Sandbox policy fixes for all known remaining issues.

content/common/sandbox_init_linux.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/public/common/sandbox_init.h"
 
 #if defined(OS_LINUX) && defined(__x86_64__)
 
 #include <asm/unistd.h>
 #include <errno.h>
@@ skipping 164 matching lines @@
 static void EmitFailSyscall(int nr, int err,
                             std::vector<struct sock_filter>* program) {
   EmitJEQJF(nr, 1, program);
   EmitRet(SECCOMP_RET_ERRNO | err, program);
 }
 
 static void EmitTrap(std::vector<struct sock_filter>* program) {
   EmitRet(SECCOMP_RET_TRAP, program);
 }
 
-static void EmitAllowKillSelf(int signal,
-                              std::vector<struct sock_filter>* program) {
-  EmitAllowSyscallArgN(__NR_kill, 2, signal, program);
+static void EmitAllowSignalSelf(std::vector<struct sock_filter>* program) {
+  EmitAllowSyscallArgN(__NR_kill, 1, getpid(), program);
+  EmitAllowSyscallArgN(__NR_tgkill, 1, getpid(), program);
 }
 
 static void EmitAllowGettime(std::vector<struct sock_filter>* program) {
   EmitAllowSyscall(__NR_clock_gettime, program);
   EmitAllowSyscall(__NR_gettimeofday, program);
 }
 
 static void ApplyGPUPolicy(std::vector<struct sock_filter>* program) {
   // "Hot" syscalls go first.
   EmitAllowSyscall(__NR_read, program);
@@ skipping 35 matching lines @@
   EmitAllowSyscall(__NR_rt_sigprocmask, program);
   EmitAllowSyscall(__NR_munmap, program);
   EmitAllowSyscall(__NR_dup, program);
   EmitAllowSyscall(__NR_mlock, program);
   EmitAllowSyscall(__NR_munlock, program);
   EmitAllowSyscall(__NR_exit, program);
   EmitAllowSyscall(__NR_exit_group, program);
   EmitAllowSyscall(__NR_getpid, program);  // Nvidia binary driver.
   EmitAllowSyscall(__NR_getppid, program);  // ATI binary driver.
   EmitAllowSyscall(__NR_lseek, program);  // Nvidia binary driver.
-  EmitAllowKillSelf(SIGTERM, program);  // GPU watchdog.
+  EmitAllowSyscall(__NR_shutdown, program);  // Virtual driver.
+  EmitAllowSyscall(__NR_rt_sigaction, program);  // Breakpad signal handler.
+  EmitAllowSignalSelf(program);  // GPU watchdog.
 
   // Generally, filename-based syscalls will fail with ENOENT to behave
   // similarly to a possible future setuid sandbox.
   EmitFailSyscall(__NR_open, ENOENT, program);
   EmitFailSyscall(__NR_access, ENOENT, program);
   EmitFailSyscall(__NR_mkdir, ENOENT, program);  // Nvidia binary driver.
   EmitFailSyscall(__NR_readlink, ENOENT, program);  // ATI binary driver.
+  EmitFailSyscall(__NR_stat, ENOENT, program);  // Nvidia binary driver.
 }
 
 static void ApplyFlashPolicy(std::vector<struct sock_filter>* program) {
   // "Hot" syscalls go first.
   EmitAllowSyscall(__NR_futex, program);
   EmitAllowSyscall(__NR_write, program);
   EmitAllowSyscall(__NR_epoll_wait, program);
   EmitAllowSyscall(__NR_read, program);
   EmitAllowSyscall(__NR_times, program);
 
   // Less hot syscalls.
   EmitAllowGettime(program);
   EmitAllowSyscall(__NR_clone, program);

[jln (very slow on Chromium), 2012/05/22 00:04:34]

We can't allow clone with EmitAllowSignalSelf I think. I suppose we do need
clone in Flash ?

Should we inspect clone flags, which thankfully we can do ?

   EmitAllowSyscall(__NR_set_robust_list, program);
   EmitAllowSyscall(__NR_getuid, program);
   EmitAllowSyscall(__NR_geteuid, program);
   EmitAllowSyscall(__NR_getgid, program);
   EmitAllowSyscall(__NR_getegid, program);
   EmitAllowSyscall(__NR_epoll_create, program);
   EmitAllowSyscall(__NR_fcntl, program);
   EmitAllowSyscall(__NR_socketpair, program);
   EmitAllowSyscall(__NR_pipe, program);
   EmitAllowSyscall(__NR_epoll_ctl, program);
@@ skipping 10 matching lines @@
   EmitAllowSyscall(__NR_wait4, program);
   EmitAllowSyscall(__NR_exit_group, program);
   EmitAllowSyscall(__NR_exit, program);
   EmitAllowSyscall(__NR_rt_sigreturn, program);
   EmitAllowSyscall(__NR_restart_syscall, program);
   EmitAllowSyscall(__NR_close, program);
   EmitAllowSyscall(__NR_recvmsg, program);
   EmitAllowSyscall(__NR_lseek, program);
   EmitAllowSyscall(__NR_brk, program);
   EmitAllowSyscall(__NR_sched_yield, program);
+  EmitAllowSyscall(__NR_shutdown, program);
+  EmitAllowSyscall(__NR_sched_getaffinity, program);  // 3D
+  EmitAllowSignalSelf(program);
 
   // These are under investigation, and hopefully not here for the long term.
   EmitAllowSyscall(__NR_shmctl, program);
   EmitAllowSyscall(__NR_shmat, program);
   EmitAllowSyscall(__NR_shmdt, program);
 
   EmitFailSyscall(__NR_open, ENOENT, program);
   EmitFailSyscall(__NR_execve, ENOENT, program);
   EmitFailSyscall(__NR_access, ENOENT, program);
 }
@@ skipping 61 matching lines @@
 
 namespace content {
 
 void InitializeSandbox() {
 }
 
 }  // namespace content
 
 #endif