MAP_PRIVATE |
-                                      MAP_ANONYMOUS | MAP_STACK | MAP_FIXED);
+  const uint64_t kAllowedFlagMask =
+      MAP_SHARED | MAP_PRIVATE | MAP_ANONYMOUS | MAP_STACK | MAP_FIXED;
   // When PROT_EXEC is specified, IRT mmap of Non-SFI NaCl helper
   // calls mmap without PROT_EXEC and then adds PROT_EXEC by mprotect,
   // so we do not need to allow PROT_EXEC in mmap.
-  const uint32_t denied_prot_mask = ~(PROT_READ | PROT_WRITE);
+  const uint64_t kAllowedProtMask = PROT_READ | PROT_WRITE;
   const Arg<int> prot(2), flags(3);
-  return If((prot & denied_prot_mask) == 0 && (flags & denied_flag_mask) == 0,
+  return If((prot & ~kAllowedProtMask) == 0 && (flags & ~kAllowedFlagMask) == 0,
             Allow()).Else(CrashSIGSYS());
 }
 
 #if defined(__x86_64__) || defined(__arm__)
 ResultExpr RestrictSocketpair() {
   // Only allow AF_UNIX, PF_UNIX. Crash if anything else is seen.
   COMPILE_ASSERT(AF_UNIX == PF_UNIX, af_unix_pf_unix_different);
   const Arg<int> domain(0);
   return If(domain == AF_UNIX, Allow()).Else(CrashSIGSYS());
 }
@@ skipping 166 matching lines @@
       scoped_ptr<sandbox::bpf_dsl::SandboxBPFDSLPolicy>(
           new nacl::nonsfi::NaClNonSfiBPFSandboxPolicy()));
   if (!sandbox_is_initialized)
     return false;
   RunSandboxSanityChecks();
   return true;
 }
 
 }  // namespace nonsfi
 }  // namespace nacl