OLD | NEW |
---|---|
1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 // Note: any code in this file MUST be async-signal safe. | 5 // Note: any code in this file MUST be async-signal safe. |
6 | 6 |
7 #include "sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.h" | 7 #include "sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.h" |
8 | 8 |
9 #include <unistd.h> | 9 #include <unistd.h> |
10 | 10 |
(...skipping 26 matching lines...) Expand all Loading... | |
37 // TODO(jln): query the current policy to check if send() is available and | 37 // TODO(jln): query the current policy to check if send() is available and |
38 // use it to perform a non-blocking write. | 38 // use it to perform a non-blocking write. |
39 const int ret = HANDLE_EINTR(write(STDERR_FILENO, error_message, size)); | 39 const int ret = HANDLE_EINTR(write(STDERR_FILENO, error_message, size)); |
40 // We can't handle any type of error here. | 40 // We can't handle any type of error here. |
41 if (ret <= 0 || static_cast<size_t>(ret) > size) break; | 41 if (ret <= 0 || static_cast<size_t>(ret) > size) break; |
42 size -= ret; | 42 size -= ret; |
43 error_message += ret; | 43 error_message += ret; |
44 } | 44 } |
45 } | 45 } |
46 | 46 |
47 // Invalid syscall values are truncated to zero. | |
48 // On architectures where base value is zero (Intel and Arm), | |
49 // syscall number is the same as offset from base. | |
50 // On architectures where base value is different than zero (Mips), | |
51 // we are truncating valid syscall value to offset from base. | |
jln (very slow on Chromium)
2014/05/28 00:06:57
Let's add the guarantee explicitly that sysno will
nedeljko
2014/05/28 09:33:43
for MIPS 0 to __NR_Linux_syscalls, for Intel/Arm 0
nedeljko
2014/05/29 14:06:45
Done.
| |
52 uint32_t SyscallNumberToOffsetFromBase(uint32_t sysno) { | |
53 #if defined(__mips__) | |
54 // On MIPS syscall numbers are in different range than on x86 and ARM. | |
55 // Valid MIPS O32 ABI syscall __NR_syscall will be truncated to zero for | |
56 // simlicity. | |
57 if (sysno > __NR_Linux && sysno <= __NR_Linux + __NR_Linux_syscalls) | |
58 sysno = sysno - __NR_Linux; | |
59 else | |
60 sysno = 0; | |
61 #else | |
62 if (sysno >= 1024) | |
jln (very slow on Chromium)
2014/05/28 00:06:57
Let's do this unconditionally. On MIPS, this shoul
nedeljko
2014/05/28 09:33:43
I am not sure that I understand you correctly.
If
jln (very slow on Chromium)
2014/06/03 01:00:33
The "if (sysno >= 1024) sysno = 0" should be kept
| |
63 sysno = 0; | |
64 #endif | |
65 return sysno; | |
66 } | |
67 | |
47 // Print a seccomp-bpf failure to handle |sysno| to stderr in an | 68 // Print a seccomp-bpf failure to handle |sysno| to stderr in an |
48 // async-signal safe way. | 69 // async-signal safe way. |
49 void PrintSyscallError(uint32_t sysno) { | 70 void PrintSyscallError(uint32_t sysno) { |
50 if (sysno >= 1024) | 71 |
51 sysno = 0; | 72 sysno = SyscallNumberToOffsetFromBase(sysno); |
73 | |
52 // TODO(markus): replace with async-signal safe snprintf when available. | 74 // TODO(markus): replace with async-signal safe snprintf when available. |
53 const size_t kNumDigits = 4; | 75 const size_t kNumDigits = 4; |
54 char sysno_base10[kNumDigits]; | 76 char sysno_base10[kNumDigits]; |
55 uint32_t rem = sysno; | 77 uint32_t rem = sysno; |
56 uint32_t mod = 0; | 78 uint32_t mod = 0; |
57 for (int i = kNumDigits - 1; i >= 0; i--) { | 79 for (int i = kNumDigits - 1; i >= 0; i--) { |
58 mod = rem % 10; | 80 mod = rem % 10; |
59 rem /= 10; | 81 rem /= 10; |
60 sysno_base10[i] = '0' + mod; | 82 sysno_base10[i] = '0' + mod; |
61 } | 83 } |
84 #if defined(__mips__) && (_MIPS_SIM == _MIPS_SIM_ABI32) | |
85 static const char kSeccompErrorPrefix[] = | |
86 __FILE__":**CRASHING**:" SECCOMP_MESSAGE_COMMON_CONTENT | |
87 " in syscall 4000 + "; | |
88 #else | |
62 static const char kSeccompErrorPrefix[] = | 89 static const char kSeccompErrorPrefix[] = |
63 __FILE__":**CRASHING**:" SECCOMP_MESSAGE_COMMON_CONTENT " in syscall "; | 90 __FILE__":**CRASHING**:" SECCOMP_MESSAGE_COMMON_CONTENT " in syscall "; |
91 #endif | |
64 static const char kSeccompErrorPostfix[] = "\n"; | 92 static const char kSeccompErrorPostfix[] = "\n"; |
65 WriteToStdErr(kSeccompErrorPrefix, sizeof(kSeccompErrorPrefix) - 1); | 93 WriteToStdErr(kSeccompErrorPrefix, sizeof(kSeccompErrorPrefix) - 1); |
66 WriteToStdErr(sysno_base10, sizeof(sysno_base10)); | 94 WriteToStdErr(sysno_base10, sizeof(sysno_base10)); |
67 WriteToStdErr(kSeccompErrorPostfix, sizeof(kSeccompErrorPostfix) - 1); | 95 WriteToStdErr(kSeccompErrorPostfix, sizeof(kSeccompErrorPostfix) - 1); |
68 } | 96 } |
69 | 97 |
70 } // namespace. | 98 } // namespace. |
71 | 99 |
72 namespace sandbox { | 100 namespace sandbox { |
73 | 101 |
74 intptr_t CrashSIGSYS_Handler(const struct arch_seccomp_data& args, void* aux) { | 102 intptr_t CrashSIGSYS_Handler(const struct arch_seccomp_data& args, void* aux) { |
75 uint32_t syscall = args.nr; | 103 uint32_t syscall = args.nr; |
76 if (syscall >= 1024) | 104 |
77 syscall = 0; | |
78 PrintSyscallError(syscall); | 105 PrintSyscallError(syscall); |
jln (very slow on Chromium)
2014/05/28 00:06:57
The truncation here is important for security, as
nedeljko
2014/05/28 09:33:43
Calling SyscallNumberToOffsetFromBase() here is a
| |
79 | 106 |
80 // Encode 8-bits of the 1st two arguments too, so we can discern which socket | 107 // Encode 8-bits of the 1st two arguments too, so we can discern which socket |
81 // type, which fcntl, ... etc., without being likely to hit a mapped | 108 // type, which fcntl, ... etc., without being likely to hit a mapped |
82 // address. | 109 // address. |
83 // Do not encode more bits here without thinking about increasing the | 110 // Do not encode more bits here without thinking about increasing the |
84 // likelihood of collision with mapped pages. | 111 // likelihood of collision with mapped pages. |
85 syscall |= ((args.args[0] & 0xffUL) << 12); | 112 syscall |= ((args.args[0] & 0xffUL) << 12); |
86 syscall |= ((args.args[1] & 0xffUL) << 20); | 113 syscall |= ((args.args[1] & 0xffUL) << 20); |
87 // Purposefully dereference the syscall as an address so it'll show up very | 114 // Purposefully dereference the syscall as an address so it'll show up very |
88 // clearly and easily in crash dumps. | 115 // clearly and easily in crash dumps. |
(...skipping 89 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
178 | 205 |
179 const char* GetIoctlErrorMessageContentForTests() { | 206 const char* GetIoctlErrorMessageContentForTests() { |
180 return SECCOMP_MESSAGE_IOCTL_CONTENT; | 207 return SECCOMP_MESSAGE_IOCTL_CONTENT; |
181 } | 208 } |
182 | 209 |
183 const char* GetKillErrorMessageContentForTests() { | 210 const char* GetKillErrorMessageContentForTests() { |
184 return SECCOMP_MESSAGE_KILL_CONTENT; | 211 return SECCOMP_MESSAGE_KILL_CONTENT; |
185 } | 212 } |
186 | 213 |
187 } // namespace sandbox. | 214 } // namespace sandbox. |
OLD | NEW |