Initial snapshot of the new BPF-enabled seccomp sandbox. This code is

sandbox/linux/seccomp_bpf/sandbox_bpf.cc

+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "sandbox/linux/seccomp_bpf/sandbox_bpf.h"
+
+// The kernel gives us a sandbox, we turn it into a playground :-)
+// This is version 2 of the playground; version 1 was built on top of
+// pre-BPF seccomp mode.
+namespace playground2 {
+

[Chris Evans, 2012/06/01 22:48:23]

Redundant newline.

[Markus (顧孟勤), 2012/06/01 23:46:33]

Done.

+
+static Sandbox::ErrorCode probeEvaluator(int signo) {
+  switch (signo) {
+  case __NR_getpid:
+    // Return EPERM so that we can check that the filter actually ran.
+    return (Sandbox::ErrorCode)EPERM;
+  case __NR_exit_group:
+    // Allow exit() with a non-default return code.
+    return Sandbox::SB_ALLOWED;
+  default:
+    // Make everything else fail in an easily recognizable way.
+    return (Sandbox::ErrorCode)EINVAL;
+  }
+}
+
+Sandbox::SandboxStatus Sandbox::supportsSeccompSandbox(int proc_fd) {

[Chris Evans, 2012/06/01 22:48:23]

Just wanted to note that this API draws its result from two things: one
stateless and one stateful.
Stateless: does the kernel have the needed support?
Stateful: are there too many threads at _this_ exact moment in time?

I'll cover the consequence in a separate reply / e-mail.

[Markus (顧孟勤), 2012/06/01 23:46:33]

I think, I explained the rationale in my other e-mail. If you think, this is
still unresolved, please let me know.

+  if (status_ == STATUS_UNKNOWN || status_ == STATUS_UNAVAILABLE) {

[Chris Evans, 2012/06/01 22:48:23]

Style issue: these nested ifs are getting harder to read. I'd recommend early
returns? e.g. if (!isSingleThreaded()) return (status_ = STATUS_UNAVAILABLE)
perhaps? Then the subsequent indenting doesn't get crazy. Same for the initial
status check.

[Markus (顧孟勤), 2012/06/01 23:46:33]

Done.

+    if (!isSingleThreaded(proc_fd)) {
+      status_ = STATUS_UNAVAILABLE;
+    } else {
+      sigset_t oldMask, newMask;
+      if (!sigfillset(&newMask) &&
+          !sigprocmask(SIG_BLOCK, &newMask, &oldMask)) {
+        pid_t pid = fork();
+        if (pid >= 0) {
+          if (!pid) {
+            // Test a very simple sandbox policy to verify that we can
+            // successfully turn on sandboxing.
+            suppressLogging_ = true;
+            setSandboxPolicy(probeEvaluator, NULL);
+            setProcFd(proc_fd);
+            startSandbox();
+            if (syscall(__NR_getpid) < 0 && errno == EPERM) {
+              syscall(__NR_exit_group, (intptr_t)100);
+            }
+            die(NULL);

[Chris Evans, 2012/06/01 22:48:23]

die() calls strlen() on the pointer so seems like this will crash.

[Markus (顧孟勤), 2012/06/01 23:46:33]

Good call. die() was already safe, when used in stand-alone mode. But it would
in fact have crashed, when using Chrome's logging feature. I fixed die() to do
the right thing.

+          }
+          if (sigprocmask(SIG_SETMASK, &oldMask, NULL)) {
+            die("sigprocmask() failed");
+          }
+          int status;
+          status_ = HANDLE_EINTR(waitpid(pid, &status, 0)) != pid

[Chris Evans, 2012/06/01 22:48:23]

Nested ternarys are a real PITA to read / parse, can we make it clearer?

[Markus (顧孟勤), 2012/06/01 23:46:33]

Done.

+            ? STATUS_UNAVAILABLE
+            : WIFEXITED(status) && WEXITSTATUS(status) == 100
+            ? STATUS_AVAILABLE
+            : STATUS_UNSUPPORTED;
+        } else if (sigprocmask(SIG_SETMASK, &oldMask, NULL)) {

[Chris Evans, 2012/06/01 22:48:23]

It looks like this branch is associated with fork() failing? It's hard to tell,
perhaps another argument for a "return early" indenting style as made above.

If this were indeed the association, is it what you intended?

[Markus (顧孟勤), 2012/06/01 23:46:33]

Done.

+          die("sigprocmask() failed");
+        }
+      }
+    }
+  } else if (status_ == STATUS_AVAILABLE &&
+             !isSingleThreaded(proc_fd)) {
+    status_ = STATUS_UNAVAILABLE;

[Chris Evans, 2012/06/01 22:48:23]

Still would prefer a dedicated error, STATUS_BADTHREADINGSITUATIONOMGOMG? :D

[Markus (顧孟勤), 2012/06/01 23:46:33]

I don't really want the caller to have to know too much about the internals of
the sandbox. There could be a lot of other run-time failure cases in the future,
and I don't want callers to have to enumerate all of them, when deciding what to
do with the return code from supportSeccompSandbox().

This is already somewhat difficult to use correctly.

I wouldn't be opposed to more logging, if that's what we want to do. If so,
please suggest what additional logging is needed.

+  }
+  return status_;
+}
+
+void Sandbox::setProcFd(int proc_fd) {
+  proc_fd_ = proc_fd;
+}
+
+void Sandbox::startSandbox() {
+  if (status_ == STATUS_UNSUPPORTED || status_ == STATUS_UNAVAILABLE) {
+    die("Trying to start sandbox, even though it is known to be unavailable");
+  } else if (status_ == STATUS_ENABLED) {
+    die("Cannot start sandbox recursively. Use multiple calls to "
+        "setSandboxPolicy() to stack policies instead");
+  }
+  if (proc_fd_ < 0) {
+    proc_fd_ = open("/proc", O_RDONLY|O_DIRECTORY);
+  }
+  if (proc_fd_ < 0) {
+    // For now, continue in degraded mode, if we can't access /proc.
+    // In the future, we might want to tighten this requirement.
+  }
+  if (!isSingleThreaded(proc_fd_)) {
+    die("Cannot start sandbox, if process is already multi-threaded");
+  }
+
+  // We no longer need access to any files in /proc. We want to do this
+  // before installing the filters, just in case that our policy denies
+  // close().
+  if (proc_fd_ >= 0) {
+    if (HANDLE_EINTR(close(proc_fd_))) {
+      die("Failed to close file descriptor for /proc");
+    }
+    proc_fd_ = -1;
+  }
+
+  // Install the filters.
+  installFilter();
+
+  // We are now inside the sandbox.
+  status_ = STATUS_ENABLED;
+}
+
+bool Sandbox::isSingleThreaded(int proc_fd) {
+  if (proc_fd < 0) {
+    // Cannot determine whether program is single-threaded. Hope for
+    // the best...
+    return true;
+  }
+
+  struct stat sb;
+  int task = -1;
+  if (proc_fd < 0 ||
+      (task = openat(proc_fd, "self/task", O_RDONLY|O_DIRECTORY)) < 0 ||
+      fstat(task, &sb) != 0 ||
+      sb.st_nlink != 3 ||
+      HANDLE_EINTR(close(task))) {
+    if (task >= 0) {
+      HANDLE_EINTR(close(task));
+    }
+    return false;
+  }
+  return true;
+}
+
+void Sandbox::setSandboxPolicy(EvaluateSyscall syscallEvaluator,
+                               EvaluateArguments argumentEvaluator) {
+  evaluators_.push_back(std::make_pair(syscallEvaluator, argumentEvaluator));
+}
+
+void Sandbox::installFilter() {
+  // Verify that the user pushed a policy.
+  if (evaluators_.empty()) {
+  filter_failed:
+    die("Failed to configure system call filters");
+  }
+
+  // Set new SIGSYS handler
+  struct sigaction sa;
+  memset(&sa, 0, sizeof(sa));
+  sa.sa_sigaction = &sigSys;
+  sa.sa_flags = SA_SIGINFO;
+  if (sigaction(SIGSYS, &sa, NULL) < 0) {
+    goto filter_failed;
+  }
+
+  // Unmask SIGSYS
+  sigset_t mask;
+  sigemptyset(&mask);
+  sigaddset(&mask, SIGSYS);
+  if (sigprocmask(SIG_UNBLOCK, &mask, NULL)) {
+    goto filter_failed;
+  }
+
+  // We can't handle stacked evaluators, yet. We'll get there eventually
+  // though. Hang tight.
+  if (evaluators_.size() != 1) {
+    die("Not implemented");
+  }
+
+  // If the architecture doesn't match SECCOMP_ARCH, disallow the
+  // system call.
+  std::vector<struct sock_filter> program;
+  program.push_back((struct sock_filter)
+                    BPF_STMT(BPF_LD+BPF_W+BPF_ABS,
+                             offsetof(struct arch_seccomp_data, arch)));
+  program.push_back((struct sock_filter)
+    BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, SECCOMP_ARCH, 1, 0));
+  program.push_back((struct sock_filter)
+    BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ERRNO + SECCOMP_DENY_ERRNO));
+
+  // Grab the system call number, so that we can implement jump tables.
+  program.push_back((struct sock_filter)
+    BPF_STMT(BPF_LD+BPF_W+BPF_ABS, offsetof(struct arch_seccomp_data, nr)));
+
+  // Evaluate all possible system calls and depending on their
+  // exit codes generate a BPF filter.
+  // This is very inefficient right now. We need to be much smarter
+  // eventually.
+  EvaluateSyscall evaluateSyscall = evaluators_.begin()->first;
+  for (int sysnum = MIN_SYSCALL; sysnum <= MAX_SYSCALL; ++sysnum) {
+    ErrorCode err = evaluateSyscall(sysnum);
+    int ret;
+    switch (err) {
+    case SB_INSPECT_ARG_1...SB_INSPECT_ARG_6:
+      die("Not implemented");
+    case SB_TRAP:
+      ret = SECCOMP_RET_TRAP;
+      break;
+    case SB_ALLOWED:
+      ret = SECCOMP_RET_ALLOW;
+      break;
+    default:
+      if (err >= static_cast<ErrorCode>(1) &&
+          err <= static_cast<ErrorCode>(4096)) {
+        // We limit errno values to a reasonable range. In fact, the Linux ABI
+        // doesn't support errno values outside of this range.
+        ret = SECCOMP_RET_ERRNO + err;
+      } else {
+        die("Invalid ErrorCode reported by sandbox system call evaluator");
+      }
+      break;
+    }
+    program.push_back((struct sock_filter)
+      BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, sysnum, 0, 1));
+    program.push_back((struct sock_filter)
+      BPF_STMT(BPF_RET+BPF_K, ret));
+  }
+
+  // Everything that isn't allowed is forbidden. Eventually, we would
+  // like to have a way to log forbidden calls, when in debug mode.
+  program.push_back((struct sock_filter)
+    BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ERRNO + SECCOMP_DENY_ERRNO));
+
+  // Install BPF filter program
+  const struct sock_fprog prog = { program.size(), &program[0] };
+  if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) ||
+      prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog)) {
+    goto filter_failed;
+  }
+
+  return;
+}
+
+void Sandbox::sigSys(int nr, siginfo_t *info, void *void_context) {
+  if (nr != SIGSYS || info->si_code != SYS_SECCOMP || !void_context) {
+    die("Unexpected SIGSYS received");

[Chris Evans, 2012/06/01 22:48:23]

Bug: die() in the Chromium context uses LOG(), which I'm pretty sure won't be
safe in the signal context.

[Markus (顧孟勤), 2012/06/01 23:46:33]

This is really a tough call. The standalone version of die() is designed to be
safe.

But the Chrome version is likely not safe ... although hopefully safe enough, as
this is fortunately a synchronous signal, making it a little less scary. Of
course, if somebody just calls "kill -SIGSYS" from the command line, all bets
are off. So, I certainly understand your concerns.

But Julien correctly pointed out that we really want to benefit from Chrome's
logging (and UMA reporting) capabilities if we fail anywhere in the sandbox. And
I think that means we have to use the standard logging functions.

+  }
+  ucontext_t *ctx = reinterpret_cast<ucontext_t *>(void_context);
+  int old_errno   = errno;

[Chris Evans, 2012/06/01 22:48:23]

We don't seem to do anything with old_errno?

[Markus (顧孟勤), 2012/06/01 23:46:33]

That is correct.

Non-exiting signal handlers must manually preserve errno or you get really
subtle bugs.

Of course, with this version of the CL, we don't actually do anything yet. So,
we are not destroying "errno". But that's presumably going to happen once the
user of the sandbox can provide its own signal handling code.

+
+  // In case of error, set the REG_RESULT CPU register to the default
+  // errno value (i.e. EPERM).
+  // We need to be very careful when doing this, as some of our target
+  // platforms have pointer types and CPU registers that are wider than
+  // ints. Furthermore, the kernel ABI requires us to return a negative
+  // value, but errno values are usually positive. And in fact, it would
+  // be perfectly reasonable for somebody to have defined them as unsigned
+  // properties. This makes the correct incantation of type casts rather
+  // subtle. Sometimes, C++ is just too smart for its own good.
+  void *rc        = (void *)(intptr_t)-(int)SECCOMP_DENY_ERRNO;
+
+  // This is where we can add extra code to handle complex system calls.
+  // ...
+
+  ctx->uc_mcontext.gregs[REG_RESULT] = reinterpret_cast<greg_t>(rc);
+  errno                              = old_errno;
+  return;
+}
+
+
+bool Sandbox::suppressLogging_          = false;
+Sandbox::SandboxStatus Sandbox::status_ = STATUS_UNKNOWN;
+int    Sandbox::proc_fd_                = -1;
+std::vector<std::pair<Sandbox::EvaluateSyscall,
+                      Sandbox::EvaluateArguments> > Sandbox::evaluators_;
+
+} // namespace