Convert sandbox_bpf_unittest.cc to use bpf_dsl

sandbox/linux/bpf_dsl/bpf_dsl.h

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef SANDBOX_LINUX_BPF_DSL_BPF_DSL_H_
 #define SANDBOX_LINUX_BPF_DSL_BPF_DSL_H_
 
 #include <stdint.h>
 
 #include <utility>
@@ skipping 42 matching lines @@
 //            return Allow();
 //          }
 //        }
 //
 //       private:
 //        DISALLOW_COPY_AND_ASSIGN(SillyPolicy);
 //      };
 //
 // More generally, the DSL currently supports the following grammar:
 //
-//   result = Allow() | Error(errno) | Trap(trap_func, aux)
+//   result = Allow() | Error(errno) | Kill(msg) | Trace(aux)
+//          | Trap(trap_func, aux) | UnsafeTrap(trap_func, aux)
 //          | If(bool, result)[.ElseIf(bool, result)].Else(result)
 //          | Switch(arg)[.Case(val, result)].Default(result)
 //   bool   = BoolConst(boolean) | !bool | bool && bool | bool || bool
-//          | arg == val
+//          | arg == val | arg != val

[jln (very slow on Chromium), 2014/09/12 23:52:57]

Please add a small test for this one.

[mdempsky, 2014/09/13 00:20:24]

Done.

 //   arg    = Arg<T>(num) | arg & mask
 //
 // The semantics of each function and operator are intended to be
 // intuitive, but are described in more detail below.
 //
 // (Credit to Sean Parent's "Inheritance is the Base Class of Evil"
 // talk at Going Native 2013 for promoting value semantics via shared
 // pointers to immutable state.)
 
 namespace sandbox {
@@ skipping 28 matching lines @@
   virtual ResultExpr InvalidSyscall() const;
 
   // Override implementations from SandboxBPFPolicy.  Marked as FINAL
   // to prevent mixups with child classes accidentally overloading
   // these instead of the above methods.
   virtual ErrorCode EvaluateSyscall(SandboxBPF* sb,
                                     int sysno) const OVERRIDE FINAL;
   virtual ErrorCode InvalidSyscall(SandboxBPF* sb) const OVERRIDE FINAL;
 
   // Helper method so policies can just write Trap(func, aux).
-  static ResultExpr Trap(Trap::TrapFnc trap_func, void* aux);
+  static ResultExpr Trap(Trap::TrapFnc trap_func, const void* aux);
 
  private:
   DISALLOW_COPY_AND_ASSIGN(SandboxBPFDSLPolicy);
 };
 
 // Allow specifies a result that the system call should be allowed to
 // execute normally.
 SANDBOX_EXPORT ResultExpr Allow();
 
 // Error specifies a result that the system call should fail with
 // error number |err|.  As a special case, Error(0) will result in the
 // system call appearing to have succeeded, but without having any
 // side effects.
 SANDBOX_EXPORT ResultExpr Error(int err);
 
+// Kill specifies a result to kill the program and print an error message.
+SANDBOX_EXPORT ResultExpr Kill(const char* msg);
+
+// Trace specifies a result to notify a tracing process via the
+// PTRACE_EVENT_SECCOMP event and allow it to change or skip the system call.
+// The value of |aux| will be available to the tracer via PTRACE_GETEVENTMSG.
+SANDBOX_EXPORT ResultExpr Trace(uint16_t aux);
+
 // Trap specifies a result that the system call should be handled by
 // trapping back into userspace and invoking |trap_func|, passing
 // |aux| as the second parameter.
-SANDBOX_EXPORT ResultExpr Trap(Trap::TrapFnc trap_func, void* aux);
+SANDBOX_EXPORT ResultExpr Trap(Trap::TrapFnc trap_func, const void* aux);
+
+// UnsafeTrap is like Trap, except the policy is marked as "unsafe"
+// and allowed to use SandboxSyscall to invoke any system call.
+//
+// NOTE: This feature, by definition, disables all security features of
+//   the sandbox. It should never be used in production, but it can be
+//   very useful to diagnose code that is incompatible with the sandbox.
+//   If even a single system call returns "UnsafeTrap", the security of
+//   entire sandbox should be considered compromised.
+SANDBOX_EXPORT ResultExpr UnsafeTrap(Trap::TrapFnc trap_func, const void* aux);
+
+// BoolConst converts a bool value into a BoolExpr.
+SANDBOX_EXPORT BoolExpr BoolConst(bool value);
+
+// Various ways to combine boolean expressions into more complex expressions.
+// They follow standard boolean algebra laws.
+SANDBOX_EXPORT BoolExpr operator!(const BoolExpr& cond);
+SANDBOX_EXPORT BoolExpr operator&&(const BoolExpr& lhs, const BoolExpr& rhs);
+SANDBOX_EXPORT BoolExpr operator||(const BoolExpr& lhs, const BoolExpr& rhs);
 
 template <typename T>
 class SANDBOX_EXPORT Arg {
  public:
   // Initializes the Arg to represent the |num|th system call
   // argument (indexed from 0), which is of type |T|.
   explicit Arg(int num);
 
   Arg(const Arg& arg) : num_(arg.num_), mask_(arg.mask_) {}
 
   // Returns an Arg representing the current argument, but after
   // bitwise-and'ing it with |rhs|.
   friend Arg operator&(const Arg& lhs, uint64_t rhs) {
     return Arg(lhs.num_, lhs.mask_ & rhs);
   }
 
-  // Returns a boolean expression comparing whether the system call
-  // argument (after applying any bitmasks, if appropriate) equals |rhs|.
+  // Returns a boolean expression comparing whether the system call argument
+  // (after applying any bitmasks, if appropriate) equals |rhs|.
   friend BoolExpr operator==(const Arg& lhs, T rhs) { return lhs.EqualTo(rhs); }
 
+  // Returns a boolean expression comparing whether the system call argument
+  // (after applying any bitmasks, if appropriate) does not equal |rhs|.
+  friend BoolExpr operator!=(const Arg& lhs, T rhs) { return !(lhs == rhs); }
+
  private:
   Arg(int num, uint64_t mask) : num_(num), mask_(mask) {}
 
   BoolExpr EqualTo(T val) const;
 
   int num_;
   uint64_t mask_;
 
   DISALLOW_ASSIGN(Arg);
 };
 
-// Convert a bool value into a BoolExpr.
-SANDBOX_EXPORT BoolExpr BoolConst(bool value);
-
-// Various ways to combine boolean expressions into more complex expressions.
-// They follow standard boolean algebra laws.
-SANDBOX_EXPORT BoolExpr operator!(const BoolExpr& cond);
-SANDBOX_EXPORT BoolExpr operator&&(const BoolExpr& lhs, const BoolExpr& rhs);
-SANDBOX_EXPORT BoolExpr operator||(const BoolExpr& lhs, const BoolExpr& rhs);
-
 // If begins a conditional result expression predicated on the
 // specified boolean expression.
 SANDBOX_EXPORT Elser If(const BoolExpr& cond, const ResultExpr& then_result);
 
 class SANDBOX_EXPORT Elser {
  public:
   Elser(const Elser& elser);
   ~Elser();
 
   // ElseIf extends the conditional result expression with another
@@ skipping 171 matching lines @@
 
 template <typename T>
 ResultExpr Caser<T>::Default(ResultExpr result) const {
   return elser_.Else(result);
 }
 
 }  // namespace bpf_dsl
 }  // namespace sandbox
 
 #endif  // SANDBOX_LINUX_BPF_DSL_BPF_DSL_H_