OLD | NEW |
| (Empty) |
1 // Copyright 2013 The Chromium Authors. All rights reserved. | |
2 // Use of this source code is governed by a BSD-style license that can be | |
3 // found in the LICENSE file. | |
4 | |
5 #ifndef CONTENT_COMMON_SANDBOX_LINUX_SANDBOX_BPF_BASE_POLICY_LINUX_H_ | |
6 #define CONTENT_COMMON_SANDBOX_LINUX_SANDBOX_BPF_BASE_POLICY_LINUX_H_ | |
7 | |
8 #include "base/basictypes.h" | |
9 #include "base/memory/scoped_ptr.h" | |
10 #include "sandbox/linux/seccomp-bpf-helpers/baseline_policy.h" | |
11 #include "sandbox/linux/seccomp-bpf/sandbox_bpf_policy.h" | |
12 | |
13 using sandbox::ErrorCode; | |
14 using sandbox::SandboxBPF; | |
15 | |
16 namespace content { | |
17 | |
18 // The "baseline" BPF policy for content/. Any content/ seccomp-bpf policy | |
19 // should inherit from it. | |
20 // It implements the main SandboxBPFPolicy interface. Due to its nature | |
21 // as a "kernel attack surface reduction" layer, it's implementation-defined. | |
22 class SandboxBPFBasePolicy : public sandbox::SandboxBPFPolicy { | |
23 public: | |
24 SandboxBPFBasePolicy(); | |
25 virtual ~SandboxBPFBasePolicy(); | |
26 | |
27 virtual ErrorCode EvaluateSyscall(SandboxBPF* sandbox_compiler, | |
28 int system_call_number) const OVERRIDE; | |
29 | |
30 // A policy can implement this hook to run code right before the policy | |
31 // is passed to the SandboxBPF class and the sandbox is engaged. | |
32 // If PreSandboxHook() returns true, the sandbox is guaranteed to be | |
33 // engaged afterwards. | |
34 // This will be used when enabling the sandbox though | |
35 // SandboxSeccompBPF::StartSandbox(). | |
36 virtual bool PreSandboxHook(); | |
37 | |
38 // Get the errno(3) to return for filesystem errors. | |
39 static int GetFSDeniedErrno(); | |
40 | |
41 private: | |
42 // Compose the BaselinePolicy from sandbox/. | |
43 scoped_ptr<sandbox::BaselinePolicy> baseline_policy_; | |
44 DISALLOW_COPY_AND_ASSIGN(SandboxBPFBasePolicy); | |
45 }; | |
46 | |
47 } // namespace content | |
48 | |
49 #endif // CONTENT_COMMON_SANDBOX_LINUX_SANDBOX_BPF_BASE_POLICY_LINUX_H_ | |
OLD | NEW |