Apply an initial seccomp filter policy for Pepper Flash.

content/common/sandbox_init_linux.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/public/common/sandbox_init.h"
 
 #if defined(OS_LINUX) && defined(__x86_64__)
 
 #include <asm/unistd.h>
 #include <errno.h>
@@ skipping 176 matching lines @@
   EmitAllowSyscall(__NR_dup, program);
   EmitAllowSyscall(__NR_mlock, program);
   EmitAllowSyscall(__NR_munlock, program);
   EmitAllowSyscall(__NR_exit, program);
   EmitAllowSyscall(__NR_exit_group, program);
 
   EmitFailSyscall(__NR_open, ENOENT, program);
   EmitFailSyscall(__NR_access, ENOENT, program);
 }
 
+static void ApplyFlashPolicy(std::vector<struct sock_filter>* program) {
+  // "Hot" syscalls go first.
+  EmitAllowSyscall(__NR_futex, program);
+  EmitAllowSyscall(__NR_write, program);
+  EmitAllowSyscall(__NR_epoll_wait, program);
+  EmitAllowSyscall(__NR_read, program);
+  EmitAllowSyscall(__NR_times, program);
+
+  // Less hot syscalls.
+  EmitAllowSyscall(__NR_clone, program);
+  EmitAllowSyscall(__NR_set_robust_list, program);
+  EmitAllowSyscall(__NR_getuid, program);
+  EmitAllowSyscall(__NR_geteuid, program);
+  EmitAllowSyscall(__NR_getgid, program);
+  EmitAllowSyscall(__NR_getegid, program);
+  EmitAllowSyscall(__NR_epoll_create, program);
+  EmitAllowSyscall(__NR_fcntl, program);
+  EmitAllowSyscall(__NR_socketpair, program);
+  EmitAllowSyscall(__NR_pipe, program);
+  EmitAllowSyscall(__NR_epoll_ctl, program);
+  EmitAllowSyscall(__NR_gettid, program);
+  EmitAllowSyscall(__NR_prctl, program);
+  EmitAllowSyscall(__NR_fstat, program);
+  EmitAllowSyscall(__NR_sendmsg, program);
+  EmitAllowSyscall(__NR_mmap, program);
+  EmitAllowSyscall(__NR_munmap, program);
+  EmitAllowSyscall(__NR_mprotect, program);
+  EmitAllowSyscall(__NR_madvise, program);
+  EmitAllowSyscall(__NR_rt_sigaction, program);
+  EmitAllowSyscall(__NR_rt_sigprocmask, program);
+  EmitAllowSyscall(__NR_wait4, program);
+  EmitAllowSyscall(__NR_exit_group, program);
+  EmitAllowSyscall(__NR_exit, program);
+  EmitAllowSyscall(__NR_rt_sigreturn, program);
+  EmitAllowSyscall(__NR_restart_syscall, program);
+  EmitAllowSyscall(__NR_close, program);
+  EmitAllowSyscall(__NR_recvmsg, program);
+  EmitAllowSyscall(__NR_lseek, program);
+  EmitAllowSyscall(__NR_brk, program);
+  EmitAllowSyscall(__NR_sched_yield, program);
+
+  // These are under investigation, and hopefully not here for the long term.

[Markus (顧孟勤), 2012/04/16 22:09:23]

SysV shared memory is really broken and dangerous as it can probably be used to
screenscrape renderers. I have an implementation in my code, that allows
restricting this system call. But it is unfortunately quite complicated. I wish
we could get kernel support.

For now, I don't have any problem with you checking in your code as is, since it
is strictly an improvement over what we had before. But in the long-run, we do
need a better solution.

+  EmitAllowSyscall(__NR_shmctl, program);
+  EmitAllowSyscall(__NR_shmat, program);
+  EmitAllowSyscall(__NR_shmdt, program);
+
+  EmitFailSyscall(__NR_open, ENOENT, program);

[Markus (顧孟勤), 2012/04/16 22:09:23]

Why do you need to explicitly fail some system calls. Wouldn't they fail,
because of a default policy that denies all system calls that aren't explicitly
whitelisted?

And I assume, this probably breaks some Flash features, doesn't it? Things like
accessing the microphone and camera would spring to mind. Or maybe, storing
persistent Flash cookies.

[Kees Cook, 2012/04/16 22:13:35]

AIUI, the difference here is between "Fail" and "Kill". Unlisted syscalls kill
the process, but these syscalls are used for no good reason, and can just be
denied instead of doing a full kill.

+  EmitFailSyscall(__NR_execve, ENOENT, program);
+  EmitFailSyscall(__NR_access, ENOENT, program);
+}
+
 static bool CanUseSeccompFilters() {
   int ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, 0, 0, 0);
   if (ret != 0 && errno == EFAULT)
     return true;
   return false;
 }
 
 static void InstallFilter(const std::vector<struct sock_filter>& program) {
   int ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
   PLOG_IF(FATAL, ret != 0) << "prctl(PR_SET_NO_NEW_PRIVS) failed";
@@ skipping 24 matching lines @@
   if (!CanUseSeccompFilters())
     return;
 
   CheckSingleThreaded();
 
   std::vector<struct sock_filter> program;
   EmitPreamble(&program);
 
   if (process_type == switches::kGpuProcess) {
     ApplyGPUPolicy(&program);
+  } else if (process_type == switches::kPpapiPluginProcess) {
+    ApplyFlashPolicy(&program);
   } else {
     NOTREACHED();
   }
 
   EmitTrap(&program);
 
   InstallSIGSYSHandler();
   InstallFilter(program);
 }
 
 }  // namespace content
 
 #else
 
 namespace content {
 
 void InitializeSandbox() {
 }
 
 }  // namespace content
 
 #endif