Allow ASanified Chrome to use sched_getaffinity

content/common/sandbox_seccomp_bpf_linux.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <asm/unistd.h>
 #include <dlfcn.h>
 #include <errno.h>
 #include <fcntl.h>
 #include <linux/audit.h>
 #include <linux/filter.h>
@@ skipping 705 matching lines @@
 #endif
       return false;
   }
 }
 
 bool IsAllowedBasicScheduler(int sysno) {
   switch (sysno) {
     case __NR_sched_yield:
     case __NR_pause:
     case __NR_nanosleep:
+#if defined(ADDRESS_SANITIZER)
+    // Allow to call sched_getaffinity under AddressSanitizer.
+    case __NR_sched_getaffinity:
+#endif
       return true;
     case __NR_getpriority:
 #if defined(__i386__) || defined(__arm__)
     case __NR_nice:
 #endif
     case __NR_setpriority:
     default:
       return false;
   }
 }
@@ skipping 229 matching lines @@
   }
 }
 #endif
 
 bool IsAdvancedScheduler(int sysno) {
   switch (sysno) {
     case __NR_ioprio_get:  // IO scheduler.
     case __NR_ioprio_set:
     case __NR_sched_get_priority_max:
     case __NR_sched_get_priority_min:
+#if !defined(ADDRESS_SANITIZER)
+    // Allow to call sched_getaffinity under AddressSanitizer.
     case __NR_sched_getaffinity:
+#endif
     case __NR_sched_getparam:
     case __NR_sched_getscheduler:
     case __NR_sched_rr_get_interval:
     case __NR_sched_setaffinity:
     case __NR_sched_setparam:
     case __NR_sched_setscheduler:
       return true;
     default:
       return false;
   }
@@ skipping 259 matching lines @@
         // dup()'ing an already open file descriptor does not work.
         // Allow open() even though it severely weakens the sandbox,
         // to test the sandboxing mechanism in general.
         // TODO(jorgelo): remove this once we solve the libva issue.
         return ErrorCode(ErrorCode::ERR_ALLOWED);
       } else {
         // Hook open() in the GPU process to allow opening /etc/drirc,
         // needed by Mesa.
         // The hook needs dup(), lseek(), and close() to be allowed.
         return Sandbox::Trap(GpuOpenSIGSYS_Handler, NULL);
       }

[jln (very slow on Chromium), 2012/12/03 18:43:38]

Please add sched_get_affinity here instead.

     default:
       if (IsEventFd(sysno))
         return ErrorCode(ErrorCode::ERR_ALLOWED);
 
       // Default on the baseline policy.
       return BaselinePolicy(sysno);
   }
 }
 
 ErrorCode RendererOrWorkerProcessPolicy(int sysno, void *) {
   switch (sysno) {
     case __NR_ioctl:  // TODO(jln) investigate legitimate use in the renderer
                       // and see if alternatives can be used.
     case __NR_fdatasync:
     case __NR_fsync:
 #if defined(__i386__) || defined(__x86_64__)
     case __NR_getrlimit:
 #endif
     case __NR_mremap:   // See crbug.com/149834.
     case __NR_pread64:
     case __NR_pwrite64:

[jln (very slow on Chromium), 2012/12/03 18:43:38]

And here.

     case __NR_sched_get_priority_max:
     case __NR_sched_get_priority_min:
     case __NR_sched_getparam:
     case __NR_sched_getscheduler:
     case __NR_sched_setscheduler:
     case __NR_setpriority:
     case __NR_sysinfo:
     case __NR_times:
     case __NR_uname:
       return ErrorCode(ErrorCode::ERR_ALLOWED);
@@ skipping 186 matching lines @@
     // should enable it, enable it or die.
     bool started_sandbox = StartBpfSandbox(command_line, process_type);
     CHECK(started_sandbox);
     return true;
   }
 #endif
   return false;
 }
 
 }  // namespace content