Non-SFI mode: Sandbox support for NaCl async-signals.

components/nacl/loader/nonsfi/nonsfi_sandbox.cc

Index: components/nacl/loader/nonsfi/nonsfi_sandbox.cc
diff --git a/components/nacl/loader/nonsfi/nonsfi_sandbox.cc b/components/nacl/loader/nonsfi/nonsfi_sandbox.cc
index 475c28c28c637f4975287402af9c28b65132117c..e71dcd809babc4ca6af22ad9c9840d5872722a19 100644
--- a/components/nacl/loader/nonsfi/nonsfi_sandbox.cc
+++ b/components/nacl/loader/nonsfi/nonsfi_sandbox.cc
@@ -22,6 +22,7 @@
 #include "sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.h"
 #include "sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.h"
 #include "sandbox/linux/system_headers/linux_futex.h"
+#include "sandbox/linux/system_headers/linux_signal.h"
 #include "sandbox/linux/system_headers/linux_syscalls.h"
 
 // Chrome OS Daisy (ARM) build environment and PNaCl toolchain do not define
@@ -83,7 +84,11 @@ ResultExpr RestrictClone() {
   clone_flags |= CLONE_PARENT_SETTID | CLONE_CHILD_CLEARTID;
 #endif
   const Arg<int> flags(0);
-  return If(flags == clone_flags, Allow()).Else(CrashSIGSYSClone());
+  // TODO(lhchavez): Add CLONE_PARENT_SETTID unconditionally to the allowed
+  // flags after the NaCl roll.
+  return If(flags == clone_flags ||
+                flags == (clone_flags | CLONE_PARENT_SETTID),
+            Allow()).Else(CrashSIGSYSClone());
 }
 
 ResultExpr RestrictFutexOperation() {
@@ -146,6 +151,18 @@ ResultExpr RestrictMmap() {
             Allow()).Else(CrashSIGSYS());
 }
 
+ResultExpr RestrictTgkill() {
+  const Arg<int> tgid(0), tid(1), signum(2);
+  // Only sending SIGUSR1 to a thread in the same process is allowed.
+  return If(tgid == getpid() &&

[jln (very slow on Chromium), 2015/08/17 21:21:11]

Don't use getpid() in policies. This should be a property of the policy itself,
recorded when the object is created.

You can look at sandbox/linux/seccomp-bpf-helpers/baseline_policy.h:policy_pid_

There are several reason for this, but in general we don't want policies to
depend on "environment" (we should be able to construct them out of process for
instance).

[Luis Héctor Chávez, 2015/08/17 22:13:07]

Done.

+            // Arg does not support a greater-than operator, so two separate
+            // checks are needed to ensure tid is positive.
+            tid != 0 &&

[jln (very slow on Chromium), 2015/08/17 21:21:11]

FYI, this check isn't strictly necessary, Linux doesn't allow negative tids
anyways. But I like the paranoia, fine to keep.

[Luis Héctor Chávez, 2015/08/17 22:13:07]

Acknowledged.

+            (tid & (1u << 31)) == 0 &&  // tid is non-negative.
+            signum == LINUX_SIGUSR1,
+            Allow()).Else(CrashSIGSYS());
+}
+
 #if !defined(OS_NACL_NONSFI) && (defined(__x86_64__) || defined(__arm__))
 ResultExpr RestrictSocketpair() {
   // Only allow AF_UNIX, PF_UNIX. Crash if anything else is seen.
@@ -304,6 +321,9 @@ ResultExpr NaClNonSfiBPFSandboxPolicy::EvaluateSyscall(int sysno) const {
 #endif
 #endif
 
+    case __NR_tgkill:
+      return RestrictTgkill();
+
     case __NR_brk:
       // The behavior of brk on Linux is different from other system
       // calls. It does not return errno but the current break on