Linux sandbox: workaround colliding system call.

sandbox/linux/seccomp-bpf/sandbox_bpf.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sandbox/linux/seccomp-bpf/sandbox_bpf.h"
 
 // Some headers on Android are missing cdefs: crbug.com/172337.
 // (We can't use OS_ANDROID here since build_config.h is not included).
 #if defined(ANDROID)
 #include <sys/cdefs.h>
@@ skipping 41 matching lines @@
 bool KernelSupportsSeccompBPF() {
   errno = 0;
   const int rv = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, nullptr);
 
   if (rv == -1 && EFAULT == errno) {
     return true;
   }
   return false;
 }
 
+// LG introduced a buggy syscall, sys_set_media_ext  with the same number as

[palmer, 2015/04/21 03:28:43]

Typo: s/  /, /

[jln (very slow on Chromium), 2015/04/23 00:02:51]

Done.

+// seccomp. Return true if the current kernel has this buggy syscall.
+//
+// We want this to work with upcoming versions of seccomp, so we pass bogus
+// flags that are unlikely to ever be used by the kernel. A normal kernel would
+// return -EINVAL, but a buggy LG kernel would return 1.
+bool KernelHasLGBug() {
+#if defined(OS_ANDROID)
+  // This has to be seen as a NULL pointer by sys_set_media_ext to not crash,

[palmer, 2015/04/21 03:28:43]

Nit: I think this comment could be stated more clearly. One idea:

sys_set_media_ext will see this as NULL, which should be a safe (non-crashing)
way to invoke it. A genuine seccomp syscall will see it as
|SECCOMP_SET_MODE_STRICT|, which is also safe.

[jln (very slow on Chromium), 2015/04/23 00:02:51]

Done.

+  // it will be seen as SECCOMP_SET_MODE_STRICT in a genuine seccomp syscall.
+  const unsigned int operation = 0;
+  // Chosen by fair dice roll. Guaranteed to be random.
+  const unsigned int flags = 0xf7a46a5c;
+  const int rv = sys_seccomp(operation, flags, nullptr);
+  // A genuine kernel would EINVAL, or at the very least return some kind of

[palmer, 2015/04/21 03:28:44]

"...would return -1 and set errno to EINVAL. Any other behavior indicates that
whatever code received our syscall was not the real seccomp."

[jln (very slow on Chromium), 2015/04/23 00:02:51]

Done.

+  // error.
+  if (rv != -1) {
+    return true;
+  }
+#endif  // defined(OS_ANDROID)
+
+  return false;
+}
+
 // Check if the kernel supports seccomp-filter via the seccomp system call
 // and the TSYNC feature to enable seccomp on all threads.
 bool KernelSupportsSeccompTsync() {
+  if (KernelHasLGBug()) {
+    return false;
+  }
+
   errno = 0;
   const int rv =
       sys_seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_TSYNC, nullptr);
 
   if (rv == -1 && errno == EFAULT) {
     return true;
   } else {
     // TODO(jln): turn these into DCHECK after 417888 is considered fixed.
     CHECK_EQ(-1, rv);
     CHECK(ENOSYS == errno || EINVAL == errno);
@@ skipping 164 matching lines @@
   } else {
     if (prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog)) {
       SANDBOX_DIE("Kernel refuses to turn on BPF filters");
     }
   }
 
   sandbox_has_started_ = true;
 }
 
 }  // namespace sandbox