[sanitizer] Disable writes to log files for binaries in a secure context.

compiler-rt/lib/sanitizer_common/sanitizer_common.h

@@ -1096,6 +1096,11 @@ inline u32 GetNumberOfCPUsCached() {
   return NumberOfCPUsCached;
 }
 
+// Returns true if the our runtime has special privileges (e.g. setuid) and
+// should be treated with caution when dealing with untrusted user input.
+// For example, when writing files or executing user-specified binaries.
+bool ShouldTreatRuntimeSecurely();
+
 }  // namespace __sanitizer
 
 inline void *operator new(__sanitizer::usize size,

compiler-rt/lib/sanitizer_common/sanitizer_common_nolibc.cpp

@@ -26,6 +26,8 @@ void LogMessageOnPrintf(const char *str) {}
 void WriteToSyslog(const char *buffer) {}
 void Abort() { internal__exit(1); }
 bool CreateDir(const char *pathname) { return false; }
+// TODO: Revisit using insecure by default approach for no-libc binaries.
+bool ShouldTreatRuntimeSecurely() { return false; }
 #endif // !SANITIZER_WINDOWS
 
 #if !SANITIZER_WINDOWS && !SANITIZER_APPLE

compiler-rt/lib/sanitizer_common/sanitizer_file.cpp

@@ -104,6 +104,16 @@ void ReportFile::SetReportPath(const char *path) {
     }
   }
 
+  if (path && ShouldTreatRuntimeSecurely() &&
+      internal_strcmp(path, "stderr") != 0 &&
+      internal_strcmp(path, "stdout") != 0) {
+    Report(
+        "ERROR: log_path must be 'stderr' or 'stdout' for AT_SECURE and/or "
+        "setuid binaries, is '%s'\n",
+        path);
+    Die();
+  }
+
   SpinMutexLock l(mu);
   if (fd != kStdoutFd && fd != kStderrFd && fd != kInvalidFd)
     CloseFile(fd);

compiler-rt/lib/sanitizer_common/sanitizer_posix_libcdep.cpp

@@ -43,6 +43,10 @@
 #define MAP_NORESERVE 0
 #endif
 
+#  if SANITIZER_LINUX
+#    include "sanitizer_getauxval.h"
+#  endif
+
 typedef void (*sa_sigaction_t)(int, siginfo_t *, void *);
 
 namespace __sanitizer {
@@ -518,6 +522,15 @@ bool IsStateDetached(int state) {
   return state == PTHREAD_CREATE_DETACHED;
 }
 
+bool ShouldTreatRuntimeSecurely() {
+#  if SANITIZER_LINUX
+  // So we can use weak reference from sanitizer_getauxval.h
+  if (&getauxval)
+    return getauxval(/* AT_SECURE */ 23) != 0;
+#  endif
+  return getuid() != geteuid() || getgid() != getegid();
+}
+
 } // namespace __sanitizer
 
 #endif // SANITIZER_POSIX

compiler-rt/lib/sanitizer_common/sanitizer_win.cpp

@@ -1199,6 +1199,10 @@ void LogFullErrorReport(const char *buffer) {
 
 void InitializePlatformCommonFlags(CommonFlags *cf) {}
 
+// FIXME: implement on this platform.
+// Windows analog to such runtime would be auto-elevated binaries.
+bool ShouldTreatRuntimeSecurely() { return false; }
+
 }  // namespace __sanitizer
 
 #endif  // _WIN32