Linux sandbox: Tighten up the NaCl sandbox policy.

components/nacl/loader/sandbox_linux/nacl_bpf_sandbox_linux.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "components/nacl/loader/sandbox_linux/nacl_bpf_sandbox_linux.h"
 
 #include "build/build_config.h"
 
 #if defined(USE_SECCOMP_BPF)
 
@@ skipping 35 matching lines @@
 
  private:
   scoped_ptr<sandbox::bpf_dsl::SandboxBPFDSLPolicy> baseline_policy_;
 
   DISALLOW_COPY_AND_ASSIGN(NaClBPFSandboxPolicy);
 };
 
 ResultExpr NaClBPFSandboxPolicy::EvaluateSyscall(int sysno) const {
   DCHECK(baseline_policy_);
   switch (sysno) {
-    // TODO(jln): NaCl's GDB debug stub uses the following socket system calls,
-    // see if it can be restricted a bit.
-#if defined(__x86_64__) || defined(__arm__) || defined(__mips__)
-    // transport_common.cc needs this.
-    case __NR_accept:

[Mark Seaborn, 2014/10/21 22:08:40]

Could we conditionalise these based on whether the GDB debug stub is enabled?

[rickyz (no longer on Chrome), 2014/10/22 03:25:05]

Yeah, this sounds like a better approach, done.

-    case __NR_setsockopt:
-#elif defined(__i386__)
-    case __NR_socketcall:
-#endif
-    // trusted/service_runtime/linux/thread_suspension.c needs sigwait() and is

[Mark Seaborn, 2014/10/21 22:08:40]

We may end up using thread suspension outside of the debug stub.  e.g. For
dynamic code unloading (see
https://code.google.com/p/nativeclient/issues/detail?id=2817).

[rickyz (no longer on Chrome), 2014/10/22 03:25:05]

Ah, good to know - I left this one enabled by default, even when the debug stub
is not enabled.

-    // used by NaCl's GDB debug stub.
-    case __NR_rt_sigtimedwait:
 #if defined(__i386__) || defined(__mips__)
     // Needed on i386 to set-up the custom segments.
     case __NR_modify_ldt:
 #endif
     // NaClAddrSpaceBeforeAlloc needs prlimit64.
     case __NR_prlimit64:
     // NaCl uses custom signal stacks.
     case __NR_sigaltstack:
     // Below is fairly similar to the policy for a Chromium renderer.
 #if defined(__i386__) || defined(__x86_64__) || defined(__mips__)
@@ skipping 56 matching lines @@
           new NaClBPFSandboxPolicy));
   if (sandbox_is_initialized) {
     RunSandboxSanityChecks();
     return true;
   }
 #endif  // defined(USE_SECCOMP_BPF)
   return false;
 }
 
 }  // namespace nacl