Add a platform-specific syscall number iterator.

sandbox/linux/seccomp-bpf/sandbox_bpf_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <ostream>
 
 #include "sandbox/linux/seccomp-bpf/bpf_tests.h"
 #include "sandbox/linux/seccomp-bpf/verifier.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
@@ skipping 28 matching lines @@
 }
 
 // A simple blacklist test
 
 ErrorCode BlacklistNanosleepPolicy(int sysno) {
   if (sysno < static_cast<int>(MIN_SYSCALL) ||
       sysno > static_cast<int>(MAX_SYSCALL)) {
     // FIXME: we should really not have to do that in a trivial policy
     return ErrorCode(ENOSYS);
   }
+#if defined(__arm__)
+  if (!Sandbox::isArmPrivateSyscall(sysno)) {

[jln (very slow on Chromium), 2012/10/11 22:42:00]

I don't understand why this would work. For instance, for EACCESS, which is not
a private syscall, wouldn't we return ENOSYS ?

Asides from that, it's a problem to require every black list-style policy to do
something so complex. Instead, export a IsValidSysCallNumber() method in the
Sandbox class to take care of what's above and here.

[Jorge Lucangeli Obes, 2012/10/12 17:58:23]

Done.

+    return ErrorCode(ENOSYS);
+  }
+#endif
   switch (sysno) {
     case __NR_nanosleep:
       return ErrorCode(EACCES);
     default:
       return ErrorCode(ErrorCode::ERR_ALLOWED);
   }
 }
 
 BPF_TEST(SandboxBpf, ApplyBasicBlacklistPolicy, BlacklistNanosleepPolicy) {
   // nanosleep() should be denied
@@ skipping 39 matching lines @@
   *(static_cast<int*>(aux)) = kExpectedReturnValue;
   return -ENOMEM;
 }
 
 ErrorCode BlacklistNanosleepPolicySigsys(int sysno) {
   if (sysno < static_cast<int>(MIN_SYSCALL) ||
       sysno > static_cast<int>(MAX_SYSCALL)) {
     // FIXME: we should really not have to do that in a trivial policy
     return ErrorCode(ENOSYS);
   }
+#if defined(__arm__)
+  if (!Sandbox::isArmPrivateSyscall(sysno)) {
+    return ErrorCode(ENOSYS);
+  }
+#endif
   switch (sysno) {
     case __NR_nanosleep:
       return Sandbox::Trap(EnomemHandler,
                  static_cast<void *>(&BlacklistNanosleepPolicySigsysAuxData));
     default:
       return ErrorCode(ErrorCode::ERR_ALLOWED);
   }
 }
 
 BPF_TEST(SandboxBpf, BasicBlacklistWithSigsys,
@@ skipping 54 matching lines @@
   }
 }
 
 BPF_TEST(SandboxBpf, SyntheticPolicy, SyntheticPolicy) {
   // Ensure that that kExpectedReturnValue + syscallnumber + 1 does not int
   // overflow.
   BPF_ASSERT(
    std::numeric_limits<int>::max() - kExpectedReturnValue - 1 >=
    static_cast<int>(MAX_SYSCALL));
 
   // TODO(jorgelo): remove this limit once crbug.com/141694 is fixed.

[jln (very slow on Chromium), 2012/10/11 22:42:00]

Do you want to go over this now?

[Jorge Lucangeli Obes, 2012/10/12 17:58:23]

This will still need the new compiler. We're still blowing up the jumptable.

 #if defined(__arm__)
   const int sysno_ceiling = kArmPublicSysnoCeiling;
 #else
   const int sysno_ceiling = static_cast<int>(MAX_SYSCALL);
 #endif
 
   for (int syscall_number =  static_cast<int>(MIN_SYSCALL);
            syscall_number <= sysno_ceiling;
          ++syscall_number) {
     if (syscall_number == __NR_exit_group ||
         syscall_number == __NR_write) {
       // exit_group() is special
       continue;
     }
     errno = 0;
     BPF_ASSERT(syscall(syscall_number) == -1);
     BPF_ASSERT(errno == SysnoToRandomErrno(syscall_number));
   }
 }
 
 } // namespace