From 48a205e99b30d1c6efff4dc00936821ee7a31852 Mon Sep 17 00:00:00 2001 From: csagan5 <32685696+csagan5@users.noreply.github.com> Date: Sat, 16 Apr 2022 10:12:07 +0200 Subject: [PATCH] Remove patches not yet tailored for Android --- CHANGELOG.md | 3 - ...bid-dynamic-code-generation-on-Linux.patch | 334 ------------------ ...ve-mremap-from-system-call-whitelist.patch | 70 ---- .../Restrict-creation-of-dynamic-code.patch | 144 -------- 4 files changed, 551 deletions(-) delete mode 100644 build/patches/Forbid-dynamic-code-generation-on-Linux.patch delete mode 100644 build/patches/Remove-mremap-from-system-call-whitelist.patch delete mode 100644 build/patches/Restrict-creation-of-dynamic-code.patch diff --git a/CHANGELOG.md b/CHANGELOG.md index 510354e7..47a9b8c2 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,9 +4,6 @@ * mark sites as visited when they have an already-parsed OpenSearch descriptor * disable TLS resumption by default (thanks to @uazo) * partition DoH requests by top-frame NIK (thanks to @uazo) -* restrict creation of dynamic code -* forbid dynamic code generation on Linux -* remove mremap from system call whitelist # 100.0.4896.83 * update zh_CN translations (thanks to @zhmars) diff --git a/build/patches/Forbid-dynamic-code-generation-on-Linux.patch b/build/patches/Forbid-dynamic-code-generation-on-Linux.patch deleted file mode 100644 index 12ab661e..00000000 --- a/build/patches/Forbid-dynamic-code-generation-on-Linux.patch +++ /dev/null @@ -1,334 +0,0 @@ -From: qua3k -Date: Thu, 4 Nov 2021 00:00:00 +0000 -Subject: Forbid dynamic code generation on Linux - -The Windows sandbox prevents dynamic code generation via setting -MITIGATION_DYNAMIC_CODE_DISABLE on certain processes; prevent dynamic -code generation in the same processes on Linux via seccomp-bpf. ---- - .../policy/linux/bpf_audio_policy_linux.cc | 18 +++++++++++ - sandbox/policy/linux/bpf_cdm_policy_linux.cc | 12 +++++++ - .../policy/linux/bpf_ppapi_policy_linux.cc | 12 +++++++ - .../bpf_print_compositor_policy_linux.cc | 12 +++++++ - .../policy/linux/bpf_renderer_policy_linux.cc | 21 +++++++++++- - .../policy/linux/bpf_renderer_policy_linux.h | 5 ++- - .../policy/linux/bpf_service_policy_linux.cc | 21 ++++++++++++ - .../policy/linux/bpf_service_policy_linux.h | 5 ++- - .../bpf_speech_recognition_policy_linux.cc | 12 +++++++ - .../policy/linux/bpf_utility_policy_linux.cc | 12 +++++++ - .../policy/linux/sandbox_seccomp_bpf_linux.cc | 32 ++++++++++++++++--- - 11 files changed, 155 insertions(+), 7 deletions(-) - -diff --git a/sandbox/policy/linux/bpf_audio_policy_linux.cc b/sandbox/policy/linux/bpf_audio_policy_linux.cc ---- a/sandbox/policy/linux/bpf_audio_policy_linux.cc -+++ b/sandbox/policy/linux/bpf_audio_policy_linux.cc -@@ -118,6 +118,24 @@ ResultExpr AudioProcessPolicy::EvaluateSyscall(int system_call_number) const { - const Arg domain(0); - return If(domain == AF_UNIX, Allow()).Else(Error(EPERM)); - } -+#endif -+#if defined(__i386__) || defined(__x86_64__) || defined(__mips__) || \ -+ defined(__aarch64__) -+ case __NR_mmap: -+#endif -+#if defined(__i386__) || defined(__arm__) || \ -+ (defined(ARCH_CPU_MIPS_FAMILY) && defined(ARCH_CPU_32_BITS)) -+ case __NR_mmap2: -+#endif -+ return RestrictMmapFlagsNoWX(); -+ case __NR_mprotect: -+ case __NR_pkey_mprotect: -+ return RestrictMprotectFlagsNoWX(); -+#if defined(__i386__) || defined(__x86_64__) || defined(__arm__) || \ -+ defined(__aarch64__) || \ -+ (defined(ARCH_CPU_MIPS_FAMILY) && defined(ARCH_CPU_64_BITS)) -+ case __NR_shmat: -+ return RestrictShmatFlags(); - #endif - default: - #if defined(__x86_64__) -diff --git a/sandbox/policy/linux/bpf_cdm_policy_linux.cc b/sandbox/policy/linux/bpf_cdm_policy_linux.cc ---- a/sandbox/policy/linux/bpf_cdm_policy_linux.cc -+++ b/sandbox/policy/linux/bpf_cdm_policy_linux.cc -@@ -49,6 +49,18 @@ ResultExpr CdmProcessPolicy::EvaluateSyscall(int sysno) const { - return RestrictSchedTarget(GetPolicyPid(), sysno); - case __NR_prlimit64: - return RestrictPrlimitToGetrlimit(GetPolicyPid()); -+#if defined(__i386__) || defined(__x86_64__) || defined(__mips__) || \ -+ defined(__aarch64__) -+ case __NR_mmap: -+#endif -+#if defined(__i386__) || defined(__arm__) || \ -+ (defined(ARCH_CPU_MIPS_FAMILY) && defined(ARCH_CPU_32_BITS)) -+ case __NR_mmap2: -+#endif -+ return RestrictMmapFlagsNoWX(); -+ case __NR_mprotect: -+ case __NR_pkey_mprotect: -+ return RestrictMprotectFlagsNoWX(); - default: - // Default on the content baseline policy. - return BPFBasePolicy::EvaluateSyscall(sysno); -diff --git a/sandbox/policy/linux/bpf_ppapi_policy_linux.cc b/sandbox/policy/linux/bpf_ppapi_policy_linux.cc ---- a/sandbox/policy/linux/bpf_ppapi_policy_linux.cc -+++ b/sandbox/policy/linux/bpf_ppapi_policy_linux.cc -@@ -40,6 +40,18 @@ ResultExpr PpapiProcessPolicy::EvaluateSyscall(int sysno) const { - return RestrictSchedTarget(GetPolicyPid(), sysno); - case __NR_ioctl: - return Error(ENOTTY); // Flash Access. -+#if defined(__i386__) || defined(__x86_64__) || defined(__mips__) || \ -+ defined(__aarch64__) -+ case __NR_mmap: -+#endif -+#if defined(__i386__) || defined(__arm__) || \ -+ (defined(ARCH_CPU_MIPS_FAMILY) && defined(ARCH_CPU_32_BITS)) -+ case __NR_mmap2: -+#endif -+ return RestrictMmapFlagsNoWX(); -+ case __NR_mprotect: -+ case __NR_pkey_mprotect: -+ return RestrictMprotectFlagsNoWX(); - default: - // Default on the baseline policy. - return BPFBasePolicy::EvaluateSyscall(sysno); -diff --git a/sandbox/policy/linux/bpf_print_compositor_policy_linux.cc b/sandbox/policy/linux/bpf_print_compositor_policy_linux.cc ---- a/sandbox/policy/linux/bpf_print_compositor_policy_linux.cc -+++ b/sandbox/policy/linux/bpf_print_compositor_policy_linux.cc -@@ -45,6 +45,18 @@ ResultExpr PrintCompositorProcessPolicy::EvaluateSyscall(int sysno) const { - case __NR_times: - case __NR_uname: - return Allow(); -+#if defined(__i386__) || defined(__x86_64__) || defined(__mips__) || \ -+ defined(__aarch64__) -+ case __NR_mmap: -+#endif -+#if defined(__i386__) || defined(__arm__) || \ -+ (defined(ARCH_CPU_MIPS_FAMILY) && defined(ARCH_CPU_32_BITS)) -+ case __NR_mmap2: -+#endif -+ return RestrictMmapFlagsNoWX(); -+ case __NR_mprotect: -+ case __NR_pkey_mprotect: -+ return RestrictMprotectFlagsNoWX(); - default: - // Default on the content baseline policy. - return BPFBasePolicy::EvaluateSyscall(sysno); -diff --git a/sandbox/policy/linux/bpf_renderer_policy_linux.cc b/sandbox/policy/linux/bpf_renderer_policy_linux.cc ---- a/sandbox/policy/linux/bpf_renderer_policy_linux.cc -+++ b/sandbox/policy/linux/bpf_renderer_policy_linux.cc -@@ -48,10 +48,29 @@ ResultExpr RestrictIoctl() { - - } // namespace - --RendererProcessPolicy::RendererProcessPolicy() {} -+RendererProcessPolicy::RendererProcessPolicy(bool is_jit_disabled) -+ : is_jit_disabled_(is_jit_disabled) {} - RendererProcessPolicy::~RendererProcessPolicy() {} - - ResultExpr RendererProcessPolicy::EvaluateSyscall(int sysno) const { -+ -+ if (is_jit_disabled_) { -+ switch (sysno) { -+#if defined(__i386__) || defined(__x86_64__) || defined(__mips__) || \ -+ defined(__aarch64__) -+ case __NR_mmap: -+#endif -+#if defined(__i386__) || defined(__arm__) || \ -+ (defined(ARCH_CPU_MIPS_FAMILY) && defined(ARCH_CPU_32_BITS)) -+ case __NR_mmap2: -+#endif -+ return RestrictMmapFlagsNoWX(); -+ case __NR_mprotect: -+ case __NR_pkey_mprotect: -+ return RestrictMprotectFlagsNoWX(); -+ } -+ } -+ - switch (sysno) { - // The baseline policy allows __NR_clock_gettime. Allow - // clock_getres() for V8. crbug.com/329053. -diff --git a/sandbox/policy/linux/bpf_renderer_policy_linux.h b/sandbox/policy/linux/bpf_renderer_policy_linux.h ---- a/sandbox/policy/linux/bpf_renderer_policy_linux.h -+++ b/sandbox/policy/linux/bpf_renderer_policy_linux.h -@@ -13,7 +13,7 @@ namespace policy { - // This policy can be used by both renderer and worker processes. - class RendererProcessPolicy : public BPFBasePolicy { - public: -- RendererProcessPolicy(); -+ explicit RendererProcessPolicy(bool is_jit_disabled); - - RendererProcessPolicy(const RendererProcessPolicy&) = delete; - RendererProcessPolicy& operator=(const RendererProcessPolicy&) = delete; -@@ -21,6 +21,9 @@ class RendererProcessPolicy : public BPFBasePolicy { - ~RendererProcessPolicy() override; - - bpf_dsl::ResultExpr EvaluateSyscall(int system_call_number) const override; -+ -+ private: -+ const bool is_jit_disabled_; // Disable dynamic code generation if jitless - }; - - } // namespace policy -diff --git a/sandbox/policy/linux/bpf_service_policy_linux.cc b/sandbox/policy/linux/bpf_service_policy_linux.cc ---- a/sandbox/policy/linux/bpf_service_policy_linux.cc -+++ b/sandbox/policy/linux/bpf_service_policy_linux.cc -@@ -20,7 +20,28 @@ using sandbox::bpf_dsl::ResultExpr; - namespace sandbox { - namespace policy { - -+ServiceProcessPolicy::ServiceProcessPolicy(bool is_jit_disabled) -+ : is_jit_disabled_(is_jit_disabled) {} -+ - ResultExpr ServiceProcessPolicy::EvaluateSyscall(int sysno) const { -+ -+ if (is_jit_disabled_) { -+ switch (sysno) { -+#if defined(__i386__) || defined(__x86_64__) || defined(__mips__) || \ -+ defined(__aarch64__) -+ case __NR_mmap: -+#endif -+#if defined(__i386__) || defined(__arm__) || \ -+ (defined(ARCH_CPU_MIPS_FAMILY) && defined(ARCH_CPU_32_BITS)) -+ case __NR_mmap2: -+#endif -+ return RestrictMmapFlagsNoWX(); -+ case __NR_mprotect: -+ case __NR_pkey_mprotect: -+ return RestrictMprotectFlagsNoWX(); -+ } -+ } -+ - switch (sysno) { - case __NR_ioctl: - return RestrictIoctl(); -diff --git a/sandbox/policy/linux/bpf_service_policy_linux.h b/sandbox/policy/linux/bpf_service_policy_linux.h ---- a/sandbox/policy/linux/bpf_service_policy_linux.h -+++ b/sandbox/policy/linux/bpf_service_policy_linux.h -@@ -16,13 +16,16 @@ namespace policy { - // Consider UtilityProcessPolicy if this is too restrictive. - class ServiceProcessPolicy : public BPFBasePolicy { - public: -- ServiceProcessPolicy() = default; -+ explicit ServiceProcessPolicy(bool is_jit_disabled); - ~ServiceProcessPolicy() override = default; - - bpf_dsl::ResultExpr EvaluateSyscall(int system_call_number) const override; - - ServiceProcessPolicy(const ServiceProcessPolicy&) = delete; - ServiceProcessPolicy& operator=(const ServiceProcessPolicy&) = delete; -+ -+ private: -+ const bool is_jit_disabled_; // Disable dynamic code generation if jitless - }; - - } // namespace policy -diff --git a/sandbox/policy/linux/bpf_speech_recognition_policy_linux.cc b/sandbox/policy/linux/bpf_speech_recognition_policy_linux.cc ---- a/sandbox/policy/linux/bpf_speech_recognition_policy_linux.cc -+++ b/sandbox/policy/linux/bpf_speech_recognition_policy_linux.cc -@@ -37,6 +37,18 @@ ResultExpr SpeechRecognitionProcessPolicy::EvaluateSyscall( - case __NR_sched_setscheduler: - // Used for starting an AudioStream when recognizing microphone data. - return RestrictSchedTarget(GetPolicyPid(), system_call_number); -+#if defined(__i386__) || defined(__x86_64__) || defined(__mips__) || \ -+ defined(__aarch64__) -+ case __NR_mmap: -+#endif -+#if defined(__i386__) || defined(__arm__) || \ -+ (defined(ARCH_CPU_MIPS_FAMILY) && defined(ARCH_CPU_32_BITS)) -+ case __NR_mmap2: -+#endif -+ return RestrictMmapFlagsNoWX(); -+ case __NR_mprotect: -+ case __NR_pkey_mprotect: -+ return RestrictMprotectFlagsNoWX(); - default: - auto* sandbox_linux = SandboxLinux::GetInstance(); - if (sandbox_linux->ShouldBrokerHandleSyscall(system_call_number)) -diff --git a/sandbox/policy/linux/bpf_utility_policy_linux.cc b/sandbox/policy/linux/bpf_utility_policy_linux.cc ---- a/sandbox/policy/linux/bpf_utility_policy_linux.cc -+++ b/sandbox/policy/linux/bpf_utility_policy_linux.cc -@@ -46,6 +46,18 @@ ResultExpr UtilityProcessPolicy::EvaluateSyscall(int sysno) const { - case __NR_times: - case __NR_uname: - return Allow(); -+#if defined(__i386__) || defined(__x86_64__) || defined(__mips__) || \ -+ defined(__aarch64__) -+ case __NR_mmap: -+#endif -+#if defined(__i386__) || defined(__arm__) || \ -+ (defined(ARCH_CPU_MIPS_FAMILY) && defined(ARCH_CPU_32_BITS)) -+ case __NR_mmap2: -+#endif -+ return RestrictMmapFlagsNoWX(); -+ case __NR_mprotect: -+ case __NR_pkey_mprotect: -+ return RestrictMprotectFlagsNoWX(); - default: - // Default on the content baseline policy. - return BPFBasePolicy::EvaluateSyscall(sysno); -diff --git a/sandbox/policy/linux/sandbox_seccomp_bpf_linux.cc b/sandbox/policy/linux/sandbox_seccomp_bpf_linux.cc ---- a/sandbox/policy/linux/sandbox_seccomp_bpf_linux.cc -+++ b/sandbox/policy/linux/sandbox_seccomp_bpf_linux.cc -@@ -30,6 +30,8 @@ - - #include "base/files/scoped_file.h" - #include "base/posix/eintr_wrapper.h" -+#include "base/strings/string_split.h" -+#include "gin/gin_features.h" - #include "sandbox/linux/seccomp-bpf-helpers/baseline_policy.h" - #include "sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.h" - #include "sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.h" -@@ -51,6 +53,7 @@ - #include "sandbox/policy/linux/bpf_service_policy_linux.h" - #include "sandbox/policy/linux/bpf_speech_recognition_policy_linux.h" - #include "sandbox/policy/linux/bpf_utility_policy_linux.h" -+#include "third_party/blink/public/common/switches.h" - - #if BUILDFLAG(IS_CHROMEOS_ASH) - #include "sandbox/policy/features.h" -@@ -164,8 +167,29 @@ std::unique_ptr SandboxSeccompBPF::PolicyForSandboxType( - switch (sandbox_type) { - case sandbox::mojom::Sandbox::kGpu: - return GetGpuProcessSandbox(options.use_amd_specific_policies); -- case sandbox::mojom::Sandbox::kRenderer: -- return std::make_unique(); -+ case sandbox::mojom::Sandbox::kRenderer: { -+ const base::CommandLine& command_line = -+ *base::CommandLine::ForCurrentProcess(); -+ bool dynamic_code_can_be_disabled = false; -+ if (base::FeatureList::IsEnabled(features::kV8NoJIT)) { -+ dynamic_code_can_be_disabled = true; -+ } -+ else if (command_line.HasSwitch(blink::switches::kJavaScriptFlags)) { -+ std::string js_flags = -+ command_line.GetSwitchValueASCII(blink::switches::kJavaScriptFlags); -+ std::vector js_flag_list = base::SplitStringPiece( -+ js_flags, ",", base::TRIM_WHITESPACE, base::SPLIT_WANT_NONEMPTY); -+ for (const auto& js_flag : js_flag_list) { -+ if (js_flag == "--jitless") { -+ // If v8 is running jitless then there is no need for the ability to -+ // mark writable pages as executable to be available to the process. -+ dynamic_code_can_be_disabled = true; -+ break; -+ } -+ } -+ } -+ return std::make_unique(dynamic_code_can_be_disabled); -+ } - #if BUILDFLAG(ENABLE_PLUGINS) - case sandbox::mojom::Sandbox::kPpapi: - return std::make_unique(); -@@ -185,9 +209,9 @@ std::unique_ptr SandboxSeccompBPF::PolicyForSandboxType( - case sandbox::mojom::Sandbox::kAudio: - return std::make_unique(); - case sandbox::mojom::Sandbox::kService: -- return std::make_unique(); -+ return std::make_unique(true); - case sandbox::mojom::Sandbox::kServiceWithJit: -- return std::make_unique(); -+ return std::make_unique(false); - case sandbox::mojom::Sandbox::kSpeechRecognition: - return std::make_unique(); - #if BUILDFLAG(IS_CHROMEOS_ASH) --- -2.25.1 diff --git a/build/patches/Remove-mremap-from-system-call-whitelist.patch b/build/patches/Remove-mremap-from-system-call-whitelist.patch deleted file mode 100644 index b5f2d0ed..00000000 --- a/build/patches/Remove-mremap-from-system-call-whitelist.patch +++ /dev/null @@ -1,70 +0,0 @@ -From: qua3k -Date: Fri, 19 Nov 2021 00:00:00 +0000 -Subject: Remove mremap from system call whitelist - -It's not used in PartitionAlloc and should be removed. ---- - sandbox/linux/seccomp-bpf-helpers/syscall_sets.cc | 1 - - sandbox/policy/linux/bpf_cdm_policy_linux.cc | 1 - - sandbox/policy/linux/bpf_print_compositor_policy_linux.cc | 1 - - sandbox/policy/linux/bpf_service_policy_linux.cc | 1 - - sandbox/policy/linux/bpf_utility_policy_linux.cc | 1 - - 5 files changed, 5 deletions(-) - -diff --git a/sandbox/linux/seccomp-bpf-helpers/syscall_sets.cc b/sandbox/linux/seccomp-bpf-helpers/syscall_sets.cc ---- a/sandbox/linux/seccomp-bpf-helpers/syscall_sets.cc -+++ b/sandbox/linux/seccomp-bpf-helpers/syscall_sets.cc -@@ -566,7 +566,6 @@ bool SyscallSets::IsAllowedAddressSpaceAccess(int sysno) { - case __NR_modify_ldt: - #endif - case __NR_mprotect: -- case __NR_mremap: - case __NR_msync: - case __NR_munlockall: - case __NR_readahead: -diff --git a/sandbox/policy/linux/bpf_cdm_policy_linux.cc b/sandbox/policy/linux/bpf_cdm_policy_linux.cc ---- a/sandbox/policy/linux/bpf_cdm_policy_linux.cc -+++ b/sandbox/policy/linux/bpf_cdm_policy_linux.cc -@@ -39,7 +39,6 @@ ResultExpr CdmProcessPolicy::EvaluateSyscall(int sysno) const { - #if defined(__i386__) || defined(__arm__) - case __NR_ugetrlimit: - #endif -- case __NR_mremap: // https://crbug.com/546204 - case __NR_pwrite64: - case __NR_sysinfo: - case __NR_times: -diff --git a/sandbox/policy/linux/bpf_print_compositor_policy_linux.cc b/sandbox/policy/linux/bpf_print_compositor_policy_linux.cc ---- a/sandbox/policy/linux/bpf_print_compositor_policy_linux.cc -+++ b/sandbox/policy/linux/bpf_print_compositor_policy_linux.cc -@@ -39,7 +39,6 @@ ResultExpr PrintCompositorProcessPolicy::EvaluateSyscall(int sysno) const { - #if defined(__i386__) || defined(__arm__) - case __NR_ugetrlimit: - #endif -- case __NR_mremap: // https://crbug.com/546204 - case __NR_pwrite64: - case __NR_sysinfo: - case __NR_times: -diff --git a/sandbox/policy/linux/bpf_service_policy_linux.cc b/sandbox/policy/linux/bpf_service_policy_linux.cc ---- a/sandbox/policy/linux/bpf_service_policy_linux.cc -+++ b/sandbox/policy/linux/bpf_service_policy_linux.cc -@@ -53,7 +53,6 @@ ResultExpr ServiceProcessPolicy::EvaluateSyscall(int sysno) const { - #if defined(__i386__) || defined(__arm__) - case __NR_ugetrlimit: - #endif -- case __NR_mremap: // https://crbug.com/546204 - case __NR_pwrite64: - case __NR_times: - return Allow(); -diff --git a/sandbox/policy/linux/bpf_utility_policy_linux.cc b/sandbox/policy/linux/bpf_utility_policy_linux.cc ---- a/sandbox/policy/linux/bpf_utility_policy_linux.cc -+++ b/sandbox/policy/linux/bpf_utility_policy_linux.cc -@@ -40,7 +40,6 @@ ResultExpr UtilityProcessPolicy::EvaluateSyscall(int sysno) const { - #if defined(__i386__) || defined(__arm__) - case __NR_ugetrlimit: - #endif -- case __NR_mremap: // https://crbug.com/546204 - case __NR_pwrite64: - case __NR_sysinfo: - case __NR_times: --- -2.25.1 diff --git a/build/patches/Restrict-creation-of-dynamic-code.patch b/build/patches/Restrict-creation-of-dynamic-code.patch deleted file mode 100644 index 5c064855..00000000 --- a/build/patches/Restrict-creation-of-dynamic-code.patch +++ /dev/null @@ -1,144 +0,0 @@ -From: qua3k -Date: Thu, 4 Nov 2021 00:00:00 +0000 -Subject: Restrict creation of dynamic code - -This commit has three parts, utilizing seccomp-bpf to prevent: - -1. the creation of executable anonymous mappings -2. the creation of writable and executable file mappings -3. making a non-executable mapping executable - -It's inspired by PaX MPROTECT restrictions. ---- - .../syscall_parameters_restrictions.cc | 55 +++++++++++++++++++ - .../syscall_parameters_restrictions.h | 18 ++++++ - 2 files changed, 73 insertions(+) - -diff --git a/sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.cc b/sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.cc ---- a/sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.cc -+++ b/sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.cc -@@ -15,6 +15,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -227,6 +228,31 @@ ResultExpr RestrictMmapFlags() { - return If((flags & ~kAllowedMask) == 0, Allow()).Else(CrashSIGSYS()); - } - -+ResultExpr RestrictMmapFlagsNoWX() { -+ // The flags you see are actually the allowed ones, and the variable is a -+ // "denied" mask because of the negation operator. -+ // Significantly, we don't permit MAP_HUGETLB, or the newer flags such as -+ // MAP_POPULATE. -+ // TODO(davidung), remove MAP_DENYWRITE with updated Tegra libraries. -+ -+ const Arg prot(2); -+ const Arg flags(3); -+ -+ const BoolExpr is_mapping_w_x = (prot & (PROT_WRITE | PROT_EXEC)) != (PROT_WRITE | PROT_EXEC); -+ -+ const BoolExpr is_anon_mapping_nx = -+ AllOf((prot & PROT_EXEC) == 0, -+ (flags & MAP_ANONYMOUS) == MAP_ANONYMOUS); -+ -+ const uint64_t kAllowedMask = MAP_SHARED | MAP_PRIVATE | MAP_STACK | -+ MAP_NORESERVE | MAP_FIXED | MAP_DENYWRITE | -+ MAP_LOCKED; -+ -+ return If(is_anon_mapping_nx, Allow()) -+ .ElseIf(AllOf(is_mapping_w_x, (flags & ~kAllowedMask) == 0), Allow()) -+ .Else(CrashSIGSYS()); -+} -+ - ResultExpr RestrictMprotectFlags() { - // The flags you see are actually the allowed ones, and the variable is a - // "denied" mask because of the negation operator. -@@ -245,6 +271,24 @@ ResultExpr RestrictMprotectFlags() { - return If((prot & ~kAllowedMask) == 0, Allow()).Else(CrashSIGSYS()); - } - -+ResultExpr RestrictMprotectFlagsNoWX() { -+ // The flags you see are actually the allowed ones, and the variable is a -+ // "denied" mask because of the negation operator. -+ // Significantly, we don't permit making non-executable pages executable, -+ // as well as weird undocumented flags such as PROT_GROWSDOWN. -+#if defined(ARCH_CPU_ARM64) -+ // Allows PROT_MTE and PROT_BTI (as explained higher up) on only Arm -+ // platforms. -+ const uint64_t kArchSpecificFlags = PROT_MTE | PROT_BTI; -+#else -+ const uint64_t kArchSpecificFlags = 0; -+#endif -+ const uint64_t kAllowedMask = -+ PROT_READ | PROT_WRITE | kArchSpecificFlags; -+ const Arg prot(2); -+ return If((prot & ~kAllowedMask) == 0, Allow()).Else(CrashSIGSYS()); -+} -+ - ResultExpr RestrictFcntlCommands() { - // We also restrict the flags in F_SETFL. We don't want to permit flags with - // a history of trouble such as O_DIRECT. The flags you see are actually the -@@ -281,6 +325,17 @@ ResultExpr RestrictFcntlCommands() { - // clang-format on - } - -+ResultExpr RestrictShmatFlags() { -+ // The flags you see are actually the allowed ones, and the variable is a -+ // "denied" mask because of the negation operator. -+ // Significantly, we don't permit flags that allow for dynamic code -+ // generation such as SHM_EXEC. -+ const uint64_t kAllowedMask = -+ 0 | SHM_RND | SHM_RDONLY | SHM_REMAP; -+ const Arg shmflg(2); -+ return If((shmflg & ~kAllowedMask) == 0, Allow()).Else(CrashSIGSYS()); -+} -+ - #if defined(__i386__) || defined(__mips__) - ResultExpr RestrictSocketcallCommand() { - // Unfortunately, we are unable to restrict the first parameter to -diff --git a/sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.h b/sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.h ---- a/sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.h -+++ b/sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.h -@@ -37,11 +37,25 @@ SANDBOX_EXPORT bpf_dsl::ResultExpr RestrictIoctl(); - // Crash if any other flag is used. - SANDBOX_EXPORT bpf_dsl::ResultExpr RestrictMmapFlags(); - -+// Restrict mmap(2) arguments to: -+// Allow: MAP_SHARED | MAP_PRIVATE | MAP_ANONYMOUS | -+// MAP_STACK | MAP_NORESERVE | MAP_FIXED | MAP_DENYWRITE. -+// Crash if any other flag is used. -+// Also, in prots, restrict the allowed protections to: -+// PROT_READ | PROT_WRITE ^ PROT_EXEC. -+// PROT_BTI | PROT_MTE is additionally allowed on 64-bit Arm. -+SANDBOX_EXPORT bpf_dsl::ResultExpr RestrictMmapFlagsNoWX(); -+ - // Restrict the prot argument in mprotect(2). - // Only allow: PROT_READ | PROT_WRITE | PROT_EXEC. - // PROT_BTI | PROT_MTE is additionally allowed on 64-bit Arm. - SANDBOX_EXPORT bpf_dsl::ResultExpr RestrictMprotectFlags(); - -+// Restrict the prot argument in mprotect(2). -+// Only allow: PROT_READ | PROT_WRITE. -+// PROT_BTI | PROT_MTE is additionally allowed on 64-bit Arm. -+SANDBOX_EXPORT bpf_dsl::ResultExpr RestrictMprotectFlagsNoWX(); -+ - // Restrict fcntl(2) cmd argument to: - // We allow F_GETFL, F_SETFL, F_GETFD, F_SETFD, F_DUPFD, F_DUPFD_CLOEXEC, - // F_SETLK, F_SETLKW and F_GETLK. -@@ -49,6 +63,10 @@ SANDBOX_EXPORT bpf_dsl::ResultExpr RestrictMprotectFlags(); - // O_NONBLOCK | O_SYNC | O_LARGEFILE | O_CLOEXEC | O_NOATIME. - SANDBOX_EXPORT bpf_dsl::ResultExpr RestrictFcntlCommands(); - -+// Restrict the shmflg argument in shmat(2). -+// Only allow: SHM_RND | SHM_RDONLY | SHM_REMAP. -+SANDBOX_EXPORT bpf_dsl::ResultExpr RestrictShmatFlags(); -+ - #if defined(__i386__) || defined(__mips__) - // Restrict socketcall(2) to only allow socketpair(2), send(2), recv(2), - // sendto(2), recvfrom(2), shutdown(2), sendmsg(2) and recvmsg(2). --- -2.25.1