Linux sandbox: Tighten up the NaCl sandbox policy.

components/nacl/loader/sandbox_linux/nacl_bpf_sandbox_linux.cc

Index: components/nacl/loader/sandbox_linux/nacl_bpf_sandbox_linux.cc
diff --git a/components/nacl/loader/sandbox_linux/nacl_bpf_sandbox_linux.cc b/components/nacl/loader/sandbox_linux/nacl_bpf_sandbox_linux.cc
index a1449cf42ed721eb9220c2cec05bfd143c81e77d..67b48003eee21c600888a8e035b696ab4020f6e3 100644
--- a/components/nacl/loader/sandbox_linux/nacl_bpf_sandbox_linux.cc
+++ b/components/nacl/loader/sandbox_linux/nacl_bpf_sandbox_linux.cc
@@ -53,18 +53,6 @@ class NaClBPFSandboxPolicy : public sandbox::bpf_dsl::SandboxBPFDSLPolicy {
 ResultExpr NaClBPFSandboxPolicy::EvaluateSyscall(int sysno) const {
   DCHECK(baseline_policy_);
   switch (sysno) {
-    // TODO(jln): NaCl's GDB debug stub uses the following socket system calls,
-    // see if it can be restricted a bit.
-#if defined(__x86_64__) || defined(__arm__) || defined(__mips__)
-    // transport_common.cc needs this.
-    case __NR_accept:

[Mark Seaborn, 2014/10/21 22:08:40]

Could we conditionalise these based on whether the GDB debug stub is enabled?

[rickyz (no longer on Chrome), 2014/10/22 03:25:05]

Yeah, this sounds like a better approach, done.

-    case __NR_setsockopt:
-#elif defined(__i386__)
-    case __NR_socketcall:
-#endif
-    // trusted/service_runtime/linux/thread_suspension.c needs sigwait() and is

[Mark Seaborn, 2014/10/21 22:08:40]

We may end up using thread suspension outside of the debug stub.  e.g. For
dynamic code unloading (see
https://code.google.com/p/nativeclient/issues/detail?id=2817).

[rickyz (no longer on Chrome), 2014/10/22 03:25:05]

Ah, good to know - I left this one enabled by default, even when the debug stub
is not enabled.

-    // used by NaCl's GDB debug stub.
-    case __NR_rt_sigtimedwait:
 #if defined(__i386__) || defined(__mips__)
     // Needed on i386 to set-up the custom segments.
     case __NR_modify_ldt: