Linux Sandbox: EPERM any system V IPC in the baseline

content/common/sandbox_seccomp_bpf_linux.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <asm/unistd.h>
 #include <dlfcn.h>
 #include <errno.h>
 #include <fcntl.h>
 #include <linux/audit.h>
 #include <linux/filter.h>
@@ skipping 996 matching lines @@
 bool IsSystemVIpc(int sysno) {
   switch (sysno) {
     case __NR_ipc:
       return true;
     default:
       return false;
   }
 }
 #endif
 
+bool IsAnySystemV(int sysno) {
+#if defined(__x86_64__) || defined(__arm__)
+  return IsSystemVMessageQueue(sysno) ||
+         IsSystemVSemaphores(sysno) ||
+         IsSystemVSharedMemory(sysno);
+#elif defined(__i386__)
+  return IsSystemVIpc(sysno);
+#endif
+}
+
 bool IsAdvancedScheduler(int sysno) {
   switch (sysno) {
     case __NR_ioprio_get:  // IO scheduler.
     case __NR_ioprio_set:
     case __NR_sched_get_priority_max:
     case __NR_sched_get_priority_min:
     case __NR_sched_getaffinity:
     case __NR_sched_getparam:
     case __NR_sched_getscheduler:
     case __NR_sched_rr_get_interval:
@@ skipping 198 matching lines @@
 #if defined(__x86_64__)
       IsNetworkSocketInformation(sysno) ||
 #endif
       IsNuma(sysno) ||
       IsProcessGroupOrSession(sysno) ||
       IsProcessPrivilegeChange(sysno) ||
 #if defined(__i386__)
       IsSocketCall(sysno) ||  // We'll need to handle this properly to build
                               // a x86_32 policy.
 #endif
-#if defined(__x86_64__) || defined(__arm__)
-      IsSystemVMessageQueue(sysno) ||
-      IsSystemVSemaphores(sysno) ||
-      IsSystemVSharedMemory(sysno) ||
-#elif defined(__i386__)
-      IsSystemVIpc(sysno) ||
-#endif
 #if defined(__arm__)
       IsArmPciConfig(sysno) ||
 #endif
       IsTimer(sysno)) {
     return true;
   } else {
     return false;
   }
 }
 
@@ skipping 155 matching lines @@
   if (sysno == __NR_fcntl64)
     return ErrorCode(ErrorCode::ERR_ALLOWED);
 #endif
 
   // TODO(jln): some system calls in those sets are not supposed to
   // return ENOENT. Return the appropriate error.
   if (IsFileSystem(sysno) || IsCurrentDirectory(sysno)) {
     return ErrorCode(ENOENT);
   }
 
+  if (IsAnySystemV(sysno)) {
+    return ErrorCode(EPERM);
+  }
+
   if (IsUmask(sysno) || IsDeniedFileSystemAccessViaFd(sysno) ||
       IsDeniedGetOrModifySocket(sysno)) {
     return ErrorCode(EPERM);
   }
 
 #if defined(__i386__)
   if (IsSocketCall(sysno))
     return RestrictSocketcallCommand(sandbox);
 #endif
 
@@ skipping 21 matching lines @@
     case __NR_mprotect:
     case __NR_sched_getaffinity:
     case __NR_sched_setaffinity:
     case __NR_setpriority:
       return ErrorCode(ErrorCode::ERR_ALLOWED);
     case __NR_access:
     case __NR_open:
     case __NR_openat:
       return sandbox->Trap(GpuSIGSYS_Handler, broker_process);
     default:
-#if defined(__x86_64__) || defined(__arm__)
-      if (IsSystemVSharedMemory(sysno))
-        return ErrorCode(EACCES);
-#endif
       if (IsEventFd(sysno))
         return ErrorCode(ErrorCode::ERR_ALLOWED);
 
       // Default on the baseline policy.
       return BaselinePolicy(sandbox, sysno);
   }
 }
 
 // x86_64/i386.
 // A GPU broker policy is the same as a GPU policy with open and
@@ skipping 427 matching lines @@
     // should enable it, enable it or die.
     bool started_sandbox = StartBpfSandbox(command_line, process_type);
     CHECK(started_sandbox);
     return true;
   }
 #endif
   return false;
 }
 
 }  // namespace content