Linux sandbox: Tighten up the NaCl sandbox policy.

components/nacl/loader/sandbox_linux/nacl_bpf_sandbox_linux.cc

Index: components/nacl/loader/sandbox_linux/nacl_bpf_sandbox_linux.cc
diff --git a/components/nacl/loader/sandbox_linux/nacl_bpf_sandbox_linux.cc b/components/nacl/loader/sandbox_linux/nacl_bpf_sandbox_linux.cc
index a1449cf42ed721eb9220c2cec05bfd143c81e77d..0bd10427a4836b23ee736a40a915e281f318e7b9 100644
--- a/components/nacl/loader/sandbox_linux/nacl_bpf_sandbox_linux.cc
+++ b/components/nacl/loader/sandbox_linux/nacl_bpf_sandbox_linux.cc
@@ -11,14 +11,19 @@
 #include <errno.h>
 #include <signal.h>
 #include <sys/ptrace.h>
+#include <sys/types.h>
+#include <unistd.h>
 
 #include "base/basictypes.h"
 #include "base/callback.h"
+#include "base/command_line.h"
 #include "base/compiler_specific.h"
 #include "base/logging.h"
 
+#include "components/nacl/common/nacl_switches.h"
 #include "content/public/common/sandbox_init.h"
 #include "sandbox/linux/bpf_dsl/bpf_dsl.h"
+#include "sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.h"
 #include "sandbox/linux/services/linux_syscalls.h"
 
 #endif  // defined(USE_SECCOMP_BPF)
@@ -36,7 +41,12 @@ using sandbox::bpf_dsl::ResultExpr;
 class NaClBPFSandboxPolicy : public sandbox::bpf_dsl::SandboxBPFDSLPolicy {
  public:
   NaClBPFSandboxPolicy()
-      : baseline_policy_(content::GetBPFSandboxBaselinePolicy()) {}
+      : baseline_policy_(content::GetBPFSandboxBaselinePolicy()) {
+    const base::CommandLine* command_line =
+        base::CommandLine::ForCurrentProcess();
+    enable_nacl_debug_ = command_line->HasSwitch(switches::kEnableNaClDebug);
+    current_pid_ = getpid();

[jln (very slow on Chromium), 2014/10/24 20:38:34]

Nit: how about putting this in the initializer list?

+  }
   virtual ~NaClBPFSandboxPolicy() {}
 
   virtual ResultExpr EvaluateSyscall(int system_call_number) const override;
@@ -46,24 +56,33 @@ class NaClBPFSandboxPolicy : public sandbox::bpf_dsl::SandboxBPFDSLPolicy {
 
  private:
   scoped_ptr<sandbox::bpf_dsl::SandboxBPFDSLPolicy> baseline_policy_;
+  bool enable_nacl_debug_;
+  pid_t current_pid_;

[jln (very slow on Chromium), 2014/10/24 20:38:34]

policy_pid_ to be consistent ?

 
   DISALLOW_COPY_AND_ASSIGN(NaClBPFSandboxPolicy);
 };
 
 ResultExpr NaClBPFSandboxPolicy::EvaluateSyscall(int sysno) const {
   DCHECK(baseline_policy_);
-  switch (sysno) {
-    // TODO(jln): NaCl's GDB debug stub uses the following socket system calls,
-    // see if it can be restricted a bit.
+
+  // NaCl's GDB debug stub uses the following socket system calls. We only
+  // allow then when --enable-nacl-debug is specified.
+  if (enable_nacl_debug_) {
+    switch (sysno) {
 #if defined(__x86_64__) || defined(__arm__) || defined(__mips__)
-    // transport_common.cc needs this.
-    case __NR_accept:
-    case __NR_setsockopt:
+      // transport_common.cc needs this.
+      case __NR_accept:
+      case __NR_setsockopt:
+        return Allow();
 #elif defined(__i386__)
-    case __NR_socketcall:
+      case __NR_socketcall:
+        return Allow();
 #endif

[jln (very slow on Chromium), 2014/10/24 20:48:11]

style: add "default:" with a // Fallthrough comment.

-    // trusted/service_runtime/linux/thread_suspension.c needs sigwait() and is
-    // used by NaCl's GDB debug stub.
+    }
+  }
+
+  switch (sysno) {
+    // trusted/service_runtime/linux/thread_suspension.c needs sigwait()
     case __NR_rt_sigtimedwait:
 #if defined(__i386__) || defined(__mips__)
     // Needed on i386 to set-up the custom segments.
@@ -88,10 +107,6 @@ ResultExpr NaClBPFSandboxPolicy::EvaluateSyscall(int sysno) const {
     case __NR_pwrite64:
     case __NR_sched_get_priority_max:
     case __NR_sched_get_priority_min:
-    case __NR_sched_getaffinity:
-    case __NR_sched_getparam:
-    case __NR_sched_getscheduler:
-    case __NR_sched_setscheduler:
     case __NR_sysinfo:
     // __NR_times needed as clock() is called by CommandBufferHelper, which is
     // used by NaCl applications that use Pepper's 3D interfaces.
@@ -102,6 +117,11 @@ ResultExpr NaClBPFSandboxPolicy::EvaluateSyscall(int sysno) const {
     case __NR_ioctl:
     case __NR_ptrace:
       return Error(EPERM);
+    case __NR_sched_getaffinity:
+    case __NR_sched_getparam:
+    case __NR_sched_getscheduler:
+    case __NR_sched_setscheduler:
+      return sandbox::RestrictSchedTarget(current_pid_, sysno);
     default:
       return baseline_policy_->EvaluateSyscall(sysno);
   }