Apply an initial seccomp filter policy for Pepper Flash.

content/common/sandbox_init_linux.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/public/common/sandbox_init.h"
 
 #if defined(OS_LINUX) && defined(__x86_64__)
 
 #include <asm/unistd.h>
 #include <errno.h>
@@ skipping 176 matching lines @@
   EmitAllowSyscall(__NR_dup, program);
   EmitAllowSyscall(__NR_mlock, program);
   EmitAllowSyscall(__NR_munlock, program);
   EmitAllowSyscall(__NR_exit, program);
   EmitAllowSyscall(__NR_exit_group, program);
 
   EmitFailSyscall(__NR_open, ENOENT, program);
   EmitFailSyscall(__NR_access, ENOENT, program);
 }
 
+static void ApplyFlashPolicy(std::vector<struct sock_filter>* program) {
+  // "Hot" syscalls go first.
+  EmitAllowSyscall(__NR_futex, program);
+  EmitAllowSyscall(__NR_write, program);
+  EmitAllowSyscall(__NR_epoll_wait, program);
+  EmitAllowSyscall(__NR_read, program);
+  EmitAllowSyscall(__NR_times, program);
+
+  // Less hot syscalls.
+  EmitAllowSyscall(__NR_clone, program);
+  EmitAllowSyscall(__NR_set_robust_list, program);
+  EmitAllowSyscall(__NR_getuid, program);
+  EmitAllowSyscall(__NR_geteuid, program);
+  EmitAllowSyscall(__NR_getgid, program);
+  EmitAllowSyscall(__NR_getegid, program);
+  EmitAllowSyscall(__NR_epoll_create, program);
+  EmitAllowSyscall(__NR_fcntl, program);
+  EmitAllowSyscall(__NR_socketpair, program);
+  EmitAllowSyscall(__NR_pipe, program);
+  EmitAllowSyscall(__NR_epoll_ctl, program);
+  EmitAllowSyscall(__NR_gettid, program);
+  EmitAllowSyscall(__NR_prctl, program);
+  EmitAllowSyscall(__NR_fstat, program);
+  EmitAllowSyscall(__NR_sendmsg, program);
+  EmitAllowSyscall(__NR_mmap, program);
+  EmitAllowSyscall(__NR_munmap, program);
+  EmitAllowSyscall(__NR_mprotect, program);
+  EmitAllowSyscall(__NR_madvise, program);
+  EmitAllowSyscall(__NR_rt_sigaction, program);
+  EmitAllowSyscall(__NR_rt_sigprocmask, program);
+  EmitAllowSyscall(__NR_wait4, program);
+  EmitAllowSyscall(__NR_exit_group, program);
+  EmitAllowSyscall(__NR_exit, program);
+  EmitAllowSyscall(__NR_rt_sigreturn, program);
+  EmitAllowSyscall(__NR_restart_syscall, program);
+  EmitAllowSyscall(__NR_close, program);
+  EmitAllowSyscall(__NR_recvmsg, program);
+  EmitAllowSyscall(__NR_lseek, program);
+  EmitAllowSyscall(__NR_brk, program);
+  EmitAllowSyscall(__NR_sched_yield, program);
+
+  // These are under investigation, and hopefully not here for the long term.
+  EmitAllowSyscall(__NR_shmctl, program);
+  EmitAllowSyscall(__NR_shmat, program);
+  EmitAllowSyscall(__NR_shmdt, program);
+
+  EmitFailSyscall(__NR_open, ENOENT, program);
+  EmitFailSyscall(__NR_execve, ENOENT, program);
+  EmitFailSyscall(__NR_access, ENOENT, program);
+}
+
 static bool CanUseSeccompFilters() {
   int ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, 0, 0, 0);
   if (ret != 0 && errno == EFAULT)
     return true;
   return false;
 }
 
 static void InstallFilter(const std::vector<struct sock_filter>& program) {
   int ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
   PLOG_IF(FATAL, ret != 0) << "prctl(PR_SET_NO_NEW_PRIVS) failed";
 
   struct sock_fprog fprog;
   fprog.len = program.size();
   fprog.filter = const_cast<struct sock_filter*>(&program[0]);
 
   ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &fprog, 0, 0);
   PLOG_IF(FATAL, ret != 0) << "Failed to install filter.";
 }
 
 }  // anonymous namespace
 
 namespace content {
 
 void InitializeSandbox() {
   const CommandLine& command_line = *CommandLine::ForCurrentProcess();
-  if (command_line.HasSwitch(switches::kNoSandbox))
+  if (command_line.HasSwitch(switches::kNoSandbox) ||
+      command_line.HasSwitch(switches::kDisableSeccompFilterSandbox))
     return;
 
   std::string process_type =
       command_line.GetSwitchValueASCII(switches::kProcessType);
   if (process_type == switches::kGpuProcess &&
       command_line.HasSwitch(switches::kDisableGpuSandbox))
     return;
 
   if (!CanUseSeccompFilters())
     return;
 
   CheckSingleThreaded();
 
   std::vector<struct sock_filter> program;
   EmitPreamble(&program);
 
   if (process_type == switches::kGpuProcess) {
     ApplyGPUPolicy(&program);
+  } else if (process_type == switches::kPpapiPluginProcess) {
+    ApplyFlashPolicy(&program);
   } else {
     NOTREACHED();
   }
 
   EmitTrap(&program);
 
   InstallSIGSYSHandler();
   InstallFilter(program);
 }
 
 }  // namespace content
 
 #else
 
 namespace content {
 
 void InitializeSandbox() {
 }
 
 }  // namespace content
 
 #endif