sandbox_bpf: rework how unsafe traps are compiled/verified

sandbox/linux/bpf_dsl/bpf_dsl.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sandbox/linux/bpf_dsl/bpf_dsl.h"
 
 #include <errno.h>
 
 #include <limits>
 
 #include "base/logging.h"
 #include "base/memory/ref_counted.h"
 #include "sandbox/linux/seccomp-bpf/errorcode.h"
 #include "sandbox/linux/seccomp-bpf/sandbox_bpf.h"
+#include "sandbox/linux/seccomp-bpf/syscall_iterator.h"
 
 namespace sandbox {
 namespace bpf_dsl {
 namespace {
 
 class AllowResultExprImpl : public internal::ResultExprImpl {
  public:
   AllowResultExprImpl() {}
 
   virtual ErrorCode Compile(SandboxBPF* sb) const override {
     return ErrorCode(ErrorCode::ERR_ALLOWED);
   }
 
  private:
   virtual ~AllowResultExprImpl() {}
 
   DISALLOW_COPY_AND_ASSIGN(AllowResultExprImpl);
 };
 
 class ErrorResultExprImpl : public internal::ResultExprImpl {
  public:
   explicit ErrorResultExprImpl(int err) : err_(err) {
     CHECK(err_ >= ErrorCode::ERR_MIN_ERRNO && err_ <= ErrorCode::ERR_MAX_ERRNO);
   }
 
   virtual ErrorCode Compile(SandboxBPF* sb) const override {
-    return ErrorCode(err_);
+    return sb->Error(err_);
   }
 
  private:
   virtual ~ErrorResultExprImpl() {}
 
   int err_;
 
   DISALLOW_COPY_AND_ASSIGN(ErrorResultExprImpl);
 };
 
@@ skipping 53 matching lines @@
  public:
   UnsafeTrapResultExprImpl(Trap::TrapFnc func, const void* arg)
       : func_(func), arg_(arg) {
     DCHECK(func_);
   }
 
   virtual ErrorCode Compile(SandboxBPF* sb) const override {
     return sb->UnsafeTrap(func_, arg_);
   }
 
+  virtual bool HasUnsafeTraps() const override { return true; }
+
  private:
   virtual ~UnsafeTrapResultExprImpl() {}
 
   Trap::TrapFnc func_;
   const void* arg_;
 
   DISALLOW_COPY_AND_ASSIGN(UnsafeTrapResultExprImpl);
 };
 
 class IfThenResultExprImpl : public internal::ResultExprImpl {
  public:
   IfThenResultExprImpl(const BoolExpr& cond,
                        const ResultExpr& then_result,
                        const ResultExpr& else_result)
       : cond_(cond), then_result_(then_result), else_result_(else_result) {}
 
   virtual ErrorCode Compile(SandboxBPF* sb) const override {
     return cond_->Compile(
         sb, then_result_->Compile(sb), else_result_->Compile(sb));
   }
 
+  virtual bool HasUnsafeTraps() const override {
+    return then_result_->HasUnsafeTraps() || else_result_->HasUnsafeTraps();
+  }
+
  private:
   virtual ~IfThenResultExprImpl() {}
 
   BoolExpr cond_;
   ResultExpr then_result_;
   ResultExpr else_result_;
 
   DISALLOW_COPY_AND_ASSIGN(IfThenResultExprImpl);
 };
 
@@ skipping 96 matching lines @@
   BoolExpr lhs_;
   BoolExpr rhs_;
 
   DISALLOW_COPY_AND_ASSIGN(OrBoolExprImpl);
 };
 
 }  // namespace
 
 namespace internal {
 
+bool ResultExprImpl::HasUnsafeTraps() const {
+  return false;
+}
+
 uint64_t DefaultMask(size_t size) {
   switch (size) {
     case 4:
       return std::numeric_limits<uint32_t>::max();
     case 8:
       return std::numeric_limits<uint64_t>::max();
     default:
       CHECK(false) << "Unimplemented DefaultMask case";
       return 0;
   }
@@ skipping 107 matching lines @@
 
 ErrorCode SandboxBPFDSLPolicy::EvaluateSyscall(SandboxBPF* sb,
                                                int sysno) const {
   return EvaluateSyscall(sysno)->Compile(sb);
 }
 
 ErrorCode SandboxBPFDSLPolicy::InvalidSyscall(SandboxBPF* sb) const {
   return InvalidSyscall()->Compile(sb);
 }
 
+bool SandboxBPFDSLPolicy::HasUnsafeTraps() const {
+  for (SyscallIterator iter(false); !iter.Done();) {
+    uint32_t sysnum = iter.Next();
+    if (SyscallIterator::IsValid(sysnum) &&
+        EvaluateSyscall(sysnum)->HasUnsafeTraps()) {
+      return true;
+    }
+  }
+  return InvalidSyscall()->HasUnsafeTraps();
+}
+
 ResultExpr SandboxBPFDSLPolicy::Trap(Trap::TrapFnc trap_func, const void* aux) {
   return bpf_dsl::Trap(trap_func, aux);
 }
 
 }  // namespace bpf_dsl
 }  // namespace sandbox