sandbox: sandbox_linux_unittests enforces TSYNC on ChromeOS

sandbox: sandbox_linux_unittests enforces TSYNC on ChromeOS

Make Seccomp-bpf tsync support mandatory on ChromeOS now
that all kernels support it.

BUG=
TEST=ChromeOS trybots

Committed: https://crrev.com/d6b6dcb15f0d15d65de1decbb165afb427d570a8
Cr-Commit-Position: refs/heads/master@{#306673}

[leecam, 2014-11-26 22:05:38]

leecam@chromium.org changed reviewers:
+ jorgelo@chromium.org

[leecam, 2014-11-26 22:05:55]

PTAL

[leecam, 2014-11-26 22:08:49]

keescook: Hey Kees, Jorge and I would like to make tsync support for ChromeOS
mandatory.
We have tried this against the trybots with different kernel variants. Is our
assumption that all the boards now have tsync correct?

[Jorge Lucangeli Obes, 2014-11-26 22:12:03]

On 2014/11/26 22:08:49, leecam wrote:
> keescook: Hey Kees, Jorge and I would like to make tsync support for ChromeOS
> mandatory.
> We have tried this against the trybots with different kernel variants. Is our
> assumption that all the boards now have tsync correct?

Also, the plan is to land this next week to be able to quickly revert if
something goes wrong.

[Kees Cook, 2014-11-26 22:13:54]

keescook@chromium.org changed reviewers:
+ keescook@chromium.org

[Kees Cook, 2014-11-26 22:13:55]

lgtm

All the Chrome OS kernels should have tsync now, so yeah, go for it!

[jln (very slow on Chromium), 2014-11-26 22:22:32]

jln@chromium.org changed reviewers:
+ jln@chromium.org

[jln (very slow on Chromium), 2014-11-26 22:22:33]

https://codereview.chromium.org/759343002/diff/1/sandbox/linux/bpf_dsl/bpf_ds...
File sandbox/linux/bpf_dsl/bpf_dsl_more_unittest.cc (right):

https://codereview.chromium.org/759343002/diff/1/sandbox/linux/bpf_dsl/bpf_ds...
sandbox/linux/bpf_dsl/bpf_dsl_more_unittest.cc:2271:
SandboxBPF::SupportsSeccompThreadFilterSynchronization();
This is a very outdated API, you should re-sync :)

https://codereview.chromium.org/759343002/diff/1/sandbox/linux/bpf_dsl/bpf_ds...
sandbox/linux/bpf_dsl/bpf_dsl_more_unittest.cc:2272: #if defined(OS_CHROMEOS)
This won't work unfortunately.

OS_CHROMEOS is just a type of build, that we run on Linux machines currently on
the WF.

We could ask infra to make sure that they're all running Trusty with updated
kernels, but that will take a little bit.

[leecam, 2014-12-03 17:01:32]

Ok how about this...

I ran this change on a few ChromeOS bots and all green there too.

[Jorge Lucangeli Obes, 2014-12-03 17:19:38]

Two comment nits. Have you ran enough trybots to cover all kernels?

https://codereview.chromium.org/759343002/diff/40001/sandbox/linux/bpf_dsl/bp...
File sandbox/linux/bpf_dsl/bpf_dsl_more_unittest.cc (right):

https://codereview.chromium.org/759343002/diff/40001/sandbox/linux/bpf_dsl/bp...
sandbox/linux/bpf_dsl/bpf_dsl_more_unittest.cc:2259: // On ChromeOS tsync is
mandatory.
Nit: "Chrome OS" with a space.

https://codereview.chromium.org/759343002/diff/40001/sandbox/linux/bpf_dsl/bp...
sandbox/linux/bpf_dsl/bpf_dsl_more_unittest.cc:2264: // else a ChromeOS build
not running on a ChromeOS device e.g. chrome bots.
Same nit, and you probably want to capitalize Chrome.

[leecam, 2014-12-03 17:25:23]

https://codereview.chromium.org/759343002/diff/40001/sandbox/linux/bpf_dsl/bp...
File sandbox/linux/bpf_dsl/bpf_dsl_more_unittest.cc (right):

https://codereview.chromium.org/759343002/diff/40001/sandbox/linux/bpf_dsl/bp...
sandbox/linux/bpf_dsl/bpf_dsl_more_unittest.cc:2259: // On ChromeOS tsync is
mandatory.
On 2014/12/03 17:19:38, Jorge Lucangeli Obes wrote:
> Nit: "Chrome OS" with a space.

Done.

https://codereview.chromium.org/759343002/diff/40001/sandbox/linux/bpf_dsl/bp...
sandbox/linux/bpf_dsl/bpf_dsl_more_unittest.cc:2264: // else a ChromeOS build
not running on a ChromeOS device e.g. chrome bots.
On 2014/12/03 17:19:38, Jorge Lucangeli Obes wrote:
> Same nit, and you probably want to capitalize Chrome.

Done.

[Jorge Lucangeli Obes, 2014-12-03 17:28:35]

lgtm, assuming trybot coverage on all kernel versions.

[leecam, 2014-12-03 17:30:33]

On 2014/12/03 17:19:38, Jorge Lucangeli Obes wrote:
> Two comment nits. Have you ran enough trybots to cover all kernels?
I've just set the full set of bots off again. x86 is all green and ran all the
tests, some bots didnt run the full tests.
Will report back in few hours

> 
>
https://codereview.chromium.org/759343002/diff/40001/sandbox/linux/bpf_dsl/bp...
> File sandbox/linux/bpf_dsl/bpf_dsl_more_unittest.cc (right):
> 
>
https://codereview.chromium.org/759343002/diff/40001/sandbox/linux/bpf_dsl/bp...
> sandbox/linux/bpf_dsl/bpf_dsl_more_unittest.cc:2259: // On ChromeOS tsync is
> mandatory.
> Nit: "Chrome OS" with a space.
> 
>
https://codereview.chromium.org/759343002/diff/40001/sandbox/linux/bpf_dsl/bp...
> sandbox/linux/bpf_dsl/bpf_dsl_more_unittest.cc:2264: // else a ChromeOS build
> not running on a ChromeOS device e.g. chrome bots.
> Same nit, and you probably want to capitalize Chrome.

[leecam, 2014-12-03 20:53:24]

The CQ bit was checked by leecam@chromium.org

[commit-bot: I haz the power, 2014-12-03 20:54:23]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/759343002/60001

[commit-bot: I haz the power, 2014-12-03 20:57:04]

Committed patchset #4 (id:60001)

[commit-bot: I haz the power, 2014-12-03 20:57:53]

Patchset 4 (id:??) landed as
https://crrev.com/d6b6dcb15f0d15d65de1decbb165afb427d570a8
Cr-Commit-Position: refs/heads/master@{#306673}