OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "sandbox/linux/bpf_dsl/bpf_dsl.h" | 5 #include "sandbox/linux/bpf_dsl/bpf_dsl.h" |
6 | 6 |
7 #include <errno.h> | 7 #include <errno.h> |
8 #include <fcntl.h> | 8 #include <fcntl.h> |
9 #include <pthread.h> | 9 #include <pthread.h> |
10 #include <sched.h> | 10 #include <sched.h> |
(...skipping 635 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
646 setenv(kSandboxDebuggingEnv, "t", 0); | 646 setenv(kSandboxDebuggingEnv, "t", 0); |
647 Die::SuppressInfoMessages(true); | 647 Die::SuppressInfoMessages(true); |
648 | 648 |
649 // Some system calls must always be allowed, if our policy wants to make | 649 // Some system calls must always be allowed, if our policy wants to make |
650 // use of UnsafeTrap() | 650 // use of UnsafeTrap() |
651 if (SandboxBPF::IsRequiredForUnsafeTrap(sysno)) | 651 if (SandboxBPF::IsRequiredForUnsafeTrap(sysno)) |
652 return Allow(); | 652 return Allow(); |
653 return UnsafeTrap(AllowRedirectedSyscall, NULL); | 653 return UnsafeTrap(AllowRedirectedSyscall, NULL); |
654 } | 654 } |
655 | 655 |
| 656 #if !defined(ADDRESS_SANITIZER) |
| 657 // ASan does not allow changing the signal handler for SIGBUS, and treats it as |
| 658 // a fatal signal. |
| 659 |
656 int bus_handler_fd_ = -1; | 660 int bus_handler_fd_ = -1; |
657 | 661 |
658 void SigBusHandler(int, siginfo_t* info, void* void_context) { | 662 void SigBusHandler(int, siginfo_t* info, void* void_context) { |
659 BPF_ASSERT(write(bus_handler_fd_, "\x55", 1) == 1); | 663 BPF_ASSERT(write(bus_handler_fd_, "\x55", 1) == 1); |
660 } | 664 } |
661 | 665 |
662 BPF_TEST_C(SandboxBPF, SigBus, RedirectAllSyscallsPolicy) { | 666 BPF_TEST_C(SandboxBPF, SigBus, RedirectAllSyscallsPolicy) { |
663 // We use the SIGBUS bit in the signal mask as a thread-local boolean | 667 // We use the SIGBUS bit in the signal mask as a thread-local boolean |
664 // value in the implementation of UnsafeTrap(). This is obviously a bit | 668 // value in the implementation of UnsafeTrap(). This is obviously a bit |
665 // of a hack that could conceivably interfere with code that uses SIGBUS | 669 // of a hack that could conceivably interfere with code that uses SIGBUS |
666 // in more traditional ways. This test verifies that basic functionality | 670 // in more traditional ways. This test verifies that basic functionality |
667 // of SIGBUS is not impacted, but it is certainly possibly to construe | 671 // of SIGBUS is not impacted, but it is certainly possibly to construe |
668 // more complex uses of signals where our use of the SIGBUS mask is not | 672 // more complex uses of signals where our use of the SIGBUS mask is not |
669 // 100% transparent. This is expected behavior. | 673 // 100% transparent. This is expected behavior. |
670 int fds[2]; | 674 int fds[2]; |
671 BPF_ASSERT(socketpair(AF_UNIX, SOCK_STREAM, 0, fds) == 0); | 675 BPF_ASSERT(socketpair(AF_UNIX, SOCK_STREAM, 0, fds) == 0); |
672 bus_handler_fd_ = fds[1]; | 676 bus_handler_fd_ = fds[1]; |
673 struct sigaction sa = {}; | 677 struct sigaction sa = {}; |
674 sa.sa_sigaction = SigBusHandler; | 678 sa.sa_sigaction = SigBusHandler; |
675 sa.sa_flags = SA_SIGINFO; | 679 sa.sa_flags = SA_SIGINFO; |
676 BPF_ASSERT(sigaction(SIGBUS, &sa, NULL) == 0); | 680 BPF_ASSERT(sigaction(SIGBUS, &sa, NULL) == 0); |
677 raise(SIGBUS); | 681 raise(SIGBUS); |
678 char c = '\000'; | 682 char c = '\000'; |
679 BPF_ASSERT(read(fds[0], &c, 1) == 1); | 683 BPF_ASSERT(read(fds[0], &c, 1) == 1); |
680 BPF_ASSERT(close(fds[0]) == 0); | 684 BPF_ASSERT(close(fds[0]) == 0); |
681 BPF_ASSERT(close(fds[1]) == 0); | 685 BPF_ASSERT(close(fds[1]) == 0); |
682 BPF_ASSERT(c == 0x55); | 686 BPF_ASSERT(c == 0x55); |
683 } | 687 } |
| 688 #endif // !defined(ADDRESS_SANITIZER) |
684 | 689 |
685 BPF_TEST_C(SandboxBPF, SigMask, RedirectAllSyscallsPolicy) { | 690 BPF_TEST_C(SandboxBPF, SigMask, RedirectAllSyscallsPolicy) { |
686 // Signal masks are potentially tricky to handle. For instance, if we | 691 // Signal masks are potentially tricky to handle. For instance, if we |
687 // ever tried to update them from inside a Trap() or UnsafeTrap() handler, | 692 // ever tried to update them from inside a Trap() or UnsafeTrap() handler, |
688 // the call to sigreturn() at the end of the signal handler would undo | 693 // the call to sigreturn() at the end of the signal handler would undo |
689 // all of our efforts. So, it makes sense to test that sigprocmask() | 694 // all of our efforts. So, it makes sense to test that sigprocmask() |
690 // works, even if we have a policy in place that makes use of UnsafeTrap(). | 695 // works, even if we have a policy in place that makes use of UnsafeTrap(). |
691 // In practice, this works because we force sigprocmask() to be handled | 696 // In practice, this works because we force sigprocmask() to be handled |
692 // entirely in the kernel. | 697 // entirely in the kernel. |
693 sigset_t mask0, mask1, mask2; | 698 sigset_t mask0, mask1, mask2; |
(...skipping 1696 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
2390 BPF_ASSERT_EQ(ENOSYS, errno); | 2395 BPF_ASSERT_EQ(ENOSYS, errno); |
2391 | 2396 |
2392 BPF_ASSERT_EQ(-1, syscall(__NR_setgid, 300)); | 2397 BPF_ASSERT_EQ(-1, syscall(__NR_setgid, 300)); |
2393 BPF_ASSERT_EQ(EPERM, errno); | 2398 BPF_ASSERT_EQ(EPERM, errno); |
2394 } | 2399 } |
2395 | 2400 |
2396 } // namespace | 2401 } // namespace |
2397 | 2402 |
2398 } // namespace bpf_dsl | 2403 } // namespace bpf_dsl |
2399 } // namespace sandbox | 2404 } // namespace sandbox |
OLD | NEW |