content/common/sandbox_seccomp_bpf_linux.cc

   1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include <asm/unistd.h>
   6 #include <dlfcn.h>
   7 #include <errno.h>
   8 #include <fcntl.h>
   9 #include <linux/audit.h>
  10 #include <linux/filter.h>
  11 #include <signal.h>
  12 #include <string.h>
  13 #include <sys/prctl.h>
  14 #include <sys/stat.h>
  15 #include <sys/types.h>
  16 #include <ucontext.h>
  17 #include <unistd.h>
  18
  19 #include <vector>
  20
  21 #include "base/command_line.h"
  22 #include "base/logging.h"
  23 #include "content/common/sandbox_linux.h"
  24 #include "content/common/sandbox_seccomp_bpf_linux.h"
  25 #include "content/public/common/content_switches.h"
  26 #include "sandbox/linux/services/broker_process.h"
  27
  28 // These are the only architectures supported for now.
  29 #if defined(__i386__) || defined(__x86_64__) || \
  30     (defined(__arm__) && (defined(__thumb__) || defined(__ARM_EABI__)))
  31 #define SECCOMP_BPF_SANDBOX
  32 #endif
  33
  34 #if defined(SECCOMP_BPF_SANDBOX)
  35 #include "sandbox/linux/seccomp-bpf/sandbox_bpf.h"
  36 #include "sandbox/linux/services/linux_syscalls.h"
  37
  38 using playground2::arch_seccomp_data;
  39 using playground2::ErrorCode;
  40 using playground2::Sandbox;
  41 using sandbox::BrokerProcess;
  42
  43 namespace {
  44
  45 void StartSandboxWithPolicy(Sandbox::EvaluateSyscall syscall_policy,
  46                             BrokerProcess* broker_process);
  47
  48 inline bool IsChromeOS() {
  49 #if defined(OS_CHROMEOS)
  50   return true;
  51 #else
  52   return false;
  53 #endif
  54 }
  55
  56 inline bool IsArchitectureX86_64() {
  57 #if defined(__x86_64__)
  58   return true;
  59 #else
  60   return false;
  61 #endif
  62 }
  63
  64 inline bool IsArchitectureI386() {
  65 #if defined(__i386__)
  66   return true;
  67 #else
  68   return false;
  69 #endif
  70 }
  71
  72 inline bool IsArchitectureArm() {
  73 #if defined(__arm__)
  74   return true;
  75 #else
  76   return false;
  77 #endif
  78 }
  79
  80 intptr_t CrashSIGSYS_Handler(const struct arch_seccomp_data& args, void* aux) {
  81   int syscall = args.nr;
  82   if (syscall >= 1024)
  83     syscall = 0;
  84   // Encode 8-bits of the 1st two arguments too, so we can discern which socket
  85   // type, which fcntl, ... etc., without being likely to hit a mapped
  86   // address.
  87   // Do not encode more bits here without thinking about increasing the
  88   // likelihood of collision with mapped pages.
  89   syscall |= ((args.args[0] & 0xffUL) << 12);
  90   syscall |= ((args.args[1] & 0xffUL) << 20);
  91   // Purposefully dereference the syscall as an address so it'll show up very
  92   // clearly and easily in crash dumps.
  93   volatile char* addr = reinterpret_cast<volatile char*>(syscall);
  94   *addr = '\0';
  95   // In case we hit a mapped address, hit the null page with just the syscall,
  96   // for paranoia.
  97   syscall &= 0xfffUL;
  98   addr = reinterpret_cast<volatile char*>(syscall);
  99   *addr = '\0';
 100   for (;;)
 101     _exit(1);
 102 }
 103
 104 bool IsAcceleratedVideoDecodeEnabled() {
 105   // Accelerated video decode is currently enabled on Chrome OS,
 106   // but not on Linux: crbug.com/137247.
 107   bool is_enabled = IsChromeOS();
 108
 109   const CommandLine& command_line = *CommandLine::ForCurrentProcess();
 110   is_enabled = is_enabled &&
 111       !command_line.HasSwitch(switches::kDisableAcceleratedVideoDecode);
 112
 113   return is_enabled;
 114 }
 115
 116 intptr_t GpuOpenSIGSYS_Handler(const struct arch_seccomp_data& args,
 117                                void* aux_broker_process) {
 118   RAW_CHECK(aux_broker_process);
 119   BrokerProcess* broker_process =
 120       static_cast<BrokerProcess*>(aux_broker_process);
 121   switch(args.nr) {
 122     case __NR_open:
 123       return broker_process->Open(reinterpret_cast<const char*>(args.args[0]),
 124                                   static_cast<int>(args.args[1]));
 125     case __NR_openat:
 126       // Allow using openat() as open().
 127       if (static_cast<int>(args.args[0]) == AT_FDCWD) {
 128         return
 129             broker_process->Open(reinterpret_cast<const char*>(args.args[1]),
 130                                  static_cast<int>(args.args[2]));
 131       } else {
 132         return -EPERM;
 133       }
 134     default:
 135       RAW_CHECK(false);
 136       return -ENOSYS;
 137   }
 138 }
 139
 140 // The functions below cover all existing i386, x86_64, and ARM system calls;
 141 // excluding syscalls made obsolete in ARM EABI.
 142 // The implicitly defined sets form a partition of the sets of
 143 // system calls.
 144
 145 // TODO(jln) we need to restrict the first parameter!
 146 bool IsKill(int sysno) {
 147   switch (sysno) {
 148     case __NR_kill:
 149     case __NR_tkill:
 150     case __NR_tgkill:
 151       return true;
 152     default:
 153       return false;
 154   }
 155 }
 156
 157 bool IsAllowedGettime(int sysno) {
 158   switch (sysno) {
 159     case __NR_clock_gettime:
 160     case __NR_gettimeofday:
 161 #if defined(__i386__) || defined(__x86_64__)
 162     case __NR_time:
 163 #endif
 164       return true;
 165     case __NR_adjtimex:         // Privileged.
 166     case __NR_clock_adjtime:    // Privileged.
 167     case __NR_clock_getres:     // Could be allowed.
 168     case __NR_clock_nanosleep:  // Could be allowed.
 169     case __NR_clock_settime:    // Privileged.
 170 #if defined(__i386__)
 171     case __NR_ftime:            // Obsolete.
 172 #endif
 173     case __NR_settimeofday:     // Privileged.
 174 #if defined(__i386__)
 175     case __NR_stime:
 176 #endif
 177     default:
 178       return false;
 179   }
 180 }
 181
 182 bool IsCurrentDirectory(int sysno) {
 183   switch (sysno)  {
 184     case __NR_getcwd:
 185     case __NR_chdir:
 186     case __NR_fchdir:
 187       return true;
 188     default:
 189       return false;
 190   }
 191 }
 192
 193 bool IsUmask(int sysno) {
 194   switch (sysno) {
 195     case __NR_umask:
 196       return true;
 197     default:
 198       return false;
 199   }
 200 }
 201
 202 // System calls that directly access the file system. They might acquire
 203 // a new file descriptor or otherwise perform an operation directly
 204 // via a path.
 205 // Both EPERM and ENOENT are valid errno unless otherwise noted in comment.
 206 bool IsFileSystem(int sysno) {
 207   switch (sysno) {
 208     case __NR_access:          // EPERM not a valid errno.
 209     case __NR_chmod:
 210     case __NR_chown:
 211 #if defined(__i386__) || defined(__arm__)
 212     case __NR_chown32:
 213 #endif
 214     case __NR_creat:
 215     case __NR_execve:
 216     case __NR_faccessat:       // EPERM not a valid errno.
 217     case __NR_fchmodat:
 218     case __NR_fchownat:        // Should be called chownat ?
 219 #if defined(__x86_64__)
 220     case __NR_newfstatat:      // fstatat(). EPERM not a valid errno.
 221 #elif defined(__i386__) || defined(__arm__)
 222     case __NR_fstatat64:
 223 #endif
 224     case __NR_futimesat:       // Should be called utimesat ?
 225     case __NR_lchown:
 226 #if defined(__i386__) || defined(__arm__)
 227     case __NR_lchown32:
 228 #endif
 229     case __NR_link:
 230     case __NR_linkat:
 231     case __NR_lookup_dcookie:  // ENOENT not a valid errno.
 232     case __NR_lstat:           // EPERM not a valid errno.
 233 #if defined(__i386__)
 234     case __NR_oldlstat:
 235 #endif
 236 #if defined(__i386__) || defined(__arm__)
 237     case __NR_lstat64:
 238 #endif
 239     case __NR_mkdir:
 240     case __NR_mkdirat:
 241     case __NR_mknod:
 242     case __NR_mknodat:
 243     case __NR_open:
 244     case __NR_openat:
 245     case __NR_readlink:        // EPERM not a valid errno.
 246     case __NR_readlinkat:
 247     case __NR_rename:
 248     case __NR_renameat:
 249     case __NR_rmdir:
 250     case __NR_stat:            // EPERM not a valid errno.
 251 #if defined(__i386__)
 252     case __NR_oldstat:
 253 #endif
 254 #if defined(__i386__) || defined(__arm__)
 255     case __NR_stat64:
 256 #endif
 257     case __NR_statfs:          // EPERM not a valid errno.
 258 #if defined(__i386__) || defined(__arm__)
 259     case __NR_statfs64:
 260 #endif
 261     case __NR_symlink:
 262     case __NR_symlinkat:
 263     case __NR_truncate:
 264 #if defined(__i386__) || defined(__arm__)
 265     case __NR_truncate64:
 266 #endif
 267     case __NR_unlink:
 268     case __NR_unlinkat:
 269     case __NR_uselib:          // Neither EPERM, nor ENOENT are valid errno.
 270     case __NR_ustat:           // Same as above. Deprecated.
 271 #if defined(__i386__) || defined(__x86_64__)
 272     case __NR_utime:
 273 #endif
 274     case __NR_utimensat:       // New.
 275     case __NR_utimes:
 276       return true;
 277     default:
 278       return false;
 279   }
 280 }
 281
 282 bool IsAllowedFileSystemAccessViaFd(int sysno) {
 283   switch (sysno) {
 284     case __NR_fstat:
 285 #if defined(__i386__) || defined(__arm__)
 286     case __NR_fstat64:
 287 #endif
 288       return true;
 289     // TODO(jln): these should be denied gracefully as well (moved below).
 290 #if defined(__i386__) || defined(__x86_64__)
 291     case __NR_fadvise64:        // EPERM not a valid errno.
 292 #endif
 293 #if defined(__i386__)
 294     case __NR_fadvise64_64:
 295 #endif
 296 #if defined(__arm__)
 297     case __NR_arm_fadvise64_64:
 298 #endif
 299     case __NR_fdatasync:        // EPERM not a valid errno.
 300     case __NR_flock:            // EPERM not a valid errno.
 301     case __NR_fstatfs:          // Give information about the whole filesystem.
 302 #if defined(__i386__) || defined(__arm__)
 303     case __NR_fstatfs64:
 304 #endif
 305     case __NR_fsync:            // EPERM not a valid errno.
 306 #if defined(__i386__)
 307     case __NR_oldfstat:
 308 #endif
 309 #if defined(__i386__) || defined(__x86_64__)
 310     case __NR_sync_file_range:      // EPERM not a valid errno.
 311 #elif defined(__arm__)
 312     case __NR_arm_sync_file_range:  // EPERM not a valid errno.
 313 #endif
 314     default:
 315       return false;
 316   }
 317 }
 318
 319 // EPERM is a good errno for any of these.
 320 bool IsDeniedFileSystemAccessViaFd(int sysno) {
 321   switch (sysno) {
 322     case __NR_fallocate:
 323     case __NR_fchmod:
 324     case __NR_fchown:
 325     case __NR_ftruncate:
 326 #if defined(__i386__) || defined(__arm__)
 327     case __NR_fchown32:
 328     case __NR_ftruncate64:
 329 #endif
 330     case __NR_getdents:         // EPERM not a valid errno.
 331     case __NR_getdents64:       // EPERM not a valid errno.
 332 #if defined(__i386__)
 333     case __NR_readdir:
 334 #endif
 335       return true;
 336     default:
 337       return false;
 338   }
 339 }
 340
 341 bool IsGetSimpleId(int sysno) {
 342   switch (sysno) {
 343     case __NR_capget:
 344     case __NR_getegid:
 345     case __NR_geteuid:
 346     case __NR_getgid:
 347     case __NR_getgroups:
 348     case __NR_getpid:
 349     case __NR_getppid:
 350     case __NR_getresgid:
 351     case __NR_getsid:
 352     case __NR_gettid:
 353     case __NR_getuid:
 354     case __NR_getresuid:
 355 #if defined(__i386__) || defined(__arm__)
 356     case __NR_getegid32:
 357     case __NR_geteuid32:
 358     case __NR_getgid32:
 359     case __NR_getgroups32:
 360     case __NR_getresgid32:
 361     case __NR_getresuid32:
 362     case __NR_getuid32:
 363 #endif
 364       return true;
 365     default:
 366       return false;
 367   }
 368 }
 369
 370 bool IsProcessPrivilegeChange(int sysno) {
 371   switch (sysno) {
 372     case __NR_capset:
 373 #if defined(__i386__) || defined(__x86_64__)
 374     case __NR_ioperm:  // Intel privilege.
 375     case __NR_iopl:    // Intel privilege.
 376 #endif
 377     case __NR_setfsgid:
 378     case __NR_setfsuid:
 379     case __NR_setgid:
 380     case __NR_setgroups:
 381     case __NR_setregid:
 382     case __NR_setresgid:
 383     case __NR_setresuid:
 384     case __NR_setreuid:
 385     case __NR_setuid:
 386 #if defined(__i386__) || defined(__arm__)
 387     case __NR_setfsgid32:
 388     case __NR_setfsuid32:
 389     case __NR_setgid32:
 390     case __NR_setgroups32:
 391     case __NR_setregid32:
 392     case __NR_setresgid32:
 393     case __NR_setresuid32:
 394     case __NR_setreuid32:
 395     case __NR_setuid32:
 396 #endif
 397       return true;
 398     default:
 399       return false;
 400   }
 401 }
 402
 403 bool IsProcessGroupOrSession(int sysno) {
 404   switch (sysno) {
 405     case __NR_setpgid:
 406     case __NR_getpgrp:
 407     case __NR_setsid:
 408     case __NR_getpgid:
 409       return true;
 410     default:
 411       return false;
 412   }
 413 }
 414
 415 bool IsAllowedSignalHandling(int sysno) {
 416   switch (sysno) {
 417     case __NR_rt_sigaction:
 418     case __NR_rt_sigprocmask:
 419     case __NR_rt_sigreturn:
 420 #if defined(__i386__) || defined(__arm__)
 421     case __NR_sigaction:
 422     case __NR_sigprocmask:
 423     case __NR_sigreturn:
 424 #endif
 425       return true;
 426     case __NR_rt_sigpending:
 427     case __NR_rt_sigqueueinfo:
 428     case __NR_rt_sigsuspend:
 429     case __NR_rt_sigtimedwait:
 430     case __NR_rt_tgsigqueueinfo:
 431     case __NR_sigaltstack:
 432     case __NR_signalfd:
 433     case __NR_signalfd4:
 434 #if defined(__i386__) || defined(__arm__)
 435     case __NR_sigpending:
 436     case __NR_sigsuspend:
 437 #endif
 438 #if defined(__i386__)
 439     case __NR_signal:
 440     case __NR_sgetmask:  // Obsolete.
 441     case __NR_ssetmask:
 442 #endif
 443     default:
 444       return false;
 445   }
 446 }
 447
 448 bool IsOperationOnFd(int sysno) {
 449   switch (sysno) {
 450     case __NR_close:
 451     case __NR_dup:
 452     case __NR_dup2:
 453     case __NR_dup3:
 454     case __NR_fcntl:  // TODO(jln): we may want to restrict arguments.
 455 #if defined(__i386__) || defined(__arm__)
 456     case __NR_fcntl64:
 457 #endif
 458 #if defined(__x86_64__) || defined(__arm__)
 459     case __NR_shutdown:
 460 #endif
 461       return true;
 462     default:
 463       return false;
 464   }
 465 }
 466
 467 bool IsKernelInternalApi(int sysno) {
 468   switch (sysno) {
 469     case __NR_restart_syscall:
 470 #if defined(__arm__)
 471     case __ARM_NR_cmpxchg:
 472 #endif
 473       return true;
 474     default:
 475       return false;
 476   }
 477 }
 478
 479 // This should be thought through in conjunction with IsFutex().
 480 bool IsAllowedProcessStartOrDeath(int sysno) {
 481   switch (sysno) {
 482     case __NR_clone:  // TODO(jln): restrict flags.
 483     case __NR_exit:
 484     case __NR_exit_group:
 485     case __NR_wait4:
 486     case __NR_waitid:
 487 #if defined(__i386__)
 488     case __NR_waitpid:
 489 #endif
 490       return true;
 491     case __NR_setns:  // Privileged.
 492     case __NR_fork:
 493 #if defined(__i386__) || defined(__x86_64__)
 494     case __NR_get_thread_area:
 495     case __NR_set_thread_area:
 496 #endif
 497     case __NR_set_tid_address:
 498     case __NR_unshare:
 499     case __NR_vfork:
 500     default:
 501       return false;
 502   }
 503 }
 504
 505 // It's difficult to restrict those, but there is attack surface here.
 506 bool IsFutex(int sysno) {
 507   switch (sysno) {
 508     case __NR_futex:
 509     case __NR_get_robust_list:
 510     case __NR_set_robust_list:
 511       return true;
 512     default:
 513       return false;
 514   }
 515 }
 516
 517 bool IsAllowedEpoll(int sysno) {
 518   switch (sysno) {
 519     case __NR_epoll_create:
 520     case __NR_epoll_create1:
 521     case __NR_epoll_ctl:
 522     case __NR_epoll_wait:
 523       return true;
 524     default:
 525 #if defined(__x86_64__)
 526     case __NR_epoll_ctl_old:
 527 #endif
 528     case __NR_epoll_pwait:
 529 #if defined(__x86_64__)
 530     case __NR_epoll_wait_old:
 531 #endif
 532       return false;
 533   }
 534 }
 535
 536 bool IsAllowedGetOrModifySocket(int sysno) {
 537   switch (sysno) {
 538     case __NR_pipe:
 539     case __NR_pipe2:
 540 #if defined(__x86_64__) || defined(__arm__)
 541     case __NR_socketpair:  // We will want to inspect its argument.
 542 #endif
 543       return true;
 544     default:
 545       return false;
 546   }
 547 }
 548
 549 bool IsDeniedGetOrModifySocket(int sysno) {
 550   switch (sysno) {
 551 #if defined(__x86_64__) || defined(__arm__)
 552     case __NR_accept:
 553     case __NR_accept4:
 554     case __NR_bind:
 555     case __NR_connect:
 556     case __NR_socket:
 557     case __NR_listen:
 558       return true;
 559 #endif
 560     default:
 561       return false;
 562   }
 563 }
 564
 565 #if defined(__i386__)
 566 // Big multiplexing system call for sockets.
 567 bool IsSocketCall(int sysno) {
 568   switch (sysno) {
 569     case __NR_socketcall:
 570       return true;
 571     default:
 572       return false;
 573   }
 574 }
 575 #endif
 576
 577 #if defined(__x86_64__) || defined(__arm__)
 578 bool IsNetworkSocketInformation(int sysno) {
 579   switch (sysno) {
 580     case __NR_getpeername:
 581     case __NR_getsockname:
 582     case __NR_getsockopt:
 583     case __NR_setsockopt:
 584       return true;
 585     default:
 586       return false;
 587   }
 588 }
 589 #endif
 590
 591 bool IsAllowedAddressSpaceAccess(int sysno) {
 592   switch (sysno) {
 593     case __NR_brk:
 594     case __NR_madvise:
 595     case __NR_mlock:
 596 #if defined(__i386__) || defined(__x86_64__)
 597     case __NR_mmap:   // TODO(jln): to restrict flags.
 598 #endif
 599 #if defined(__i386__) || defined(__arm__)
 600     case __NR_mmap2:
 601 #endif
 602     case __NR_mprotect:
 603     case __NR_munlock:
 604     case __NR_munmap:
 605       return true;
 606     case __NR_mincore:
 607     case __NR_mlockall:
 608 #if defined(__i386__) || defined(__x86_64__)
 609     case __NR_modify_ldt:
 610 #endif
 611     case __NR_mremap:
 612     case __NR_msync:
 613     case __NR_munlockall:
 614     case __NR_readahead:
 615     case __NR_remap_file_pages:
 616 #if defined(__i386__)
 617     case __NR_vm86:
 618     case __NR_vm86old:
 619 #endif
 620     default:
 621       return false;
 622   }
 623 }
 624
 625 bool IsAllowedGeneralIo(int sysno) {
 626   switch (sysno) {
 627     case __NR_lseek:
 628 #if defined(__i386__) || defined(__arm__)
 629     case __NR__llseek:
 630 #endif
 631     case __NR_poll:
 632     case __NR_ppoll:
 633     case __NR_pselect6:
 634     case __NR_read:
 635     case __NR_readv:
 636 #if defined(__arm__)
 637     case __NR_recv:
 638 #endif
 639 #if defined(__x86_64__) || defined(__arm__)
 640     case __NR_recvfrom:  // Could specify source.
 641     case __NR_recvmsg:   // Could specify source.
 642 #endif
 643 #if defined(__i386__) || defined(__x86_64__)
 644     case __NR_select:
 645 #endif
 646 #if defined(__i386__) || defined(__arm__)
 647     case __NR__newselect:
 648 #endif
 649 #if defined(__arm__)
 650     case __NR_send:
 651 #endif
 652 #if defined(__x86_64__) || defined(__arm__)
 653     case __NR_sendmsg:   // Could specify destination.
 654     case __NR_sendto:    // Could specify destination.
 655 #endif
 656     case __NR_write:
 657     case __NR_writev:
 658       return true;
 659     case __NR_ioctl:     // Can be very powerful.
 660     case __NR_pread64:
 661     case __NR_preadv:
 662     case __NR_pwrite64:
 663     case __NR_pwritev:
 664     case __NR_recvmmsg:  // Could specify source.
 665     case __NR_sendfile:
 666 #if defined(__i386__) || defined(__arm__)
 667     case __NR_sendfile64:
 668 #endif
 669     case __NR_sendmmsg:  // Could specify destination.
 670     case __NR_splice:
 671     case __NR_tee:
 672     case __NR_vmsplice:
 673     default:
 674       return false;
 675   }
 676 }
 677
 678 bool IsAllowedPrctl(int sysno) {
 679   switch (sysno) {
 680     case __NR_prctl:
 681       return true;
 682     default:
 683 #if defined(__x86_64__)
 684     case __NR_arch_prctl:
 685 #endif
 686       return false;
 687   }
 688 }
 689
 690 bool IsAllowedBasicScheduler(int sysno) {
 691   switch (sysno) {
 692     case __NR_sched_yield:
 693     case __NR_pause:
 694     case __NR_nanosleep:
 695       return true;
 696     case __NR_getpriority:
 697 #if defined(__i386__) || defined(__arm__)
 698     case __NR_nice:
 699 #endif
 700     case __NR_setpriority:
 701     default:
 702       return false;
 703   }
 704 }
 705
 706 bool IsAdminOperation(int sysno) {
 707   switch (sysno) {
 708 #if defined(__i386__) || defined(__arm__)
 709     case __NR_bdflush:
 710 #endif
 711     case __NR_kexec_load:
 712     case __NR_reboot:
 713     case __NR_setdomainname:
 714     case __NR_sethostname:
 715     case __NR_syslog:
 716       return true;
 717     default:
 718       return false;
 719   }
 720 }
 721
 722 bool IsKernelModule(int sysno) {
 723   switch (sysno) {
 724 #if defined(__i386__) || defined(__x86_64__)
 725     case __NR_create_module:
 726     case __NR_get_kernel_syms:  // Should ENOSYS.
 727     case __NR_query_module:
 728 #endif
 729     case __NR_delete_module:
 730     case __NR_init_module:
 731       return true;
 732     default:
 733       return false;
 734   }
 735 }
 736
 737 bool IsGlobalFSViewChange(int sysno) {
 738   switch (sysno) {
 739     case __NR_pivot_root:
 740     case __NR_chroot:
 741     case __NR_sync:
 742       return true;
 743     default:
 744       return false;
 745   }
 746 }
 747
 748 bool IsFsControl(int sysno) {
 749   switch (sysno) {
 750     case __NR_mount:
 751     case __NR_nfsservctl:
 752     case __NR_quotactl:
 753     case __NR_swapoff:
 754     case __NR_swapon:
 755 #if defined(__i386__)
 756     case __NR_umount:
 757 #endif
 758     case __NR_umount2:
 759       return true;
 760     default:
 761       return false;
 762   }
 763 }
 764
 765 bool IsNuma(int sysno) {
 766   switch (sysno) {
 767     case __NR_get_mempolicy:
 768     case __NR_getcpu:
 769     case __NR_mbind:
 770 #if defined(__i386__) || defined(__x86_64__)
 771     case __NR_migrate_pages:
 772 #endif
 773     case __NR_move_pages:
 774     case __NR_set_mempolicy:
 775       return true;
 776     default:
 777       return false;
 778   }
 779 }
 780
 781 bool IsMessageQueue(int sysno) {
 782   switch (sysno) {
 783     case __NR_mq_getsetattr:
 784     case __NR_mq_notify:
 785     case __NR_mq_open:
 786     case __NR_mq_timedreceive:
 787     case __NR_mq_timedsend:
 788     case __NR_mq_unlink:
 789       return true;
 790     default:
 791       return false;
 792   }
 793 }
 794
 795 bool IsGlobalProcessEnvironment(int sysno) {
 796   switch (sysno) {
 797     case __NR_acct:         // Privileged.
 798 #if defined(__i386__) || defined(__x86_64__)
 799     case __NR_getrlimit:
 800 #endif
 801 #if defined(__i386__) || defined(__arm__)
 802     case __NR_ugetrlimit:
 803 #endif
 804 #if defined(__i386__)
 805     case __NR_ulimit:
 806 #endif
 807     case __NR_getrusage:
 808     case __NR_personality:  // Can change its personality as well.
 809     case __NR_prlimit64:    // Like setrlimit / getrlimit.
 810     case __NR_setrlimit:
 811     case __NR_times:
 812       return true;
 813     default:
 814       return false;
 815   }
 816 }
 817
 818 bool IsDebug(int sysno) {
 819   switch (sysno) {
 820     case __NR_ptrace:
 821     case __NR_process_vm_readv:
 822     case __NR_process_vm_writev:
 823 #if defined(__i386__) || defined(__x86_64__)
 824     case __NR_kcmp:
 825 #endif
 826       return true;
 827     default:
 828       return false;
 829   }
 830 }
 831
 832 bool IsGlobalSystemStatus(int sysno) {
 833   switch (sysno) {
 834     case __NR__sysctl:
 835     case __NR_sysfs:
 836     case __NR_sysinfo:
 837     case __NR_uname:
 838 #if defined(__i386__)
 839     case __NR_olduname:
 840     case __NR_oldolduname:
 841 #endif
 842       return true;
 843     default:
 844       return false;
 845   }
 846 }
 847
 848 bool IsEventFd(int sysno) {
 849   switch (sysno) {
 850     case __NR_eventfd:
 851     case __NR_eventfd2:
 852       return true;
 853     default:
 854       return false;
 855   }
 856 }
 857
 858 // Asynchronous I/O API.
 859 bool IsAsyncIo(int sysno) {
 860   switch (sysno) {
 861     case __NR_io_cancel:
 862     case __NR_io_destroy:
 863     case __NR_io_getevents:
 864     case __NR_io_setup:
 865     case __NR_io_submit:
 866       return true;
 867     default:
 868       return false;
 869   }
 870 }
 871
 872 bool IsKeyManagement(int sysno) {
 873   switch (sysno) {
 874     case __NR_add_key:
 875     case __NR_keyctl:
 876     case __NR_request_key:
 877       return true;
 878     default:
 879       return false;
 880   }
 881 }
 882
 883 #if defined(__x86_64__) || defined(__arm__)
 884 bool IsSystemVSemaphores(int sysno) {
 885   switch (sysno) {
 886     case __NR_semctl:
 887     case __NR_semget:
 888     case __NR_semop:
 889     case __NR_semtimedop:
 890       return true;
 891     default:
 892       return false;
 893   }
 894 }
 895 #endif
 896
 897 #if defined(__x86_64__) || defined(__arm__)
 898 // These give a lot of ambient authority and bypass the setuid sandbox.
 899 bool IsSystemVSharedMemory(int sysno) {
 900   switch (sysno) {
 901     case __NR_shmat:
 902     case __NR_shmctl:
 903     case __NR_shmdt:
 904     case __NR_shmget:
 905       return true;
 906     default:
 907       return false;
 908   }
 909 }
 910 #endif
 911
 912 #if defined(__x86_64__) || defined(__arm__)
 913 bool IsSystemVMessageQueue(int sysno) {
 914   switch (sysno) {
 915     case __NR_msgctl:
 916     case __NR_msgget:
 917     case __NR_msgrcv:
 918     case __NR_msgsnd:
 919       return true;
 920     default:
 921       return false;
 922   }
 923 }
 924 #endif
 925
 926 #if defined(__i386__)
 927 // Big system V multiplexing system call.
 928 bool IsSystemVIpc(int sysno) {
 929   switch (sysno) {
 930     case __NR_ipc:
 931       return true;
 932     default:
 933       return false;
 934   }
 935 }
 936 #endif
 937
 938 bool IsAdvancedScheduler(int sysno) {
 939   switch (sysno) {
 940     case __NR_ioprio_get:  // IO scheduler.
 941     case __NR_ioprio_set:
 942     case __NR_sched_get_priority_max:
 943     case __NR_sched_get_priority_min:
 944     case __NR_sched_getaffinity:
 945     case __NR_sched_getparam:
 946     case __NR_sched_getscheduler:
 947     case __NR_sched_rr_get_interval:
 948     case __NR_sched_setaffinity:
 949     case __NR_sched_setparam:
 950     case __NR_sched_setscheduler:
 951       return true;
 952     default:
 953       return false;
 954   }
 955 }
 956
 957 bool IsInotify(int sysno) {
 958   switch (sysno) {
 959     case __NR_inotify_add_watch:
 960     case __NR_inotify_init:
 961     case __NR_inotify_init1:
 962     case __NR_inotify_rm_watch:
 963       return true;
 964     default:
 965       return false;
 966   }
 967 }
 968
 969 bool IsFaNotify(int sysno) {
 970   switch (sysno) {
 971     case __NR_fanotify_init:
 972     case __NR_fanotify_mark:
 973       return true;
 974     default:
 975       return false;
 976   }
 977 }
 978
 979 bool IsTimer(int sysno) {
 980   switch (sysno) {
 981     case __NR_getitimer:
 982 #if defined(__i386__) || defined(__x86_64__)
 983     case __NR_alarm:
 984 #endif
 985     case __NR_setitimer:
 986       return true;
 987     default:
 988       return false;
 989   }
 990 }
 991
 992 bool IsAdvancedTimer(int sysno) {
 993   switch (sysno) {
 994     case __NR_timer_create:
 995     case __NR_timer_delete:
 996     case __NR_timer_getoverrun:
 997     case __NR_timer_gettime:
 998     case __NR_timer_settime:
 999     case __NR_timerfd_create:
1000     case __NR_timerfd_gettime:
1001     case __NR_timerfd_settime:
1002       return true;
1003     default:
1004       return false;
1005   }
1006 }
1007
1008 bool IsExtendedAttributes(int sysno) {
1009   switch (sysno) {
1010     case __NR_fgetxattr:
1011     case __NR_flistxattr:
1012     case __NR_fremovexattr:
1013     case __NR_fsetxattr:
1014     case __NR_getxattr:
1015     case __NR_lgetxattr:
1016     case __NR_listxattr:
1017     case __NR_llistxattr:
1018     case __NR_lremovexattr:
1019     case __NR_lsetxattr:
1020     case __NR_removexattr:
1021     case __NR_setxattr:
1022       return true;
1023     default:
1024       return false;
1025   }
1026 }
1027
1028 // Various system calls that need to be researched.
1029 // TODO(jln): classify this better.
1030 bool IsMisc(int sysno) {
1031   switch (sysno) {
1032     case __NR_name_to_handle_at:
1033     case __NR_open_by_handle_at:
1034     case __NR_perf_event_open:
1035     case __NR_syncfs:
1036     case __NR_vhangup:
1037     // The system calls below are not implemented.
1038 #if defined(__i386__) || defined(__x86_64__)
1039     case __NR_afs_syscall:
1040 #endif
1041 #if defined(__i386__)
1042     case __NR_break:
1043 #endif
1044 #if defined(__i386__) || defined(__x86_64__)
1045     case __NR_getpmsg:
1046 #endif
1047 #if defined(__i386__)
1048     case __NR_gtty:
1049     case __NR_idle:
1050     case __NR_lock:
1051     case __NR_mpx:
1052     case __NR_prof:
1053     case __NR_profil:
1054 #endif
1055 #if defined(__i386__) || defined(__x86_64__)
1056     case __NR_putpmsg:
1057 #endif
1058 #if defined(__x86_64__)
1059     case __NR_security:
1060 #endif
1061 #if defined(__i386__)
1062     case __NR_stty:
1063 #endif
1064 #if defined(__x86_64__)
1065     case __NR_tuxcall:
1066 #endif
1067     case __NR_vserver:
1068       return true;
1069     default:
1070       return false;
1071   }
1072 }
1073
1074 #if defined(__arm__)
1075 bool IsArmPciConfig(int sysno) {
1076   switch (sysno) {
1077     case __NR_pciconfig_iobase:
1078     case __NR_pciconfig_read:
1079     case __NR_pciconfig_write:
1080       return true;
1081     default:
1082       return false;
1083   }
1084 }
1085
1086 bool IsArmPrivate(int sysno) {
1087   switch (sysno) {
1088     case __ARM_NR_breakpoint:
1089     case __ARM_NR_cacheflush:
1090     case __ARM_NR_set_tls:
1091     case __ARM_NR_usr26:
1092     case __ARM_NR_usr32:
1093       return true;
1094     default:
1095       return false;
1096   }
1097 }
1098 #endif  // defined(__arm__)
1099
1100 // End of the system call sets section.
1101
1102 bool IsBaselinePolicyAllowed(int sysno) {
1103   if (IsAllowedAddressSpaceAccess(sysno) ||
1104       IsAllowedBasicScheduler(sysno) ||
1105       IsAllowedEpoll(sysno) ||
1106       IsAllowedFileSystemAccessViaFd(sysno) ||
1107       IsAllowedGeneralIo(sysno) ||
1108       IsAllowedGetOrModifySocket(sysno) ||
1109       IsAllowedGettime(sysno) ||
1110       IsAllowedPrctl(sysno) ||
1111       IsAllowedProcessStartOrDeath(sysno) ||
1112       IsAllowedSignalHandling(sysno) ||
1113       IsFutex(sysno) ||
1114       IsGetSimpleId(sysno) ||
1115       IsKernelInternalApi(sysno) ||
1116 #if defined(__arm__)
1117       IsArmPrivate(sysno) ||
1118 #endif
1119       IsKill(sysno) ||
1120       IsOperationOnFd(sysno)) {
1121     return true;
1122   } else {
1123     return false;
1124   }
1125 }
1126
1127 // System calls that will trigger the crashing SIGSYS handler.
1128 bool IsBaselinePolicyWatched(int sysno) {
1129   if (IsAdminOperation(sysno) ||
1130       IsAdvancedScheduler(sysno) ||
1131       IsAdvancedTimer(sysno) ||
1132       IsAsyncIo(sysno) ||
1133       IsDebug(sysno) ||
1134       IsEventFd(sysno) ||
1135       IsExtendedAttributes(sysno) ||
1136       IsFaNotify(sysno) ||
1137       IsFsControl(sysno) ||
1138       IsGlobalFSViewChange(sysno) ||
1139       IsGlobalProcessEnvironment(sysno) ||
1140       IsGlobalSystemStatus(sysno) ||
1141       IsInotify(sysno) ||
1142       IsKernelModule(sysno) ||
1143       IsKeyManagement(sysno) ||
1144       IsMessageQueue(sysno) ||
1145       IsMisc(sysno) ||
1146 #if defined(__x86_64__)
1147       IsNetworkSocketInformation(sysno) ||
1148 #endif
1149       IsNuma(sysno) ||
1150       IsProcessGroupOrSession(sysno) ||
1151       IsProcessPrivilegeChange(sysno) ||
1152 #if defined(__i386__)
1153       IsSocketCall(sysno) ||  // We'll need to handle this properly to build
1154                               // a x86_32 policy.
1155 #endif
1156 #if defined(__x86_64__) || defined(__arm__)
1157       IsSystemVMessageQueue(sysno) ||
1158       IsSystemVSemaphores(sysno) ||
1159       IsSystemVSharedMemory(sysno) ||
1160 #elif defined(__i386__)
1161       IsSystemVIpc(sysno) ||
1162 #endif
1163 #if defined(__arm__)
1164       IsArmPciConfig(sysno) ||
1165 #endif
1166       IsTimer(sysno)) {
1167     return true;
1168   } else {
1169     return false;
1170   }
1171 }
1172
1173 ErrorCode BaselinePolicy(int sysno) {
1174   if (IsBaselinePolicyAllowed(sysno)) {
1175     return ErrorCode(ErrorCode::ERR_ALLOWED);
1176   }
1177
1178 #if defined(__i386__)
1179   // socketcall(2) should be tightened.
1180   if (IsSocketCall(sysno)) {
1181     return ErrorCode(ErrorCode::ERR_ALLOWED);
1182   }
1183 #endif
1184
1185   // TODO(jln): some system calls in those sets are not supposed to
1186   // return ENOENT. Return the appropriate error.
1187   if (IsFileSystem(sysno) || IsCurrentDirectory(sysno)) {
1188     return ErrorCode(ENOENT);
1189   }
1190
1191   if (IsUmask(sysno) || IsDeniedFileSystemAccessViaFd(sysno) ||
1192       IsDeniedGetOrModifySocket(sysno)) {
1193     return ErrorCode(EPERM);
1194   }
1195
1196   if (IsBaselinePolicyWatched(sysno)) {
1197     // Previously unseen syscalls. TODO(jln): some of these should
1198     // be denied gracefully right away.
1199     return Sandbox::Trap(CrashSIGSYS_Handler, NULL);
1200   }
1201   // In any other case crash the program with our SIGSYS handler
1202   return Sandbox::Trap(CrashSIGSYS_Handler, NULL);
1203 }
1204
1205 // x86_64/i386 for now. Needs to be adapted and tested for ARM.
1206 ErrorCode GpuProcessPolicy(int sysno, void *broker_process) {
1207   switch(sysno) {
1208     case __NR_ioctl:
1209 #if defined(ADDRESS_SANITIZER)
1210     // Allow to call sched_getaffinity under AddressSanitizer.
1211     case __NR_sched_getaffinity:
1212 #endif
1213       return ErrorCode(ErrorCode::ERR_ALLOWED);
1214     case __NR_open:
1215     case __NR_openat:
1216         return Sandbox::Trap(GpuOpenSIGSYS_Handler, broker_process);
1217     default:
1218       if (IsEventFd(sysno))
1219         return ErrorCode(ErrorCode::ERR_ALLOWED);
1220
1221       // Default on the baseline policy.
1222       return BaselinePolicy(sysno);
1223   }
1224 }
1225
1226 // x86_64/i386 for now. Needs to be adapted and tested for ARM.
1227 // A GPU broker policy is the same as a GPU policy with open and
1228 // openat allowed.
1229 ErrorCode GpuBrokerProcessPolicy(int sysno, void*) {
1230   switch(sysno) {
1231     case __NR_open:
1232     case __NR_openat:
1233       return ErrorCode(ErrorCode::ERR_ALLOWED);
1234     default:
1235       return GpuProcessPolicy(sysno, NULL);
1236   }
1237 }
1238
1239 ErrorCode RendererOrWorkerProcessPolicy(int sysno, void *) {
1240   switch (sysno) {
1241     case __NR_ioctl:  // TODO(jln) investigate legitimate use in the renderer
1242                       // and see if alternatives can be used.
1243     case __NR_fdatasync:
1244     case __NR_fsync:
1245 #if defined(__i386__) || defined(__x86_64__)
1246     case __NR_getrlimit:
1247 #endif
1248     case __NR_mremap:   // See crbug.com/149834.
1249     case __NR_pread64:
1250     case __NR_pwrite64:
1251 #if defined(ADDRESS_SANITIZER)
1252     // Allow to call sched_getaffinity() under AddressSanitizer.
1253     case __NR_sched_getaffinity:
1254 #endif
1255     case __NR_sched_get_priority_max:
1256     case __NR_sched_get_priority_min:
1257     case __NR_sched_getparam:
1258     case __NR_sched_getscheduler:
1259     case __NR_sched_setscheduler:
1260     case __NR_setpriority:
1261     case __NR_sysinfo:
1262     case __NR_times:
1263     case __NR_uname:
1264       return ErrorCode(ErrorCode::ERR_ALLOWED);
1265     case __NR_prlimit64:
1266       return ErrorCode(EPERM);  // See crbug.com/160157.
1267     default:
1268       // These need further tightening.
1269 #if defined(__x86_64__) || defined(__arm__)
1270       if (IsSystemVSharedMemory(sysno))
1271         return ErrorCode(ErrorCode::ERR_ALLOWED);
1272 #endif
1273 #if defined(__i386__)
1274       if (IsSystemVIpc(sysno))
1275         return ErrorCode(ErrorCode::ERR_ALLOWED);
1276 #endif
1277
1278       // Default on the baseline policy.
1279       return BaselinePolicy(sysno);
1280   }
1281 }
1282
1283 ErrorCode FlashProcessPolicy(int sysno, void *) {
1284   switch (sysno) {
1285     case __NR_sched_getaffinity:
1286     case __NR_sched_setscheduler:
1287     case __NR_times:
1288       return ErrorCode(ErrorCode::ERR_ALLOWED);
1289     case __NR_ioctl:
1290       return ErrorCode(ENOTTY);  // Flash Access.
1291     default:
1292       // These need further tightening.
1293 #if defined(__x86_64__) || defined(__arm__)
1294       if (IsSystemVSharedMemory(sysno))
1295         return ErrorCode(ErrorCode::ERR_ALLOWED);
1296 #endif
1297 #if defined(__i386__)
1298       if (IsSystemVIpc(sysno))
1299         return ErrorCode(ErrorCode::ERR_ALLOWED);
1300 #endif
1301
1302       // Default on the baseline policy.
1303       return BaselinePolicy(sysno);
1304   }
1305 }
1306
1307 ErrorCode BlacklistDebugAndNumaPolicy(int sysno, void *) {
1308   if (!Sandbox::IsValidSyscallNumber(sysno)) {
1309     // TODO(jln) we should not have to do that in a trivial policy.
1310     return ErrorCode(ENOSYS);
1311   }
1312
1313   if (IsDebug(sysno) || IsNuma(sysno))
1314     return Sandbox::Trap(CrashSIGSYS_Handler, NULL);
1315
1316   return ErrorCode(ErrorCode::ERR_ALLOWED);
1317 }
1318
1319 // Allow all syscalls.
1320 // This will still deny x32 or IA32 calls in 64 bits mode or
1321 // 64 bits system calls in compatibility mode.
1322 ErrorCode AllowAllPolicy(int sysno, void *) {
1323   if (!Sandbox::IsValidSyscallNumber(sysno)) {
1324     // TODO(jln) we should not have to do that in a trivial policy.
1325     return ErrorCode(ENOSYS);
1326   } else {
1327     return ErrorCode(ErrorCode::ERR_ALLOWED);
1328   }
1329 }
1330
1331 bool EnableGpuBrokerPolicyCallBack() {
1332   StartSandboxWithPolicy(GpuBrokerProcessPolicy, NULL);
1333   return true;
1334 }
1335
1336 // Start a broker process to handle open() inside the sandbox.
1337 void InitGpuBrokerProcess(BrokerProcess** broker_process) {
1338   static const char kDriRcPath[] = "/etc/drirc";
1339   static const char kDriCard0Path[] = "/dev/dri/card0";
1340
1341   CHECK(broker_process);
1342   CHECK(*broker_process == NULL);
1343
1344   std::vector<std::string> read_whitelist;
1345   read_whitelist.push_back(kDriCard0Path);
1346   read_whitelist.push_back(kDriRcPath);
1347   std::vector<std::string> write_whitelist;
1348   write_whitelist.push_back(kDriCard0Path);
1349
1350   *broker_process = new BrokerProcess(read_whitelist, write_whitelist);
1351   // Initialize the broker process and give it a sandbox call back.
1352   CHECK((*broker_process)->Init(EnableGpuBrokerPolicyCallBack));
1353 }
1354
1355 // Warms up/preloads resources needed by the policies.
1356 // Eventually start a broker process and return it in broker_process.
1357 void WarmupPolicy(Sandbox::EvaluateSyscall policy,
1358                   BrokerProcess** broker_process) {
1359   if (policy == GpuProcessPolicy) {
1360     if (IsArchitectureX86_64() || IsArchitectureI386()) {
1361       // Create a new broker process.
1362       InitGpuBrokerProcess(broker_process);
1363
1364       // Accelerated video decode dlopen()'s a shared object
1365       // inside the sandbox, so preload it now.
1366       if (IsAcceleratedVideoDecodeEnabled()) {
1367         const char* I965DrvVideoPath = NULL;
1368
1369         if (IsArchitectureX86_64()) {
1370           I965DrvVideoPath = "/usr/lib64/va/drivers/i965_drv_video.so";
1371         } else if (IsArchitectureI386()) {
1372           I965DrvVideoPath = "/usr/lib/va/drivers/i965_drv_video.so";
1373         }
1374
1375         dlopen(I965DrvVideoPath, RTLD_NOW|RTLD_GLOBAL|RTLD_NODELETE);
1376       }
1377     }
1378   }
1379 }
1380
1381 Sandbox::EvaluateSyscall GetProcessSyscallPolicy(
1382     const CommandLine& command_line,
1383     const std::string& process_type) {
1384   if (process_type == switches::kGpuProcess) {
1385     // On Chrome OS, --enable-gpu-sandbox enables the more restrictive policy.
1386     // However, we don't yet enable the more restrictive GPU process policy
1387     // on ARM.
1388     if (IsArchitectureArm() ||
1389         (IsChromeOS() && !command_line.HasSwitch(switches::kEnableGpuSandbox)))
1390       return BlacklistDebugAndNumaPolicy;
1391     else
1392       return GpuProcessPolicy;
1393   }
1394
1395   if (process_type == switches::kPpapiPluginProcess) {
1396     // TODO(jln): figure out what to do with non-Flash PPAPI
1397     // out-of-process plug-ins.
1398     return FlashProcessPolicy;
1399   }
1400
1401   if (process_type == switches::kRendererProcess ||
1402       process_type == switches::kWorkerProcess) {
1403     return RendererOrWorkerProcessPolicy;
1404   }
1405
1406   if (process_type == switches::kUtilityProcess) {
1407     return BlacklistDebugAndNumaPolicy;
1408   }
1409
1410   NOTREACHED();
1411   // This will be our default if we need one.
1412   return AllowAllPolicy;
1413 }
1414
1415 // broker_process can be NULL if there is no need for one.
1416 void StartSandboxWithPolicy(Sandbox::EvaluateSyscall syscall_policy,
1417                             BrokerProcess* broker_process) {
1418
1419   Sandbox::SetSandboxPolicy(syscall_policy, broker_process);
1420   Sandbox::StartSandbox();
1421 }
1422
1423 // Initialize the seccomp-bpf sandbox.
1424 bool StartBpfSandbox(const CommandLine& command_line,
1425                      const std::string& process_type) {
1426   Sandbox::EvaluateSyscall syscall_policy =
1427       GetProcessSyscallPolicy(command_line, process_type);
1428
1429   BrokerProcess* broker_process = NULL;
1430   // Warm up resources needed by the policy we're about to enable and
1431   // eventually start a broker process.
1432   WarmupPolicy(syscall_policy, &broker_process);
1433
1434   StartSandboxWithPolicy(syscall_policy, broker_process);
1435
1436   return true;
1437 }
1438
1439 }  // namespace
1440
1441 #endif  // SECCOMP_BPF_SANDBOX
1442
1443 namespace content {
1444
1445 // Is seccomp BPF globally enabled?
1446 bool SandboxSeccompBpf::IsSeccompBpfDesired() {
1447   const CommandLine& command_line = *CommandLine::ForCurrentProcess();
1448   if (!command_line.HasSwitch(switches::kNoSandbox) &&
1449       !command_line.HasSwitch(switches::kDisableSeccompFilterSandbox)) {
1450     return true;
1451   } else {
1452     return false;
1453   }
1454 }
1455
1456 bool SandboxSeccompBpf::ShouldEnableSeccompBpf(
1457     const std::string& process_type) {
1458 #if defined(SECCOMP_BPF_SANDBOX)
1459   const CommandLine& command_line = *CommandLine::ForCurrentProcess();
1460   if (process_type == switches::kGpuProcess)
1461     return !command_line.HasSwitch(switches::kDisableGpuSandbox);
1462
1463   return true;
1464 #endif  // SECCOMP_BPF_SANDBOX
1465   return false;
1466 }
1467
1468 bool SandboxSeccompBpf::SupportsSandbox() {
1469 #if defined(SECCOMP_BPF_SANDBOX)
1470   // TODO(jln): pass the saved proc_fd_ from the LinuxSandbox singleton
1471   // here.
1472   Sandbox::SandboxStatus bpf_sandbox_status =
1473       Sandbox::SupportsSeccompSandbox(-1);
1474   // Kernel support is what we are interested in here. Other status
1475   // such as STATUS_UNAVAILABLE (has threads) still indicate kernel support.
1476   // We make this a negative check, since if there is a bug, we would rather
1477   // "fail closed" (expect a sandbox to be available and try to start it).
1478   if (bpf_sandbox_status != Sandbox::STATUS_UNSUPPORTED) {
1479     return true;
1480   }
1481 #endif
1482   return false;
1483 }
1484
1485 bool SandboxSeccompBpf::StartSandbox(const std::string& process_type) {
1486 #if defined(SECCOMP_BPF_SANDBOX)
1487   const CommandLine& command_line = *CommandLine::ForCurrentProcess();
1488
1489   if (IsSeccompBpfDesired() &&  // Global switches policy.
1490       ShouldEnableSeccompBpf(process_type) &&  // Process-specific policy.
1491       SupportsSandbox()) {
1492     // If the kernel supports the sandbox, and if the command line says we
1493     // should enable it, enable it or die.
1494     bool started_sandbox = StartBpfSandbox(command_line, process_type);
1495     CHECK(started_sandbox);
1496     return true;
1497   }
1498 #endif
1499   return false;
1500 }
1501
1502 }  // namespace content