Allow ASanified Chrome to use sched_getaffinity

Allow ASanified Chrome to use sched_getaffinity

BUG=127536
Committed: https://src.chromium.org/viewvc/chrome?view=rev&revision=170827

[Alexander Potapenko, 2012-12-01 03:07:12]

Please take a look.

[jln (very slow on Chromium), 2012-12-03 18:43:38]

Your CL modifies the "sets" themselves, which we really don't want to do.

One option would be to add it to the baseline policy, but I would prefer to add
it on top of each policy.

It's already in Flash so you just need to add it to the GPU and Renderer.

Have you been able to test ASAN under different process types ? For instance the
GPU policy is more tight, maybe it's worth checking that ASAN works there.

https://chromiumcodereview.appspot.com/11418277/diff/1/content/common/sandbox...
File content/common/sandbox_seccomp_bpf_linux.cc (right):

https://chromiumcodereview.appspot.com/11418277/diff/1/content/common/sandbox...
content/common/sandbox_seccomp_bpf_linux.cc:1262: }
Please add sched_get_affinity here instead.

https://chromiumcodereview.appspot.com/11418277/diff/1/content/common/sandbox...
content/common/sandbox_seccomp_bpf_linux.cc:1283: case __NR_pwrite64:
And here.

[Alexander Potapenko, 2012-12-03 21:14:47]

PTAL

[Alexander Potapenko, 2012-12-03 21:16:24]

> Have you been able to test ASAN under different process types ? For instance
the
> GPU policy is more tight, maybe it's worth checking that ASAN works there.
I don't think I understand your question. Aren't most of the process types
launched at Chrome startup?

[jln (very slow on Chromium), 2012-12-03 21:40:02]

On 2012/12/03 21:14:47, Alexander Potapenko wrote:
> PTAL

lgtm

[jln (very slow on Chromium), 2012-12-03 21:42:13]

On 2012/12/03 21:16:24, Alexander Potapenko wrote:
> > Have you been able to test ASAN under different process types ? For instance
> the
> > GPU policy is more tight, maybe it's worth checking that ASAN works there.
> I don't think I understand your question. Aren't most of the process types
> launched at Chrome startup?

Unfortunately no, but the renderer and GPU should. However, depending on where
you test, your GPU sandbox might not be enabled (check about:sandbox).

But I think the important point is that when reporting an error, ASAN could fail
if sandboxed. So one would need to check that an ASAN failure is properly
working sandboxed, under each process type, isn't it ?

Introducing an ASAN failure in gpu_main, right after sandboxing would be useful
for testing for instance.

[jln (very slow on Chromium), 2012-12-04 00:16:08]

I'm very sorry I missed this in the review :(

https://chromiumcodereview.appspot.com/11418277/diff/5001/content/common/sand...
File content/common/sandbox_seccomp_bpf_linux.cc (right):

https://chromiumcodereview.appspot.com/11418277/diff/5001/content/common/sand...
content/common/sandbox_seccomp_bpf_linux.cc:1258: case __NR_sched_getaffinity:
You need to add return ErrorCode(ErrorCode::ERR_ALLOWED); here.