OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "sandbox/linux/bpf_dsl/bpf_dsl.h" | 5 #include "sandbox/linux/bpf_dsl/bpf_dsl.h" |
6 | 6 |
7 #include <errno.h> | 7 #include <errno.h> |
8 #include <fcntl.h> | 8 #include <fcntl.h> |
9 #include <pthread.h> | 9 #include <pthread.h> |
10 #include <sched.h> | 10 #include <sched.h> |
(...skipping 634 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
645 setenv(kSandboxDebuggingEnv, "t", 0); | 645 setenv(kSandboxDebuggingEnv, "t", 0); |
646 Die::SuppressInfoMessages(true); | 646 Die::SuppressInfoMessages(true); |
647 | 647 |
648 // Some system calls must always be allowed, if our policy wants to make | 648 // Some system calls must always be allowed, if our policy wants to make |
649 // use of UnsafeTrap() | 649 // use of UnsafeTrap() |
650 if (SandboxBPF::IsRequiredForUnsafeTrap(sysno)) | 650 if (SandboxBPF::IsRequiredForUnsafeTrap(sysno)) |
651 return Allow(); | 651 return Allow(); |
652 return UnsafeTrap(AllowRedirectedSyscall, NULL); | 652 return UnsafeTrap(AllowRedirectedSyscall, NULL); |
653 } | 653 } |
654 | 654 |
655 #if !defined(ADDRESS_SANITIZER) | |
656 // ASan does not allow changing the signal handler for SIGBUS, and treats it as | |
657 // a fatal signal. | |
658 | |
659 int bus_handler_fd_ = -1; | 655 int bus_handler_fd_ = -1; |
660 | 656 |
661 void SigBusHandler(int, siginfo_t* info, void* void_context) { | 657 void SigBusHandler(int, siginfo_t* info, void* void_context) { |
662 BPF_ASSERT(write(bus_handler_fd_, "\x55", 1) == 1); | 658 BPF_ASSERT(write(bus_handler_fd_, "\x55", 1) == 1); |
663 } | 659 } |
664 | 660 |
665 BPF_TEST_C(SandboxBPF, SigBus, RedirectAllSyscallsPolicy) { | 661 BPF_TEST_C(SandboxBPF, SigBus, RedirectAllSyscallsPolicy) { |
666 // We use the SIGBUS bit in the signal mask as a thread-local boolean | 662 // We use the SIGBUS bit in the signal mask as a thread-local boolean |
667 // value in the implementation of UnsafeTrap(). This is obviously a bit | 663 // value in the implementation of UnsafeTrap(). This is obviously a bit |
668 // of a hack that could conceivably interfere with code that uses SIGBUS | 664 // of a hack that could conceivably interfere with code that uses SIGBUS |
669 // in more traditional ways. This test verifies that basic functionality | 665 // in more traditional ways. This test verifies that basic functionality |
670 // of SIGBUS is not impacted, but it is certainly possibly to construe | 666 // of SIGBUS is not impacted, but it is certainly possibly to construe |
671 // more complex uses of signals where our use of the SIGBUS mask is not | 667 // more complex uses of signals where our use of the SIGBUS mask is not |
672 // 100% transparent. This is expected behavior. | 668 // 100% transparent. This is expected behavior. |
673 int fds[2]; | 669 int fds[2]; |
674 BPF_ASSERT(socketpair(AF_UNIX, SOCK_STREAM, 0, fds) == 0); | 670 BPF_ASSERT(socketpair(AF_UNIX, SOCK_STREAM, 0, fds) == 0); |
675 bus_handler_fd_ = fds[1]; | 671 bus_handler_fd_ = fds[1]; |
676 struct sigaction sa = {}; | 672 struct sigaction sa = {}; |
677 sa.sa_sigaction = SigBusHandler; | 673 sa.sa_sigaction = SigBusHandler; |
678 sa.sa_flags = SA_SIGINFO; | 674 sa.sa_flags = SA_SIGINFO; |
679 BPF_ASSERT(sigaction(SIGBUS, &sa, NULL) == 0); | 675 BPF_ASSERT(sigaction(SIGBUS, &sa, NULL) == 0); |
680 raise(SIGBUS); | 676 raise(SIGBUS); |
681 char c = '\000'; | 677 char c = '\000'; |
682 BPF_ASSERT(read(fds[0], &c, 1) == 1); | 678 BPF_ASSERT(read(fds[0], &c, 1) == 1); |
683 BPF_ASSERT(close(fds[0]) == 0); | 679 BPF_ASSERT(close(fds[0]) == 0); |
684 BPF_ASSERT(close(fds[1]) == 0); | 680 BPF_ASSERT(close(fds[1]) == 0); |
685 BPF_ASSERT(c == 0x55); | 681 BPF_ASSERT(c == 0x55); |
686 } | 682 } |
687 #endif // !defined(ADDRESS_SANITIZER) | |
688 | 683 |
689 BPF_TEST_C(SandboxBPF, SigMask, RedirectAllSyscallsPolicy) { | 684 BPF_TEST_C(SandboxBPF, SigMask, RedirectAllSyscallsPolicy) { |
690 // Signal masks are potentially tricky to handle. For instance, if we | 685 // Signal masks are potentially tricky to handle. For instance, if we |
691 // ever tried to update them from inside a Trap() or UnsafeTrap() handler, | 686 // ever tried to update them from inside a Trap() or UnsafeTrap() handler, |
692 // the call to sigreturn() at the end of the signal handler would undo | 687 // the call to sigreturn() at the end of the signal handler would undo |
693 // all of our efforts. So, it makes sense to test that sigprocmask() | 688 // all of our efforts. So, it makes sense to test that sigprocmask() |
694 // works, even if we have a policy in place that makes use of UnsafeTrap(). | 689 // works, even if we have a policy in place that makes use of UnsafeTrap(). |
695 // In practice, this works because we force sigprocmask() to be handled | 690 // In practice, this works because we force sigprocmask() to be handled |
696 // entirely in the kernel. | 691 // entirely in the kernel. |
697 sigset_t mask0, mask1, mask2; | 692 sigset_t mask0, mask1, mask2; |
(...skipping 1695 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
2393 BPF_ASSERT_EQ(ENOSYS, errno); | 2388 BPF_ASSERT_EQ(ENOSYS, errno); |
2394 | 2389 |
2395 BPF_ASSERT_EQ(-1, syscall(__NR_setgid, 300)); | 2390 BPF_ASSERT_EQ(-1, syscall(__NR_setgid, 300)); |
2396 BPF_ASSERT_EQ(EPERM, errno); | 2391 BPF_ASSERT_EQ(EPERM, errno); |
2397 } | 2392 } |
2398 | 2393 |
2399 } // namespace | 2394 } // namespace |
2400 | 2395 |
2401 } // namespace bpf_dsl | 2396 } // namespace bpf_dsl |
2402 } // namespace sandbox | 2397 } // namespace sandbox |
OLD | NEW |