| OLD | NEW |
|---|
| 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #ifndef SANDBOX_LINUX_SECCOMP_BPF_HELPERS_SYSCALL_PARAMETERS_RESTRICTIONS_H_ | 5 #ifndef SANDBOX_LINUX_SECCOMP_BPF_HELPERS_SYSCALL_PARAMETERS_RESTRICTIONS_H_ |
| 6 #define SANDBOX_LINUX_SECCOMP_BPF_HELPERS_SYSCALL_PARAMETERS_RESTRICTIONS_H_ | 6 #define SANDBOX_LINUX_SECCOMP_BPF_HELPERS_SYSCALL_PARAMETERS_RESTRICTIONS_H_ |
| 7 | 7 |
| 8 #include <unistd.h> | 8 #include <unistd.h> |
| 9 | 9 |
| 10 #include "build/build_config.h" | 10 #include "build/build_config.h" |
| (...skipping 74 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 85 // Restricts the |who| argument of getrusage to RUSAGE_SELF (meaning the calling | 85 // Restricts the |who| argument of getrusage to RUSAGE_SELF (meaning the calling |
| 86 // process). | 86 // process). |
| 87 SANDBOX_EXPORT bpf_dsl::ResultExpr RestrictGetrusage(); | 87 SANDBOX_EXPORT bpf_dsl::ResultExpr RestrictGetrusage(); |
| 88 | 88 |
| 89 // Restrict |clk_id| for clock_getres(), clock_gettime() and clock_settime(). | 89 // Restrict |clk_id| for clock_getres(), clock_gettime() and clock_settime(). |
| 90 // We allow accessing only CLOCK_MONOTONIC, CLOCK_PROCESS_CPUTIME_ID, | 90 // We allow accessing only CLOCK_MONOTONIC, CLOCK_PROCESS_CPUTIME_ID, |
| 91 // CLOCK_REALTIME, and CLOCK_THREAD_CPUTIME_ID. In particular, this disallows | 91 // CLOCK_REALTIME, and CLOCK_THREAD_CPUTIME_ID. In particular, this disallows |
| 92 // access to arbitrary per-{process,thread} CPU-time clock IDs (such as those | 92 // access to arbitrary per-{process,thread} CPU-time clock IDs (such as those |
| 93 // returned by {clock,pthread}_getcpuclockid), which can leak information | 93 // returned by {clock,pthread}_getcpuclockid), which can leak information |
| 94 // about the state of the host OS. | 94 // about the state of the host OS. |
| 95 // On Chrome OS, base::TraceTicks::kClockSystemTrace is also allowed. | |
| 96 SANDBOX_EXPORT bpf_dsl::ResultExpr RestrictClockID(); | 95 SANDBOX_EXPORT bpf_dsl::ResultExpr RestrictClockID(); |
| 97 | 96 |
| 98 } // namespace sandbox. | 97 } // namespace sandbox. |
| 99 | 98 |
| 100 #endif // SANDBOX_LINUX_SECCOMP_BPF_HELPERS_SYSCALL_PARAMETERS_RESTRICTIONS_H_ | 99 #endif // SANDBOX_LINUX_SECCOMP_BPF_HELPERS_SYSCALL_PARAMETERS_RESTRICTIONS_H_ |
| OLD | NEW |
|---|
Chromium Code Reviews
Issue 1424323002:
Removes support for using the system clock on ChromeOS (Closed)
Base URL: https://chromium.googlesource.com/chromium/src.git@master