|
@@ -1,8 +1,7 @@
|
|
|
-From b607596fa6128fd4052a187075f7d1c91ac06f8f Mon Sep 17 00:00:00 2001
|
|
|
+From 6329d77e50c3289d21cd5b79204871352e93938f Mon Sep 17 00:00:00 2001
|
|
|
From: Rebecca Chang Swee Fun <rebecca.chang@starfivetech.com>
|
|
|
-Date: Wed, 30 Mar 2022 06:38:26 +0000
|
|
|
-Subject: [PATCH 02/21] sandbox: add riscv arch definition and define syscall
|
|
|
- header
|
|
|
+Date: Wed, 15 Jun 2022 08:27:45 +0000
|
|
|
+Subject: [PATCH] sandbox: add riscv arch definition and define syscall
|
|
|
|
|
|
Credit to work contributed in Github.
|
|
|
https://github.com/felixonmars/archriscv-packages/tree/master/chromium
|
|
@@ -10,6 +9,7 @@ https://github.com/felixonmars/archriscv-packages/tree/master/chromium
|
|
|
Signed-off-by: Rebecca Chang Swee Fun <rebecca.chang@starfivetech.com>
|
|
|
---
|
|
|
sandbox/features.gni | 3 +-
|
|
|
+ sandbox/linux/BUILD.gn | 5 +
|
|
|
sandbox/linux/bpf_dsl/linux_syscall_ranges.h | 6 +
|
|
|
sandbox/linux/bpf_dsl/seccomp_macros.h | 41 +
|
|
|
.../seccomp-bpf-helpers/baseline_policy.cc | 9 +-
|
|
@@ -18,6 +18,7 @@ Signed-off-by: Rebecca Chang Swee Fun <rebecca.chang@starfivetech.com>
|
|
|
.../linux/seccomp-bpf-helpers/syscall_sets.h | 11 +-
|
|
|
sandbox/linux/seccomp-bpf/syscall.cc | 35 +-
|
|
|
sandbox/linux/services/credentials.cc | 2 +-
|
|
|
+ sandbox/linux/services/syscall_wrappers.cc | 2 +-
|
|
|
.../linux/syscall_broker/broker_process.cc | 20 +-
|
|
|
sandbox/linux/system_headers/linux_seccomp.h | 8 +
|
|
|
sandbox/linux/system_headers/linux_signal.h | 2 +-
|
|
@@ -26,11 +27,11 @@ Signed-off-by: Rebecca Chang Swee Fun <rebecca.chang@starfivetech.com>
|
|
|
.../system_headers/riscv64_linux_syscalls.h | 1070 +++++++++++++++++
|
|
|
.../linux/bpf_cros_amd_gpu_policy_linux.cc | 2 +-
|
|
|
sandbox/policy/linux/bpf_gpu_policy_linux.cc | 2 +-
|
|
|
- 17 files changed, 1241 insertions(+), 52 deletions(-)
|
|
|
+ 19 files changed, 1247 insertions(+), 53 deletions(-)
|
|
|
create mode 100644 sandbox/linux/system_headers/riscv64_linux_syscalls.h
|
|
|
|
|
|
diff --git a/sandbox/features.gni b/sandbox/features.gni
|
|
|
-index ad067ada520b5..c9f67f81618f6 100644
|
|
|
+index ad067ada520b..c9f67f81618f 100644
|
|
|
--- a/sandbox/features.gni
|
|
|
+++ b/sandbox/features.gni
|
|
|
@@ -9,7 +9,8 @@
|
|
@@ -43,8 +44,29 @@ index ad067ada520b5..c9f67f81618f6 100644
|
|
|
|
|
|
# SSBD (Speculative Store Bypass Disable) is a mitigation of Spectre Variant 4.
|
|
|
# As Spectre Variant 4 can be mitigated by site isolation, opt-out SSBD on site
|
|
|
+diff --git a/sandbox/linux/BUILD.gn b/sandbox/linux/BUILD.gn
|
|
|
+index ec24cd81e274..60c60d741bf6 100644
|
|
|
+--- a/sandbox/linux/BUILD.gn
|
|
|
++++ b/sandbox/linux/BUILD.gn
|
|
|
+@@ -292,11 +292,16 @@ if (is_linux || is_chromeos) {
|
|
|
+ cflags = [
|
|
|
+ # For ULLONG_MAX
|
|
|
+ "-std=gnu99",
|
|
|
++ "-fPIE",
|
|
|
+
|
|
|
+ # These files have a suspicious comparison.
|
|
|
+ # TODO fix this and re-enable this warning.
|
|
|
+ "-Wno-sign-compare",
|
|
|
+ ]
|
|
|
++
|
|
|
++ ldflags = [
|
|
|
++ "-pie",
|
|
|
++ ]
|
|
|
+ }
|
|
|
+ }
|
|
|
+
|
|
|
diff --git a/sandbox/linux/bpf_dsl/linux_syscall_ranges.h b/sandbox/linux/bpf_dsl/linux_syscall_ranges.h
|
|
|
-index 313511f22e95a..104dabde1cc0a 100644
|
|
|
+index 313511f22e95..104dabde1cc0 100644
|
|
|
--- a/sandbox/linux/bpf_dsl/linux_syscall_ranges.h
|
|
|
+++ b/sandbox/linux/bpf_dsl/linux_syscall_ranges.h
|
|
|
@@ -56,6 +56,12 @@
|
|
@@ -61,7 +83,7 @@ index 313511f22e95a..104dabde1cc0a 100644
|
|
|
#error "Unsupported architecture"
|
|
|
#endif
|
|
|
diff --git a/sandbox/linux/bpf_dsl/seccomp_macros.h b/sandbox/linux/bpf_dsl/seccomp_macros.h
|
|
|
-index 961a8cf7521ee..7c9a0c99e8fbe 100644
|
|
|
+index 961a8cf7521e..7c9a0c99e8fb 100644
|
|
|
--- a/sandbox/linux/bpf_dsl/seccomp_macros.h
|
|
|
+++ b/sandbox/linux/bpf_dsl/seccomp_macros.h
|
|
|
@@ -343,6 +343,47 @@ struct regs_struct {
|
|
@@ -113,7 +135,7 @@ index 961a8cf7521ee..7c9a0c99e8fbe 100644
|
|
|
#error Unsupported target platform
|
|
|
|
|
|
diff --git a/sandbox/linux/seccomp-bpf-helpers/baseline_policy.cc b/sandbox/linux/seccomp-bpf-helpers/baseline_policy.cc
|
|
|
-index 90df076e15eb8..31d7b35349704 100644
|
|
|
+index 30c15cccb5c1..06c6026a26fa 100644
|
|
|
--- a/sandbox/linux/seccomp-bpf-helpers/baseline_policy.cc
|
|
|
+++ b/sandbox/linux/seccomp-bpf-helpers/baseline_policy.cc
|
|
|
@@ -60,6 +60,9 @@ bool IsBaselinePolicyAllowed(int sysno) {
|
|
@@ -154,7 +176,7 @@ index 90df076e15eb8..31d7b35349704 100644
|
|
|
// Only allow AF_UNIX, PF_UNIX. Crash if anything else is seen.
|
|
|
static_assert(AF_UNIX == PF_UNIX,
|
|
|
diff --git a/sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.cc b/sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.cc
|
|
|
-index 7feff3f49323a..80205c10dd0b4 100644
|
|
|
+index 9728d0b52e68..6f6e3984028b 100644
|
|
|
--- a/sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.cc
|
|
|
+++ b/sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.cc
|
|
|
@@ -37,6 +37,7 @@
|
|
@@ -165,7 +187,7 @@ index 7feff3f49323a..80205c10dd0b4 100644
|
|
|
!defined(PTRACE_GET_THREAD_AREA)
|
|
|
// Also include asm/ptrace-abi.h since ptrace.h in older libc (for instance
|
|
|
// the one in Ubuntu 16.04 LTS) is missing PTRACE_GET_THREAD_AREA.
|
|
|
-@@ -443,7 +444,7 @@ ResultExpr RestrictPtrace() {
|
|
|
+@@ -438,7 +439,7 @@ ResultExpr RestrictPtrace() {
|
|
|
#endif
|
|
|
return Switch(request)
|
|
|
.CASES((
|
|
@@ -175,7 +197,7 @@ index 7feff3f49323a..80205c10dd0b4 100644
|
|
|
PTRACE_GETREGSET,
|
|
|
#endif
|
|
|
diff --git a/sandbox/linux/seccomp-bpf-helpers/syscall_sets.cc b/sandbox/linux/seccomp-bpf-helpers/syscall_sets.cc
|
|
|
-index b3cf6fc7e86fd..906b798b5c04e 100644
|
|
|
+index b3cf6fc7e86f..906b798b5c04 100644
|
|
|
--- a/sandbox/linux/seccomp-bpf-helpers/syscall_sets.cc
|
|
|
+++ b/sandbox/linux/seccomp-bpf-helpers/syscall_sets.cc
|
|
|
@@ -103,7 +103,7 @@ bool SyscallSets::IsUmask(int sysno) {
|
|
@@ -458,7 +480,7 @@ index b3cf6fc7e86fd..906b798b5c04e 100644
|
|
|
bool SyscallSets::IsMipsPrivate(int sysno) {
|
|
|
switch (sysno) {
|
|
|
diff --git a/sandbox/linux/seccomp-bpf-helpers/syscall_sets.h b/sandbox/linux/seccomp-bpf-helpers/syscall_sets.h
|
|
|
-index 6403f45dc2f78..dd7cb8ca17ecf 100644
|
|
|
+index 6403f45dc2f7..dd7cb8ca17ec 100644
|
|
|
--- a/sandbox/linux/seccomp-bpf-helpers/syscall_sets.h
|
|
|
+++ b/sandbox/linux/seccomp-bpf-helpers/syscall_sets.h
|
|
|
@@ -52,7 +52,7 @@ class SANDBOX_EXPORT SyscallSets {
|
|
@@ -498,7 +520,7 @@ index 6403f45dc2f78..dd7cb8ca17ecf 100644
|
|
|
|
|
|
} // namespace sandbox.
|
|
|
diff --git a/sandbox/linux/seccomp-bpf/syscall.cc b/sandbox/linux/seccomp-bpf/syscall.cc
|
|
|
-index 2e0e810383b58..37f60d3333e0d 100644
|
|
|
+index 2e0e810383b5..37f60d3333e0 100644
|
|
|
--- a/sandbox/linux/seccomp-bpf/syscall.cc
|
|
|
+++ b/sandbox/linux/seccomp-bpf/syscall.cc
|
|
|
@@ -18,7 +18,7 @@ namespace sandbox {
|
|
@@ -558,7 +580,7 @@ index 2e0e810383b58..37f60d3333e0d 100644
|
|
|
#else
|
|
|
#error "Unimplemented architecture"
|
|
|
diff --git a/sandbox/linux/services/credentials.cc b/sandbox/linux/services/credentials.cc
|
|
|
-index 00b969ee02a7e..7fa1a42ca41cc 100644
|
|
|
+index 00b969ee02a7..7fa1a42ca41c 100644
|
|
|
--- a/sandbox/linux/services/credentials.cc
|
|
|
+++ b/sandbox/linux/services/credentials.cc
|
|
|
@@ -80,7 +80,7 @@ bool ChrootToSafeEmptyDir() {
|
|
@@ -570,8 +592,21 @@ index 00b969ee02a7e..7fa1a42ca41cc 100644
|
|
|
// The stack grows downward.
|
|
|
void* stack = stack_buf + sizeof(stack_buf);
|
|
|
#else
|
|
|
+diff --git a/sandbox/linux/services/syscall_wrappers.cc b/sandbox/linux/services/syscall_wrappers.cc
|
|
|
+index f863cd005141..b6d7dac2cab4 100644
|
|
|
+--- a/sandbox/linux/services/syscall_wrappers.cc
|
|
|
++++ b/sandbox/linux/services/syscall_wrappers.cc
|
|
|
+@@ -61,7 +61,7 @@ long sys_clone(unsigned long flags,
|
|
|
+ #if defined(ARCH_CPU_X86_64)
|
|
|
+ return syscall(__NR_clone, flags, child_stack, ptid, ctid, tls);
|
|
|
+ #elif defined(ARCH_CPU_X86) || defined(ARCH_CPU_ARM_FAMILY) || \
|
|
|
+- defined(ARCH_CPU_MIPS_FAMILY)
|
|
|
++ defined(ARCH_CPU_MIPS_FAMILY) || defined(ARCH_CPU_RISCV_FAMILY)
|
|
|
+ // CONFIG_CLONE_BACKWARDS defined.
|
|
|
+ return syscall(__NR_clone, flags, child_stack, ptid, tls, ctid);
|
|
|
+ #endif
|
|
|
diff --git a/sandbox/linux/syscall_broker/broker_process.cc b/sandbox/linux/syscall_broker/broker_process.cc
|
|
|
-index 7dd4688011f9e..6feb09aeedf2b 100644
|
|
|
+index 7dd4688011f9..6feb09aeedf2 100644
|
|
|
--- a/sandbox/linux/syscall_broker/broker_process.cc
|
|
|
+++ b/sandbox/linux/syscall_broker/broker_process.cc
|
|
|
@@ -117,44 +117,46 @@ bool BrokerProcess::IsSyscallBrokerable(int sysno, bool fast_check) const {
|
|
@@ -647,7 +682,7 @@ index 7dd4688011f9e..6feb09aeedf2b 100644
|
|
|
return !fast_check || policy_->allowed_command_set.test(COMMAND_UNLINK);
|
|
|
#endif
|
|
|
diff --git a/sandbox/linux/system_headers/linux_seccomp.h b/sandbox/linux/system_headers/linux_seccomp.h
|
|
|
-index 7d898d84631ae..0b144fe30c329 100644
|
|
|
+index 7d898d84631a..0b144fe30c32 100644
|
|
|
--- a/sandbox/linux/system_headers/linux_seccomp.h
|
|
|
+++ b/sandbox/linux/system_headers/linux_seccomp.h
|
|
|
@@ -39,6 +39,10 @@
|
|
@@ -673,7 +708,7 @@ index 7d898d84631ae..0b144fe30c329 100644
|
|
|
#ifndef PR_SET_SECCOMP
|
|
|
#define PR_SET_SECCOMP 22
|
|
|
diff --git a/sandbox/linux/system_headers/linux_signal.h b/sandbox/linux/system_headers/linux_signal.h
|
|
|
-index 74bbb8ef8c740..db6159f754ce1 100644
|
|
|
+index 74bbb8ef8c74..db6159f754ce 100644
|
|
|
--- a/sandbox/linux/system_headers/linux_signal.h
|
|
|
+++ b/sandbox/linux/system_headers/linux_signal.h
|
|
|
@@ -13,7 +13,7 @@
|
|
@@ -686,7 +721,7 @@ index 74bbb8ef8c740..db6159f754ce1 100644
|
|
|
#define LINUX_SIGHUP 1
|
|
|
#define LINUX_SIGINT 2
|
|
|
diff --git a/sandbox/linux/system_headers/linux_stat.h b/sandbox/linux/system_headers/linux_stat.h
|
|
|
-index 5f49a958499ee..32ab256cfca45 100644
|
|
|
+index 5f49a958499e..32ab256cfca4 100644
|
|
|
--- a/sandbox/linux/system_headers/linux_stat.h
|
|
|
+++ b/sandbox/linux/system_headers/linux_stat.h
|
|
|
@@ -150,7 +150,7 @@ struct kernel_stat {
|
|
@@ -699,7 +734,7 @@ index 5f49a958499ee..32ab256cfca45 100644
|
|
|
unsigned long st_dev;
|
|
|
unsigned long st_ino;
|
|
|
diff --git a/sandbox/linux/system_headers/linux_syscalls.h b/sandbox/linux/system_headers/linux_syscalls.h
|
|
|
-index 2b78a0cc3b974..968d6f71b5862 100644
|
|
|
+index 2b78a0cc3b97..968d6f71b586 100644
|
|
|
--- a/sandbox/linux/system_headers/linux_syscalls.h
|
|
|
+++ b/sandbox/linux/system_headers/linux_syscalls.h
|
|
|
@@ -35,5 +35,9 @@
|
|
@@ -714,7 +749,7 @@ index 2b78a0cc3b974..968d6f71b5862 100644
|
|
|
|
|
|
diff --git a/sandbox/linux/system_headers/riscv64_linux_syscalls.h b/sandbox/linux/system_headers/riscv64_linux_syscalls.h
|
|
|
new file mode 100644
|
|
|
-index 0000000000000..23533617a91b7
|
|
|
+index 000000000000..23533617a91b
|
|
|
--- /dev/null
|
|
|
+++ b/sandbox/linux/system_headers/riscv64_linux_syscalls.h
|
|
|
@@ -0,0 +1,1070 @@
|
|
@@ -1789,7 +1824,7 @@ index 0000000000000..23533617a91b7
|
|
|
+
|
|
|
+#endif // SANDBOX_LINUX_SYSTEM_HEADERS_RISCV64_LINUX_SYSCALLS_H_
|
|
|
diff --git a/sandbox/policy/linux/bpf_cros_amd_gpu_policy_linux.cc b/sandbox/policy/linux/bpf_cros_amd_gpu_policy_linux.cc
|
|
|
-index cd64d06ae39d7..1dad48a7caaed 100644
|
|
|
+index cd64d06ae39d..1dad48a7caae 100644
|
|
|
--- a/sandbox/policy/linux/bpf_cros_amd_gpu_policy_linux.cc
|
|
|
+++ b/sandbox/policy/linux/bpf_cros_amd_gpu_policy_linux.cc
|
|
|
@@ -38,7 +38,7 @@ ResultExpr CrosAmdGpuProcessPolicy::EvaluateSyscall(int sysno) const {
|
|
@@ -1802,7 +1837,7 @@ index cd64d06ae39d7..1dad48a7caaed 100644
|
|
|
case __NR_stat:
|
|
|
#endif
|
|
|
diff --git a/sandbox/policy/linux/bpf_gpu_policy_linux.cc b/sandbox/policy/linux/bpf_gpu_policy_linux.cc
|
|
|
-index f8df9dcbd9310..4a6287aba2ef5 100644
|
|
|
+index f8df9dcbd931..4a6287aba2ef 100644
|
|
|
--- a/sandbox/policy/linux/bpf_gpu_policy_linux.cc
|
|
|
+++ b/sandbox/policy/linux/bpf_gpu_policy_linux.cc
|
|
|
@@ -73,7 +73,7 @@ ResultExpr GpuProcessPolicy::EvaluateSyscall(int sysno) const {
|