src/sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions_unittests.cc

   1 // Copyright 2014 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.h"
   6
   7 #include <errno.h>
   8 #include <sched.h>
   9 #include <sys/syscall.h>
  10 #include <time.h>
  11 #include <unistd.h>
  12
  13 #include "base/bind.h"
  14 #include "base/synchronization/waitable_event.h"
  15 #include "base/sys_info.h"
  16 #include "base/threading/thread.h"
  17 #include "base/time/time.h"
  18 #include "build/build_config.h"
  19 #include "sandbox/linux/bpf_dsl/bpf_dsl.h"
  20 #include "sandbox/linux/bpf_dsl/policy.h"
  21 #include "sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.h"
  22 #include "sandbox/linux/seccomp-bpf/bpf_tests.h"
  23 #include "sandbox/linux/seccomp-bpf/sandbox_bpf.h"
  24 #include "sandbox/linux/seccomp-bpf/syscall.h"
  25 #include "sandbox/linux/services/linux_syscalls.h"
  26 #include "sandbox/linux/tests/unit_tests.h"
  27
  28 #if !defined(OS_ANDROID)
  29 #include "third_party/lss/linux_syscall_support.h"  // for MAKE_PROCESS_CPUCLOCK
  30 #endif
  31
  32 namespace sandbox {
  33
  34 namespace {
  35
  36 // NOTE: most of the parameter restrictions are tested in
  37 // baseline_policy_unittest.cc as a more end-to-end test.
  38
  39 using sandbox::bpf_dsl::Allow;
  40 using sandbox::bpf_dsl::ResultExpr;
  41
  42 class RestrictClockIdPolicy : public bpf_dsl::Policy {
  43  public:
  44   RestrictClockIdPolicy() {}
  45   ~RestrictClockIdPolicy() override {}
  46
  47   ResultExpr EvaluateSyscall(int sysno) const override {
  48     switch (sysno) {
  49       case __NR_clock_gettime:
  50       case __NR_clock_getres:
  51         return RestrictClockID();
  52       default:
  53         return Allow();
  54     }
  55   }
  56 };
  57
  58 void CheckClock(clockid_t clockid) {
  59   struct timespec ts;
  60   ts.tv_sec = ts.tv_nsec = -1;
  61   BPF_ASSERT_EQ(0, clock_gettime(clockid, &ts));
  62   BPF_ASSERT_LE(0, ts.tv_sec);
  63   BPF_ASSERT_LE(0, ts.tv_nsec);
  64 }
  65
  66 BPF_TEST_C(ParameterRestrictions,
  67            clock_gettime_allowed,
  68            RestrictClockIdPolicy) {
  69   CheckClock(CLOCK_MONOTONIC);
  70   CheckClock(CLOCK_PROCESS_CPUTIME_ID);
  71   CheckClock(CLOCK_REALTIME);
  72   CheckClock(CLOCK_THREAD_CPUTIME_ID);
  73 }
  74
  75 BPF_DEATH_TEST_C(ParameterRestrictions,
  76                  clock_gettime_crash_monotonic_raw,
  77                  DEATH_SEGV_MESSAGE(sandbox::GetErrorMessageContentForTests()),
  78                  RestrictClockIdPolicy) {
  79   struct timespec ts;
  80   clock_gettime(CLOCK_MONOTONIC_RAW, &ts);
  81 }
  82
  83 #if defined(OS_CHROMEOS)
  84
  85 // A custom BPF tester delegate to run IsRunningOnChromeOS() before
  86 // the sandbox is enabled because we cannot run it with non-SFI BPF
  87 // sandbox enabled.
  88 class ClockSystemTesterDelegate : public sandbox::BPFTesterDelegate {
  89  public:
  90   ClockSystemTesterDelegate()
  91       : is_running_on_chromeos_(base::SysInfo::IsRunningOnChromeOS()) {}
  92   virtual ~ClockSystemTesterDelegate() {}
  93
  94   virtual scoped_ptr<sandbox::bpf_dsl::Policy> GetSandboxBPFPolicy() override {
  95     return scoped_ptr<sandbox::bpf_dsl::Policy>(new RestrictClockIdPolicy());
  96   }
  97   virtual void RunTestFunction() override {
  98     if (is_running_on_chromeos_) {
  99       CheckClock(base::TimeTicks::kClockSystemTrace);
 100     } else {
 101       struct timespec ts;
 102       // kClockSystemTrace is 11, which is CLOCK_THREAD_CPUTIME_ID of
 103       // the init process (pid=1). If kernel supports this feature,
 104       // this may succeed even if this is not running on Chrome OS. We
 105       // just check this clock_gettime call does not crash.
 106       clock_gettime(base::TimeTicks::kClockSystemTrace, &ts);
 107     }
 108   }
 109
 110  private:
 111   const bool is_running_on_chromeos_;
 112   DISALLOW_COPY_AND_ASSIGN(ClockSystemTesterDelegate);
 113 };
 114
 115 BPF_TEST_D(BPFTest, BPFTestWithDelegateClass, ClockSystemTesterDelegate);
 116
 117 #elif defined(OS_LINUX)
 118
 119 BPF_DEATH_TEST_C(ParameterRestrictions,
 120                  clock_gettime_crash_system_trace,
 121                  DEATH_SEGV_MESSAGE(sandbox::GetErrorMessageContentForTests()),
 122                  RestrictClockIdPolicy) {
 123   struct timespec ts;
 124   clock_gettime(base::TimeTicks::kClockSystemTrace, &ts);
 125 }
 126
 127 #endif  // defined(OS_CHROMEOS)
 128
 129 #if !defined(OS_ANDROID)
 130 BPF_DEATH_TEST_C(ParameterRestrictions,
 131                  clock_gettime_crash_cpu_clock,
 132                  DEATH_SEGV_MESSAGE(sandbox::GetErrorMessageContentForTests()),
 133                  RestrictClockIdPolicy) {
 134   // We can't use clock_getcpuclockid() because it's not implemented in newlib,
 135   // and it might not work inside the sandbox anyway.
 136   const pid_t kInitPID = 1;
 137   const clockid_t kInitCPUClockID =
 138       MAKE_PROCESS_CPUCLOCK(kInitPID, CPUCLOCK_SCHED);
 139
 140   struct timespec ts;
 141   clock_gettime(kInitCPUClockID, &ts);
 142 }
 143 #endif  // !defined(OS_ANDROID)
 144
 145 class RestrictSchedPolicy : public bpf_dsl::Policy {
 146  public:
 147   RestrictSchedPolicy() {}
 148   ~RestrictSchedPolicy() override {}
 149
 150   ResultExpr EvaluateSyscall(int sysno) const override {
 151     switch (sysno) {
 152       case __NR_sched_getparam:
 153         return RestrictSchedTarget(getpid(), sysno);
 154       default:
 155         return Allow();
 156     }
 157   }
 158 };
 159
 160 void CheckSchedGetParam(pid_t pid, struct sched_param* param) {
 161   BPF_ASSERT_EQ(0, sched_getparam(pid, param));
 162 }
 163
 164 void SchedGetParamThread(base::WaitableEvent* thread_run) {
 165   const pid_t pid = getpid();
 166   const pid_t tid = syscall(__NR_gettid);
 167   BPF_ASSERT_NE(pid, tid);
 168
 169   struct sched_param current_pid_param;
 170   CheckSchedGetParam(pid, &current_pid_param);
 171
 172   struct sched_param zero_param;
 173   CheckSchedGetParam(0, &zero_param);
 174
 175   struct sched_param tid_param;
 176   CheckSchedGetParam(tid, &tid_param);
 177
 178   BPF_ASSERT_EQ(zero_param.sched_priority, tid_param.sched_priority);
 179
 180   // Verify that the SIGSYS handler sets errno properly.
 181   errno = 0;
 182   BPF_ASSERT_EQ(-1, sched_getparam(tid, NULL));
 183   BPF_ASSERT_EQ(EINVAL, errno);
 184
 185   thread_run->Signal();
 186 }
 187
 188 BPF_TEST_C(ParameterRestrictions,
 189            sched_getparam_allowed,
 190            RestrictSchedPolicy) {
 191   base::WaitableEvent thread_run(true, false);
 192   // Run the actual test in a new thread so that the current pid and tid are
 193   // different.
 194   base::Thread getparam_thread("sched_getparam_thread");
 195   BPF_ASSERT(getparam_thread.Start());
 196   getparam_thread.message_loop()->PostTask(
 197       FROM_HERE, base::Bind(&SchedGetParamThread, &thread_run));
 198   BPF_ASSERT(thread_run.TimedWait(base::TimeDelta::FromMilliseconds(5000)));
 199   getparam_thread.Stop();
 200 }
 201
 202 BPF_DEATH_TEST_C(ParameterRestrictions,
 203                  sched_getparam_crash_non_zero,
 204                  DEATH_SEGV_MESSAGE(sandbox::GetErrorMessageContentForTests()),
 205                  RestrictSchedPolicy) {
 206   const pid_t kInitPID = 1;
 207   struct sched_param param;
 208   sched_getparam(kInitPID, &param);
 209 }
 210
 211 }  // namespace
 212
 213 }  // namespace sandbox