Non-SFI NaCl: Disallow futex call without FUTEX_PRIVATE_FLAG

components/nacl/loader/nonsfi/nonsfi_sandbox.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "components/nacl/loader/nonsfi/nonsfi_sandbox.h"
 
 #include <errno.h>
 #include <fcntl.h>
+#include <linux/futex.h>
 #include <linux/net.h>
 #include <sys/prctl.h>
 #include <sys/ptrace.h>
 #include <sys/mman.h>
 #include <sys/socket.h>
 #include <sys/syscall.h>
 
 #include "base/basictypes.h"
 #include "base/logging.h"
 #include "build/build_config.h"
 #include "content/public/common/sandbox_init.h"
 #include "sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.h"
 #include "sandbox/linux/seccomp-bpf/sandbox_bpf.h"
 #include "sandbox/linux/seccomp-bpf/sandbox_bpf_policy.h"
 #include "sandbox/linux/seccomp-bpf/trap.h"
 #include "sandbox/linux/services/linux_syscalls.h"
 
 #if defined(__arm__) && !defined(MAP_STACK)
 // Chrome OS Daisy (ARM) build environment has old headers.
 #define MAP_STACK 0x20000
 #endif
 
 using sandbox::ErrorCode;
 using sandbox::SandboxBPF;
 
 namespace nacl {
 namespace nonsfi {
 namespace {
 
+ErrorCode RestrictFutexCommands(SandboxBPF* sb) {
+  // For now, we allow non-PRIVATE FUTEX_WAIT for lll_wait_tid in
+  // glibc's pthread_join.
+  // TODO(hamaji): Disallow FUTEX_WAIT by switching to newlib or
+  // detaching threads.
+  return sb->Cond(1, ErrorCode::TP_32BIT,
+                  ErrorCode::OP_EQUAL, FUTEX_WAIT,
+                  ErrorCode(ErrorCode::ERR_ALLOWED),
+         sb->Cond(1, ErrorCode::TP_32BIT,
+                  ErrorCode::OP_HAS_ALL_BITS, FUTEX_PRIVATE_FLAG,
+                  ErrorCode(ErrorCode::ERR_ALLOWED),
+         sb->Trap(sandbox::CrashSIGSYS_Handler, NULL)));
+}
+
 ErrorCode RestrictFcntlCommands(SandboxBPF* sb) {
   ErrorCode::ArgType mask_long_type;
   if (sizeof(long) == 8) {
     mask_long_type = ErrorCode::TP_64BIT;
   } else if (sizeof(long) == 4) {
     mask_long_type = ErrorCode::TP_32BIT;
   } else {
     NOTREACHED();
   }
   // We allow following cases:
@@ skipping 171 matching lines @@
     case __NR_epoll_create:
     case __NR_epoll_ctl:
     case __NR_epoll_wait:
     case __NR_exit:
     case __NR_exit_group:
 #if defined(__i386__) || defined(__arm__)
     case __NR_fstat64:
 #elif defined(__x86_64__)
     case __NR_fstat:
 #endif
-    // TODO(hamaji): Allow only FUTEX_PRIVATE_FLAG.
-    case __NR_futex:
     // TODO(hamaji): Remove the need of gettid. Currently, this is
     // called from PlatformThread::CurrentId().
     case __NR_gettid:
     case __NR_gettimeofday:
     case __NR_munmap:
     case __NR_nanosleep:
     // TODO(hamaji): Remove the need of pipe. Currently, this is
     // called from base::MessagePumpLibevent::Init().
     case __NR_pipe:
     case __NR_pread64:
@@ skipping 15 matching lines @@
       return RestrictClone(sb);
 
 #if defined(__x86_64__)
     case __NR_fcntl:
 #endif
 #if defined(__i386__) || defined(__arm__)
     case __NR_fcntl64:
 #endif
       return RestrictFcntlCommands(sb);
 
+    case __NR_futex:
+      return RestrictFutexCommands(sb);
+
 #if defined(__x86_64__)
     case __NR_mmap:
 #endif
 #if defined(__i386__) || defined(__arm__)
     case __NR_mmap2:
 #endif
       return RestrictMmap(sb);
     case __NR_mprotect:
       return RestrictMemoryProtection(sb, 2);
 
@@ skipping 34 matching lines @@
       scoped_ptr<sandbox::SandboxBPFPolicy>(
           new nacl::nonsfi::NaClNonSfiBPFSandboxPolicy()));
   if (!sandbox_is_initialized)
     return false;
   RunSandboxSanityChecks();
   return true;
 }
 
 }  // namespace nonsfi
 }  // namespace nacl