Add ARM syscalls to syscall sets.

content/common/sandbox_seccomp_bpf_linux.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <asm/unistd.h>
 #include <dlfcn.h>
 #include <errno.h>
 #include <fcntl.h>
 #include <linux/audit.h>
 #include <linux/filter.h>
@@ skipping 135 matching lines @@
   int flags = static_cast<int>(arg1);
 
   if (strcmp(pathname, kDriRcPath) == 0) {
     int ret = OpenWithCache(pathname, flags);
     return (ret == -1) ? -errno : ret;
   } else {
     return -ENOENT;
   }
 }
 
-#if defined(__i386__) || defined(__x86_64__)
+#if defined(__i386__) || defined(__x86_64__) || defined(__arm__)

[jln (very slow on Chromium), 2012/08/16 20:45:08]

I think we don't need this line at all now. Hurray!

We only need a #if defined (SECCOMP_BPF) around the anonymous namespace section,
which we already have.

[Jorge Lucangeli Obes, 2012/08/16 21:32:08]

Done.

 
 // The functions below cover all existing x86_64 and i386 system calls.

[jln (very slow on Chromium), 2012/08/16 20:45:08]

You now have the privilege to add an architecture here.

[Jorge Lucangeli Obes, 2012/08/16 21:32:08]

Done.

 // The implicitly defined sets form a partition of the sets of
 // system calls.
 
 // TODO(jln) we need to restrict the first parameter!
 bool IsKill(int sysno) {
   switch (sysno) {
     case __NR_kill:
     case __NR_tkill:
     case __NR_tgkill:
       return true;
     default:
       return false;
   }
 }
 
 bool IsAllowedGettime(int sysno) {
   switch (sysno) {
     case __NR_clock_gettime:
     case __NR_gettimeofday:
+#if defined(__i386__) || defined(__x86_64__)
     case __NR_time:
+#endif
       return true;
     case __NR_adjtimex:         // Privileged.
     case __NR_clock_adjtime:    // Privileged.
     case __NR_clock_getres:     // Could be allowed.
     case __NR_clock_nanosleep:  // Could be allowed.
     case __NR_clock_settime:    // Privileged.
 #if defined(__i386__)
     case __NR_ftime:            // Obsolete.
 #endif
     case __NR_settimeofday:     // Privileged.
@@ skipping 83 matching lines @@
     case __NR_symlink:
     case __NR_symlinkat:
     case __NR_truncate:
 #if defined(__i386__)
     case __NR_truncate64:
 #endif
     case __NR_unlink:
     case __NR_unlinkat:
     case __NR_uselib:          // Neither EPERM, nor ENOENT are valid errno.
     case __NR_ustat:           // Same as above. Deprecated.
+#if defined(__i386__) || defined(__x86_64__)
     case __NR_utime:
+#endif
     case __NR_utimensat:       // New.
     case __NR_utimes:
       return true;
     default:
       return false;
   }
 }
 
 bool IsAllowedFileSystemAccessViaFd(int sysno) {
   switch (sysno) {
     case __NR_fstat:
 #if defined(__i386__)
     case __NR_fstat64:
 #endif
       return true;
     // TODO(jln): these should be denied gracefully as well (moved below).
+#if defined(__i386__) || defined(__x86_64__)
     case __NR_fadvise64:        // EPERM not a valid errno.
+#endif
 #if defined(__i386__)
     case __NR_fadvise64_64:
 #endif
+#if defined(__arm__)
+    case __NR_arm_fadvise64_64:
+#endif
     case __NR_fdatasync:        // EPERM not a valid errno.
     case __NR_flock:            // EPERM not a valid errno.
     case __NR_fstatfs:          // Give information about the whole filesystem.
 #if defined(__i386__)
     case __NR_fstatfs64:
 #endif
     case __NR_fsync:            // EPERM not a valid errno.
 #if defined(__i386__)
     case __NR_oldfstat:
 #endif
-    case __NR_sync_file_range:  // EPERM not a valid errno.
+#if defined(__i386__) || defined(__x86_64__)
+    case __NR_sync_file_range:      // EPERM not a valid errno.
+#else   // defined(__arm__)

[jln (very slow on Chromium), 2012/08/16 20:45:08]

Please, make this a #elif.

[Jorge Lucangeli Obes, 2012/08/16 21:32:08]

Done.

+    case __NR_arm_sync_file_range:  // EPERM not a valid errno.
+#endif
     default:
       return false;
   }
 }
 
 // EPERM is a good errno for any of these.
 bool IsDeniedFileSystemAccessViaFd(int sysno) {
   switch (sysno) {
     case __NR_fallocate:
     case __NR_fchmod:
@@ skipping 53 matching lines @@
 #endif
       return true;
     default:
       return false;
   }
 }
 
 bool IsProcessPrivilegeChange(int sysno) {
   switch (sysno) {
     case __NR_capset:
+#if defined(__i386__) || defined(__x86_64__)
     case __NR_ioperm:  // Intel privilege.
     case __NR_iopl:    // Intel privilege.
+#endif
     case __NR_setfsgid:
     case __NR_setfsuid:
     case __NR_setgid:
     case __NR_setgroups:
     case __NR_setregid:
     case __NR_setresgid:
     case __NR_setresuid:
     case __NR_setreuid:
     case __NR_setuid:
 #if defined(__i386__)
@@ skipping 68 matching lines @@
 #endif
 #if defined(__x86_64__)
     case __NR_shutdown:
 #endif
       return true;
     default:
       return false;
   }
 }
 
-bool IsKernelInteralApi(int sysno) {
+bool IsKernelInternalApi(int sysno) {
   switch (sysno) {
     case __NR_restart_syscall:
+#if defined(__arm__)
+    case __ARM_NR_cmpxchg:
+#endif
       return true;
     default:
       return false;
   }
 }
 
 // This should be thought through in conjunction with IsFutex().
 bool IsAllowedProcessStartOrDeath(int sysno) {
   switch (sysno) {
     case __NR_clone:  // TODO(jln): restrict flags.
     case __NR_exit:
     case __NR_exit_group:
     case __NR_wait4:
     case __NR_waitid:
 #if defined(__i386__)
     case __NR_waitpid:
 #endif
       return true;
     case __NR_setns:  // Privileged.
     case __NR_fork:
+#if defined(__i386__) || defined(__x86_64__)
     case __NR_get_thread_area:
     case __NR_set_thread_area:
+#endif
     case __NR_set_tid_address:
     case __NR_unshare:
     case __NR_vfork:
     default:
       return false;
   }
 }
 
 // It's difficult to restrict those, but there is attack surface here.
 bool IsFutex(int sysno) {
@@ skipping 71 matching lines @@
       return false;
   }
 }
 #endif
 
 bool IsAllowedAddressSpaceAccess(int sysno) {
   switch (sysno) {
     case __NR_brk:
     case __NR_madvise:
     case __NR_mlock:
+#if defined(__i386__) || defined(__x86_64__)
     case __NR_mmap:   // TODO(jln): to restrict flags.

[jln (very slow on Chromium), 2012/08/16 20:45:08]

I'm pretty certain arm has mmap(). Maybe it's called old_mmap now ? Did you
explicitly exclude obsolete syscalls?

[Jorge Lucangeli Obes, 2012/08/16 21:32:08]

It's explicitly undefined in unistd.h and marked OBSOLETE in calls.S, which
automatically returns ENOSYS.

-#if defined(__i386__)
+#endif
+#if defined(__i386__) || defined(__arm__)
     case __NR_mmap2:
 #endif
     case __NR_mprotect:
     case __NR_munlock:
     case __NR_munmap:
       return true;
     case __NR_mincore:
     case __NR_mlockall:
+#if defined(__i386__) || defined(__x86_64__)
     case __NR_modify_ldt:
+#endif
     case __NR_mremap:
     case __NR_msync:
     case __NR_munlockall:
     case __NR_readahead:
     case __NR_remap_file_pages:
 #if defined(__i386__)
     case __NR_vm86:
     case __NR_vm86old:
 #endif
     default:
       return false;
   }
 }
 
 bool IsAllowedGeneralIo(int sysno) {
   switch (sysno) {
     case __NR_lseek:
 #if defined(__i386__)
     case __NR__llseek:
 #endif
     case __NR_poll:
     case __NR_ppoll:
     case __NR_pselect6:
     case __NR_read:
     case __NR_readv:
+#if defined(__arm__)
+    case __NR_recv:
+#endif
 #if defined(__x86_64__)
     case __NR_recvfrom:  // Could specify source.
     case __NR_recvmsg:   // Could specify source.
 #endif
+#if defined(__i386__) || defined(__x86_64__)
     case __NR_select:
-#if defined(__i386__)
+#endif
+#if defined(__i386__) || defined(__arm__)
     case __NR__newselect:
 #endif
+#if defined(__arm__)
+    case __NR_send:
+#endif
 #if defined(__x86_64__)
     case __NR_sendmsg:   // Could specify destination.
     case __NR_sendto:    // Could specify destination.
 #endif
     case __NR_write:
     case __NR_writev:
       return true;
     case __NR_ioctl:     // Can be very powerful.
     case __NR_pread64:
     case __NR_preadv:
@@ skipping 52 matching lines @@
     case __NR_sethostname:
     case __NR_syslog:
       return true;
     default:
       return false;
   }
 }
 
 bool IsKernelModule(int sysno) {
   switch (sysno) {
+#if defined(__i386__) || defined(__x86_64__)

[jln (very slow on Chromium), 2012/08/16 20:45:08]

Feel free to collapse these in one big #if defined.

[Jorge Lucangeli Obes, 2012/08/16 21:32:08]

Done.

     case __NR_create_module:
+#endif
     case __NR_delete_module:
+#if defined(__i386__) || defined(__x86_64__)
     case __NR_get_kernel_syms:  // Should ENOSYS.
+#endif
     case __NR_init_module:
+#if defined(__i386__) || defined(__x86_64__)
     case __NR_query_module:
+#endif
       return true;
     default:
       return false;
   }
 }
 
 bool IsGlobalFSViewChange(int sysno) {
   switch (sysno) {
     case __NR_pivot_root:
     case __NR_chroot:
@@ skipping 19 matching lines @@
     default:
       return false;
   }
 }
 
 bool IsNuma(int sysno) {
   switch (sysno) {
     case __NR_get_mempolicy:
     case __NR_getcpu:
     case __NR_mbind:
+#if defined(__i386__) || defined(__x86_64__)
     case __NR_migrate_pages:
+#endif
     case __NR_move_pages:
     case __NR_set_mempolicy:
       return true;
     default:
       return false;
   }
 }
 
 bool IsMessageQueue(int sysno) {
   switch (sysno) {
     case __NR_mq_getsetattr:
     case __NR_mq_notify:
     case __NR_mq_open:
     case __NR_mq_timedreceive:
     case __NR_mq_timedsend:
     case __NR_mq_unlink:
       return true;
     default:
       return false;
   }
 }
 
 bool IsGlobalProcessEnvironment(int sysno) {
   switch (sysno) {
     case __NR_acct:         // Privileged.
+#if defined(__i386__) || defined(__x86_64__)
     case __NR_getrlimit:
-#if defined(__i386__)
+#endif
+#if defined(__i386__) || defined(__arm__)
     case __NR_ugetrlimit:
+#elif defined(__i386__)
     case __NR_ulimit:
 #endif
     case __NR_getrusage:
     case __NR_personality:  // Can change its personality as well.
     case __NR_prlimit64:    // Like setrlimit / getrlimit.
     case __NR_setrlimit:
     case __NR_times:
       return true;
     default:
       return false;
   }
 }
 
 bool IsDebug(int sysno) {
   switch (sysno) {
     case __NR_ptrace:
     case __NR_process_vm_readv:
     case __NR_process_vm_writev:
+#if defined(__i386__) || defined(__x86_64__)
     case __NR_kcmp:
+#endif
       return true;
     default:
       return false;
   }
 }
 
 bool IsGlobalSystemStatus(int sysno) {
   switch (sysno) {
     case __NR__sysctl:
     case __NR_sysfs:
@@ skipping 136 matching lines @@
     case __NR_fanotify_mark:
       return true;
     default:
       return false;
   }
 }
 
 bool IsTimer(int sysno) {
   switch (sysno) {
     case __NR_getitimer:
+#if defined(__i386__) || defined(__x86_64__)
     case __NR_alarm:
+#endif
     case __NR_setitimer:
       return true;
     default:
       return false;
   }
 }
 
 bool IsAdvancedTimer(int sysno) {
   switch (sysno) {
     case __NR_timer_create:
@@ skipping 33 matching lines @@
 // Various system calls that need to be researched.
 // TODO(jln): classify this better.
 bool IsMisc(int sysno) {
   switch (sysno) {
     case __NR_name_to_handle_at:
     case __NR_open_by_handle_at:
     case __NR_perf_event_open:
     case __NR_syncfs:
     case __NR_vhangup:
     // The system calls below are not implemented.
+#if defined(__i386__) || defined(__x86_64__)
     case __NR_afs_syscall:
+#endif
 #if defined(__i386__)
     case __NR_break:
 #endif
+#if defined(__i386__) || defined(__x86_64__)
     case __NR_getpmsg:
+#endif
 #if defined(__i386__)
     case __NR_gtty:
     case __NR_idle:
     case __NR_lock:
     case __NR_mpx:
     case __NR_prof:
     case __NR_profil:
 #endif
+#if defined(__i386__) || defined(__x86_64__)
     case __NR_putpmsg:
+#endif
 #if defined(__x86_64__)
     case __NR_security:
 #endif
 #if defined(__i386__)
     case __NR_stty:
 #endif
 #if defined(__x86_64__)
     case __NR_tuxcall:
 #endif
     case __NR_vserver:
       return true;
     default:
       return false;
   }
 }
 
+#if defined(__arm__)
+bool IsArmPciConfig(int sysno) {

[jln (very slow on Chromium), 2012/08/16 20:45:08]

I really want to keep the property that the baseline explicitly covers all
system calls.

Please add these to IsBaselinePolicyWatched_x86_64

[Jorge Lucangeli Obes, 2012/08/16 21:32:08]

I don't think these exist in x86/64. I don't understand the suggestion. Do you
want to have a Baseline valid for ARM as well?

+  switch (sysno) {
+    case __NR_pciconfig_iobase:
+    case __NR_pciconfig_read:
+    case __NR_pciconfig_write:
+      return true;
+    default:
+      return false;
+  }
+}
+
+bool IsArmPrivate(int sysno) {
+  switch (sysno) {
+    case __ARM_NR_breakpoint:
+    case __ARM_NR_cacheflush:
+    case __ARM_NR_set_tls:
+    case __ARM_NR_usr26:
+    case __ARM_NR_usr32:
+      return true;
+    default:
+      return false;
+  }
+}
+#endif  // defined(__arm__)
+
 // End of the system call sets section.
 
 bool IsBaselinePolicyAllowed_x86_64(int sysno) {
   if (IsAllowedAddressSpaceAccess(sysno) ||
       IsAllowedBasicScheduler(sysno) ||
       IsAllowedEpoll(sysno) ||
       IsAllowedFileSystemAccessViaFd(sysno) ||
       IsAllowedGeneralIo(sysno) ||
       IsAllowedGetOrModifySocket(sysno) ||
       IsAllowedGettime(sysno) ||
       IsAllowedPrctl(sysno) ||
       IsAllowedProcessStartOrDeath(sysno) ||
       IsAllowedSignalHandling(sysno) ||
       IsFutex(sysno) ||
       IsGetSimpleId(sysno) ||
-      IsKernelInteralApi(sysno) ||
+      IsKernelInternalApi(sysno) ||
       IsKill(sysno) ||
       IsOperationOnFd(sysno)) {
     return true;
   } else {
     return false;
   }
 }
 
 // System calls that will trigger the crashing sigsys handler.
 bool IsBaselinePolicyWatched_x86_64(int sysno) {
@@ skipping 271 matching lines @@
       // Process-specific policy.
       ShouldEnableSeccompBpf(process_type) &&
       SupportsSandbox()) {
     return StartBpfSandbox(command_line, process_type);
   }
 #endif
   return false;
 }
 
 }  // namespace content