Linux sandbox: workaround colliding system call.

sandbox/linux/seccomp-bpf/sandbox_bpf.cc

Index: sandbox/linux/seccomp-bpf/sandbox_bpf.cc
diff --git a/sandbox/linux/seccomp-bpf/sandbox_bpf.cc b/sandbox/linux/seccomp-bpf/sandbox_bpf.cc
index af397dfaa35b8c583b4c450bf69e1192d3a72bc9..7732573da2b7bb74400691c0166615d6761fe138 100644
--- a/sandbox/linux/seccomp-bpf/sandbox_bpf.cc
+++ b/sandbox/linux/seccomp-bpf/sandbox_bpf.cc
@@ -59,9 +59,37 @@ bool KernelSupportsSeccompBPF() {
   return false;
 }
 
+// LG introduced a buggy syscall, sys_set_media_ext  with the same number as

[palmer, 2015/04/21 03:28:43]

Typo: s/  /, /

[jln (very slow on Chromium), 2015/04/23 00:02:51]

Done.

+// seccomp. Return true if the current kernel has this buggy syscall.
+//
+// We want this to work with upcoming versions of seccomp, so we pass bogus
+// flags that are unlikely to ever be used by the kernel. A normal kernel would
+// return -EINVAL, but a buggy LG kernel would return 1.
+bool KernelHasLGBug() {
+#if defined(OS_ANDROID)
+  // This has to be seen as a NULL pointer by sys_set_media_ext to not crash,

[palmer, 2015/04/21 03:28:43]

Nit: I think this comment could be stated more clearly. One idea:

sys_set_media_ext will see this as NULL, which should be a safe (non-crashing)
way to invoke it. A genuine seccomp syscall will see it as
|SECCOMP_SET_MODE_STRICT|, which is also safe.

[jln (very slow on Chromium), 2015/04/23 00:02:51]

Done.

+  // it will be seen as SECCOMP_SET_MODE_STRICT in a genuine seccomp syscall.
+  const unsigned int operation = 0;
+  // Chosen by fair dice roll. Guaranteed to be random.
+  const unsigned int flags = 0xf7a46a5c;
+  const int rv = sys_seccomp(operation, flags, nullptr);
+  // A genuine kernel would EINVAL, or at the very least return some kind of

[palmer, 2015/04/21 03:28:44]

"...would return -1 and set errno to EINVAL. Any other behavior indicates that
whatever code received our syscall was not the real seccomp."

[jln (very slow on Chromium), 2015/04/23 00:02:51]

Done.

+  // error.
+  if (rv != -1) {
+    return true;
+  }
+#endif  // defined(OS_ANDROID)
+
+  return false;
+}
+
 // Check if the kernel supports seccomp-filter via the seccomp system call
 // and the TSYNC feature to enable seccomp on all threads.
 bool KernelSupportsSeccompTsync() {
+  if (KernelHasLGBug()) {
+    return false;
+  }
+
   errno = 0;
   const int rv =
       sys_seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_TSYNC, nullptr);