Browse Source

update patch for sandbox

Merge 2 patches into single patch.
Added minor code changes to sandbox/linux/services/syscall_wrappers.cc

Signed-off-by: Rebecca Chang Swee Fun <rebecca.chang@starfivetech.com>
Rebecca Chang Swee Fun 1 year ago
parent
commit
fb4ba57d6a

+ 58 - 23
0002-sandbox-add-riscv-arch-definition-and-define-syscall.patch

@@ -1,8 +1,7 @@
-From b607596fa6128fd4052a187075f7d1c91ac06f8f Mon Sep 17 00:00:00 2001
+From 6329d77e50c3289d21cd5b79204871352e93938f Mon Sep 17 00:00:00 2001
 From: Rebecca Chang Swee Fun <rebecca.chang@starfivetech.com>
-Date: Wed, 30 Mar 2022 06:38:26 +0000
-Subject: [PATCH 02/21] sandbox: add riscv arch definition and define syscall
- header
+Date: Wed, 15 Jun 2022 08:27:45 +0000
+Subject: [PATCH] sandbox: add riscv arch definition and define syscall
 
 Credit to work contributed in Github.
 https://github.com/felixonmars/archriscv-packages/tree/master/chromium
@@ -10,6 +9,7 @@ https://github.com/felixonmars/archriscv-packages/tree/master/chromium
 Signed-off-by: Rebecca Chang Swee Fun <rebecca.chang@starfivetech.com>
 ---
  sandbox/features.gni                          |    3 +-
+ sandbox/linux/BUILD.gn                        |    5 +
  sandbox/linux/bpf_dsl/linux_syscall_ranges.h  |    6 +
  sandbox/linux/bpf_dsl/seccomp_macros.h        |   41 +
  .../seccomp-bpf-helpers/baseline_policy.cc    |    9 +-
@@ -18,6 +18,7 @@ Signed-off-by: Rebecca Chang Swee Fun <rebecca.chang@starfivetech.com>
  .../linux/seccomp-bpf-helpers/syscall_sets.h  |   11 +-
  sandbox/linux/seccomp-bpf/syscall.cc          |   35 +-
  sandbox/linux/services/credentials.cc         |    2 +-
+ sandbox/linux/services/syscall_wrappers.cc    |    2 +-
  .../linux/syscall_broker/broker_process.cc    |   20 +-
  sandbox/linux/system_headers/linux_seccomp.h  |    8 +
  sandbox/linux/system_headers/linux_signal.h   |    2 +-
@@ -26,11 +27,11 @@ Signed-off-by: Rebecca Chang Swee Fun <rebecca.chang@starfivetech.com>
  .../system_headers/riscv64_linux_syscalls.h   | 1070 +++++++++++++++++
  .../linux/bpf_cros_amd_gpu_policy_linux.cc    |    2 +-
  sandbox/policy/linux/bpf_gpu_policy_linux.cc  |    2 +-
- 17 files changed, 1241 insertions(+), 52 deletions(-)
+ 19 files changed, 1247 insertions(+), 53 deletions(-)
  create mode 100644 sandbox/linux/system_headers/riscv64_linux_syscalls.h
 
 diff --git a/sandbox/features.gni b/sandbox/features.gni
-index ad067ada520b5..c9f67f81618f6 100644
+index ad067ada520b..c9f67f81618f 100644
 --- a/sandbox/features.gni
 +++ b/sandbox/features.gni
 @@ -9,7 +9,8 @@
@@ -43,8 +44,29 @@ index ad067ada520b5..c9f67f81618f6 100644
  
  # SSBD (Speculative Store Bypass Disable) is a mitigation of Spectre Variant 4.
  # As Spectre Variant 4 can be mitigated by site isolation, opt-out SSBD on site
+diff --git a/sandbox/linux/BUILD.gn b/sandbox/linux/BUILD.gn
+index ec24cd81e274..60c60d741bf6 100644
+--- a/sandbox/linux/BUILD.gn
++++ b/sandbox/linux/BUILD.gn
+@@ -292,11 +292,16 @@ if (is_linux || is_chromeos) {
+     cflags = [
+       # For ULLONG_MAX
+       "-std=gnu99",
++      "-fPIE",
+ 
+       # These files have a suspicious comparison.
+       # TODO fix this and re-enable this warning.
+       "-Wno-sign-compare",
+     ]
++
++    ldflags = [
++      "-pie",
++    ]
+   }
+ }
+ 
 diff --git a/sandbox/linux/bpf_dsl/linux_syscall_ranges.h b/sandbox/linux/bpf_dsl/linux_syscall_ranges.h
-index 313511f22e95a..104dabde1cc0a 100644
+index 313511f22e95..104dabde1cc0 100644
 --- a/sandbox/linux/bpf_dsl/linux_syscall_ranges.h
 +++ b/sandbox/linux/bpf_dsl/linux_syscall_ranges.h
 @@ -56,6 +56,12 @@
@@ -61,7 +83,7 @@ index 313511f22e95a..104dabde1cc0a 100644
  #error "Unsupported architecture"
  #endif
 diff --git a/sandbox/linux/bpf_dsl/seccomp_macros.h b/sandbox/linux/bpf_dsl/seccomp_macros.h
-index 961a8cf7521ee..7c9a0c99e8fbe 100644
+index 961a8cf7521e..7c9a0c99e8fb 100644
 --- a/sandbox/linux/bpf_dsl/seccomp_macros.h
 +++ b/sandbox/linux/bpf_dsl/seccomp_macros.h
 @@ -343,6 +343,47 @@ struct regs_struct {
@@ -113,7 +135,7 @@ index 961a8cf7521ee..7c9a0c99e8fbe 100644
  #error Unsupported target platform
  
 diff --git a/sandbox/linux/seccomp-bpf-helpers/baseline_policy.cc b/sandbox/linux/seccomp-bpf-helpers/baseline_policy.cc
-index 90df076e15eb8..31d7b35349704 100644
+index 30c15cccb5c1..06c6026a26fa 100644
 --- a/sandbox/linux/seccomp-bpf-helpers/baseline_policy.cc
 +++ b/sandbox/linux/seccomp-bpf-helpers/baseline_policy.cc
 @@ -60,6 +60,9 @@ bool IsBaselinePolicyAllowed(int sysno) {
@@ -154,7 +176,7 @@ index 90df076e15eb8..31d7b35349704 100644
      // Only allow AF_UNIX, PF_UNIX. Crash if anything else is seen.
      static_assert(AF_UNIX == PF_UNIX,
 diff --git a/sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.cc b/sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.cc
-index 7feff3f49323a..80205c10dd0b4 100644
+index 9728d0b52e68..6f6e3984028b 100644
 --- a/sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.cc
 +++ b/sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.cc
 @@ -37,6 +37,7 @@
@@ -165,7 +187,7 @@ index 7feff3f49323a..80205c10dd0b4 100644
      !defined(PTRACE_GET_THREAD_AREA)
  // Also include asm/ptrace-abi.h since ptrace.h in older libc (for instance
  // the one in Ubuntu 16.04 LTS) is missing PTRACE_GET_THREAD_AREA.
-@@ -443,7 +444,7 @@ ResultExpr RestrictPtrace() {
+@@ -438,7 +439,7 @@ ResultExpr RestrictPtrace() {
  #endif
    return Switch(request)
        .CASES((
@@ -175,7 +197,7 @@ index 7feff3f49323a..80205c10dd0b4 100644
                   PTRACE_GETREGSET,
  #endif
 diff --git a/sandbox/linux/seccomp-bpf-helpers/syscall_sets.cc b/sandbox/linux/seccomp-bpf-helpers/syscall_sets.cc
-index b3cf6fc7e86fd..906b798b5c04e 100644
+index b3cf6fc7e86f..906b798b5c04 100644
 --- a/sandbox/linux/seccomp-bpf-helpers/syscall_sets.cc
 +++ b/sandbox/linux/seccomp-bpf-helpers/syscall_sets.cc
 @@ -103,7 +103,7 @@ bool SyscallSets::IsUmask(int sysno) {
@@ -458,7 +480,7 @@ index b3cf6fc7e86fd..906b798b5c04e 100644
  bool SyscallSets::IsMipsPrivate(int sysno) {
    switch (sysno) {
 diff --git a/sandbox/linux/seccomp-bpf-helpers/syscall_sets.h b/sandbox/linux/seccomp-bpf-helpers/syscall_sets.h
-index 6403f45dc2f78..dd7cb8ca17ecf 100644
+index 6403f45dc2f7..dd7cb8ca17ec 100644
 --- a/sandbox/linux/seccomp-bpf-helpers/syscall_sets.h
 +++ b/sandbox/linux/seccomp-bpf-helpers/syscall_sets.h
 @@ -52,7 +52,7 @@ class SANDBOX_EXPORT SyscallSets {
@@ -498,7 +520,7 @@ index 6403f45dc2f78..dd7cb8ca17ecf 100644
  
  }  // namespace sandbox.
 diff --git a/sandbox/linux/seccomp-bpf/syscall.cc b/sandbox/linux/seccomp-bpf/syscall.cc
-index 2e0e810383b58..37f60d3333e0d 100644
+index 2e0e810383b5..37f60d3333e0 100644
 --- a/sandbox/linux/seccomp-bpf/syscall.cc
 +++ b/sandbox/linux/seccomp-bpf/syscall.cc
 @@ -18,7 +18,7 @@ namespace sandbox {
@@ -558,7 +580,7 @@ index 2e0e810383b58..37f60d3333e0d 100644
  #else
  #error "Unimplemented architecture"
 diff --git a/sandbox/linux/services/credentials.cc b/sandbox/linux/services/credentials.cc
-index 00b969ee02a7e..7fa1a42ca41cc 100644
+index 00b969ee02a7..7fa1a42ca41c 100644
 --- a/sandbox/linux/services/credentials.cc
 +++ b/sandbox/linux/services/credentials.cc
 @@ -80,7 +80,7 @@ bool ChrootToSafeEmptyDir() {
@@ -570,8 +592,21 @@ index 00b969ee02a7e..7fa1a42ca41cc 100644
    // The stack grows downward.
    void* stack = stack_buf + sizeof(stack_buf);
  #else
+diff --git a/sandbox/linux/services/syscall_wrappers.cc b/sandbox/linux/services/syscall_wrappers.cc
+index f863cd005141..b6d7dac2cab4 100644
+--- a/sandbox/linux/services/syscall_wrappers.cc
++++ b/sandbox/linux/services/syscall_wrappers.cc
+@@ -61,7 +61,7 @@ long sys_clone(unsigned long flags,
+ #if defined(ARCH_CPU_X86_64)
+   return syscall(__NR_clone, flags, child_stack, ptid, ctid, tls);
+ #elif defined(ARCH_CPU_X86) || defined(ARCH_CPU_ARM_FAMILY) || \
+-    defined(ARCH_CPU_MIPS_FAMILY)
++    defined(ARCH_CPU_MIPS_FAMILY) || defined(ARCH_CPU_RISCV_FAMILY)
+   // CONFIG_CLONE_BACKWARDS defined.
+   return syscall(__NR_clone, flags, child_stack, ptid, tls, ctid);
+ #endif
 diff --git a/sandbox/linux/syscall_broker/broker_process.cc b/sandbox/linux/syscall_broker/broker_process.cc
-index 7dd4688011f9e..6feb09aeedf2b 100644
+index 7dd4688011f9..6feb09aeedf2 100644
 --- a/sandbox/linux/syscall_broker/broker_process.cc
 +++ b/sandbox/linux/syscall_broker/broker_process.cc
 @@ -117,44 +117,46 @@ bool BrokerProcess::IsSyscallBrokerable(int sysno, bool fast_check) const {
@@ -647,7 +682,7 @@ index 7dd4688011f9e..6feb09aeedf2b 100644
        return !fast_check || policy_->allowed_command_set.test(COMMAND_UNLINK);
  #endif
 diff --git a/sandbox/linux/system_headers/linux_seccomp.h b/sandbox/linux/system_headers/linux_seccomp.h
-index 7d898d84631ae..0b144fe30c329 100644
+index 7d898d84631a..0b144fe30c32 100644
 --- a/sandbox/linux/system_headers/linux_seccomp.h
 +++ b/sandbox/linux/system_headers/linux_seccomp.h
 @@ -39,6 +39,10 @@
@@ -673,7 +708,7 @@ index 7d898d84631ae..0b144fe30c329 100644
  #ifndef PR_SET_SECCOMP
  #define PR_SET_SECCOMP               22
 diff --git a/sandbox/linux/system_headers/linux_signal.h b/sandbox/linux/system_headers/linux_signal.h
-index 74bbb8ef8c740..db6159f754ce1 100644
+index 74bbb8ef8c74..db6159f754ce 100644
 --- a/sandbox/linux/system_headers/linux_signal.h
 +++ b/sandbox/linux/system_headers/linux_signal.h
 @@ -13,7 +13,7 @@
@@ -686,7 +721,7 @@ index 74bbb8ef8c740..db6159f754ce1 100644
  #define LINUX_SIGHUP 1
  #define LINUX_SIGINT 2
 diff --git a/sandbox/linux/system_headers/linux_stat.h b/sandbox/linux/system_headers/linux_stat.h
-index 5f49a958499ee..32ab256cfca45 100644
+index 5f49a958499e..32ab256cfca4 100644
 --- a/sandbox/linux/system_headers/linux_stat.h
 +++ b/sandbox/linux/system_headers/linux_stat.h
 @@ -150,7 +150,7 @@ struct kernel_stat {
@@ -699,7 +734,7 @@ index 5f49a958499ee..32ab256cfca45 100644
    unsigned long st_dev;
    unsigned long st_ino;
 diff --git a/sandbox/linux/system_headers/linux_syscalls.h b/sandbox/linux/system_headers/linux_syscalls.h
-index 2b78a0cc3b974..968d6f71b5862 100644
+index 2b78a0cc3b97..968d6f71b586 100644
 --- a/sandbox/linux/system_headers/linux_syscalls.h
 +++ b/sandbox/linux/system_headers/linux_syscalls.h
 @@ -35,5 +35,9 @@
@@ -714,7 +749,7 @@ index 2b78a0cc3b974..968d6f71b5862 100644
  
 diff --git a/sandbox/linux/system_headers/riscv64_linux_syscalls.h b/sandbox/linux/system_headers/riscv64_linux_syscalls.h
 new file mode 100644
-index 0000000000000..23533617a91b7
+index 000000000000..23533617a91b
 --- /dev/null
 +++ b/sandbox/linux/system_headers/riscv64_linux_syscalls.h
 @@ -0,0 +1,1070 @@
@@ -1789,7 +1824,7 @@ index 0000000000000..23533617a91b7
 +
 +#endif  // SANDBOX_LINUX_SYSTEM_HEADERS_RISCV64_LINUX_SYSCALLS_H_
 diff --git a/sandbox/policy/linux/bpf_cros_amd_gpu_policy_linux.cc b/sandbox/policy/linux/bpf_cros_amd_gpu_policy_linux.cc
-index cd64d06ae39d7..1dad48a7caaed 100644
+index cd64d06ae39d..1dad48a7caae 100644
 --- a/sandbox/policy/linux/bpf_cros_amd_gpu_policy_linux.cc
 +++ b/sandbox/policy/linux/bpf_cros_amd_gpu_policy_linux.cc
 @@ -38,7 +38,7 @@ ResultExpr CrosAmdGpuProcessPolicy::EvaluateSyscall(int sysno) const {
@@ -1802,7 +1837,7 @@ index cd64d06ae39d7..1dad48a7caaed 100644
      case __NR_stat:
  #endif
 diff --git a/sandbox/policy/linux/bpf_gpu_policy_linux.cc b/sandbox/policy/linux/bpf_gpu_policy_linux.cc
-index f8df9dcbd9310..4a6287aba2ef5 100644
+index f8df9dcbd931..4a6287aba2ef 100644
 --- a/sandbox/policy/linux/bpf_gpu_policy_linux.cc
 +++ b/sandbox/policy/linux/bpf_gpu_policy_linux.cc
 @@ -73,7 +73,7 @@ ResultExpr GpuProcessPolicy::EvaluateSyscall(int sysno) const {

+ 0 - 34
0003-sandbox-linux-pass-fPIE-to-compiler.patch

@@ -1,34 +0,0 @@
-From 0724b7c6e4ac612d183aaace97bd5c2ae0296da9 Mon Sep 17 00:00:00 2001
-From: Rebecca Chang Swee Fun <rebecca.chang@starfivetech.com>
-Date: Thu, 13 Jan 2022 03:50:24 +0000
-Subject: [PATCH 03/21] sandbox: linux: pass -fPIE to compiler
-
-Signed-off-by: Rebecca Chang Swee Fun <rebecca.chang@starfivetech.com>
----
- sandbox/linux/BUILD.gn | 5 +++++
- 1 file changed, 5 insertions(+)
-
-diff --git a/sandbox/linux/BUILD.gn b/sandbox/linux/BUILD.gn
-index ec24cd81e2748..60c60d741bf6d 100644
---- a/sandbox/linux/BUILD.gn
-+++ b/sandbox/linux/BUILD.gn
-@@ -292,11 +292,16 @@ if (is_linux || is_chromeos) {
-     cflags = [
-       # For ULLONG_MAX
-       "-std=gnu99",
-+      "-fPIE",
- 
-       # These files have a suspicious comparison.
-       # TODO fix this and re-enable this warning.
-       "-Wno-sign-compare",
-     ]
-+
-+    ldflags = [
-+      "-pie",
-+    ]
-   }
- }
- 
--- 
-2.25.1
-