sandbox_bpf: rework how unsafe traps are compiled/verified

sandbox_bpf: rework how unsafe traps are compiled/verified

One tricky quirk of unsafe traps is we can't use SECCOMP_RET_ERROR,
otherwise the unsafe trap handlers won't be able to make use of the
filtered system calls.  To workaround this, when unsafe traps are
enabled, we use a "ReturnErrno" trap instead of SECCOMP_RET_ERROR,
and the SIGSYS signal handler instead decides whether to allow the
system call or run the trap handler (i.e., return an error).

Currently, SandboxBPF implements this in a very roundabout manner
though: it compiles the policy normally, searches the compiled
instructions for any trap returns that corresponded to an unsafe trap,
then rewrites any error instructions to also use traps.  This is
further complicated by the verifier, because it then needs a policy
wrapper so the verifier wouldn't be surprised when an "error" was
actually compiled as a "trap".  (That policy wrapper is also the last
SandboxBPFPolicy, and not amenable to conversion to use bpf_dsl.)

This CL changes things to upfront check if the policy uses any unsafe
traps; and if so, it directly compiles "Error(x)" into a trap instead
of using SECCOMP_RET_ERROR.

BUG=414363
Committed: https://crrev.com/6c20e4dde6b5c8d7594d3576ed1bbbe97586fb58
Cr-Commit-Position: refs/heads/master@{#298763}

[mdempsky, 2014-10-04 01:00:46]

mdempsky@chromium.org changed reviewers:
+ jln@chromium.org, rickyz@chromium.org

[rickyz (no longer on Chrome), 2014-10-07 00:29:05]

lgtm

Ah yeah, I remember noticing that the scope of the rewriting changed on that
last review. This is a way nicer way of allowing syscalls in unsafe traps.

[jln (very slow on Chromium), 2014-10-08 17:31:32]

lgtm, much better! :)

https://chromiumcodereview.appspot.com/628823003/diff/20001/sandbox/linux/bpf...
File sandbox/linux/bpf_dsl/bpf_dsl.cc (right):

https://chromiumcodereview.appspot.com/628823003/diff/20001/sandbox/linux/bpf...
sandbox/linux/bpf_dsl/bpf_dsl.cc:394: EvaluateSyscall(sysnum)->HasUnsafeTraps())
Nit: {}

[mdempsky, 2014-10-08 17:34:19]

Thanks guys!

https://codereview.chromium.org/628823003/diff/20001/sandbox/linux/bpf_dsl/bp...
File sandbox/linux/bpf_dsl/bpf_dsl.cc (right):

https://codereview.chromium.org/628823003/diff/20001/sandbox/linux/bpf_dsl/bp...
sandbox/linux/bpf_dsl/bpf_dsl.cc:394: EvaluateSyscall(sysnum)->HasUnsafeTraps())
On 2014/10/08 17:31:32, jln (slow on IPC reviews) wrote:
> Nit: {}

Done.

[mdempsky, 2014-10-08 17:34:22]

The CQ bit was checked by mdempsky@chromium.org

[commit-bot: I haz the power, 2014-10-08 17:34:50]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/628823003/40001

[commit-bot: I haz the power, 2014-10-08 17:39:36]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2014-10-08 17:39:37]

Try jobs failed on following builders:
  linux_gpu on tryserver.chromium.gpu
(http://build.chromium.org/p/tryserver.chromium.gpu/builders/linux_gpu/builds/...)
  mac_gpu on tryserver.chromium.gpu
(http://build.chromium.org/p/tryserver.chromium.gpu/builders/mac_gpu/builds/66058)
  win_gpu on tryserver.chromium.gpu
(http://build.chromium.org/p/tryserver.chromium.gpu/builders/win_gpu/builds/70887)
  android_aosp on tryserver.chromium.linux
(http://build.chromium.org/p/tryserver.chromium.linux/builders/android_aosp/bu...)
  android_arm64_dbg_recipe on tryserver.chromium.linux
(http://build.chromium.org/p/tryserver.chromium.linux/builders/android_arm64_d...)
  android_chromium_gn_compile_dbg on tryserver.chromium.linux
(http://build.chromium.org/p/tryserver.chromium.linux/builders/android_chromiu...)
  android_chromium_gn_compile_rel on tryserver.chromium.linux
(http://build.chromium.org/p/tryserver.chromium.linux/builders/android_chromiu...)
  android_clang_dbg_recipe on tryserver.chromium.linux
(http://build.chromium.org/p/tryserver.chromium.linux/builders/android_clang_d...)
  chromium_presubmit on tryserver.chromium.linux
(http://build.chromium.org/p/tryserver.chromium.linux/builders/chromium_presub...)
  linux_chromium_chromeos_rel_swarming on tryserver.chromium.linux
(http://build.chromium.org/p/tryserver.chromium.linux/builders/linux_chromium_...)
  linux_chromium_gn_dbg on tryserver.chromium.linux
(http://build.chromium.org/p/tryserver.chromium.linux/builders/linux_chromium_...)
  linux_chromium_gn_rel on tryserver.chromium.linux
(http://build.chromium.org/p/tryserver.chromium.linux/builders/linux_chromium_...)
  linux_chromium_rel_swarming on tryserver.chromium.linux
(http://build.chromium.org/p/tryserver.chromium.linux/builders/linux_chromium_...)
  ios_rel_device_ninja on tryserver.chromium.mac
(http://build.chromium.org/p/tryserver.chromium.mac/builders/ios_rel_device_ni...)
  win8_chromium_rel on tryserver.chromium.win
(http://build.chromium.org/p/tryserver.chromium.win/builders/win8_chromium_rel...)
  win_chromium_x64_rel_swarming on tryserver.chromium.win
(http://build.chromium.org/p/tryserver.chromium.win/builders/win_chromium_x64_...)

[mdempsky, 2014-10-08 17:51:41]

The CQ bit was checked by mdempsky@chromium.org

[commit-bot: I haz the power, 2014-10-08 17:52:55]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/628823003/60001

[commit-bot: I haz the power, 2014-10-09 04:34:34]

Committed patchset #4 (id:60001) as d26e8ecfb2b4e8cadda954a32d869efa53097d71

[commit-bot: I haz the power, 2014-10-09 04:35:50]

Patchset 4 (id:??) landed as
https://crrev.com/6c20e4dde6b5c8d7594d3576ed1bbbe97586fb58
Cr-Commit-Position: refs/heads/master@{#298763}