OLD | NEW |
1 // Copyright 2015 The Chromium Authors. All rights reserved. | 1 // Copyright 2015 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "mojo/runner/host/linux_sandbox.h" | 5 #include "mojo/runner/host/linux_sandbox.h" |
6 | 6 |
7 #include <fcntl.h> | 7 #include <fcntl.h> |
8 #include <sys/syscall.h> | 8 #include <sys/syscall.h> |
9 | 9 |
10 #include "base/bind.h" | 10 #include "base/bind.h" |
11 #include "base/debug/leak_annotations.h" | 11 #include "base/debug/leak_annotations.h" |
12 #include "base/posix/eintr_wrapper.h" | 12 #include "base/posix/eintr_wrapper.h" |
13 #include "base/rand_util.h" | 13 #include "base/rand_util.h" |
14 #include "base/sys_info.h" | 14 #include "base/sys_info.h" |
15 #include "sandbox/linux/bpf_dsl/policy.h" | 15 #include "sandbox/linux/bpf_dsl/policy.h" |
16 #include "sandbox/linux/bpf_dsl/trap_registry.h" | 16 #include "sandbox/linux/bpf_dsl/trap_registry.h" |
17 #include "sandbox/linux/seccomp-bpf-helpers/baseline_policy.h" | 17 #include "sandbox/linux/seccomp-bpf-helpers/baseline_policy.h" |
18 #include "sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.h" | 18 #include "sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.h" |
19 #include "sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.h" | 19 #include "sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.h" |
20 #include "sandbox/linux/seccomp-bpf-helpers/syscall_sets.h" | 20 #include "sandbox/linux/seccomp-bpf-helpers/syscall_sets.h" |
21 #include "sandbox/linux/seccomp-bpf/sandbox_bpf.h" | 21 #include "sandbox/linux/seccomp-bpf/sandbox_bpf.h" |
22 #include "sandbox/linux/services/credentials.h" | 22 #include "sandbox/linux/services/credentials.h" |
23 #include "sandbox/linux/services/namespace_sandbox.h" | 23 #include "sandbox/linux/services/namespace_sandbox.h" |
24 #include "sandbox/linux/services/proc_util.h" | 24 #include "sandbox/linux/services/proc_util.h" |
25 #include "sandbox/linux/services/thread_helpers.h" | 25 #include "sandbox/linux/services/thread_helpers.h" |
| 26 #include "sandbox/linux/system_headers/linux_syscalls.h" |
26 | 27 |
27 using sandbox::syscall_broker::BrokerFilePermission; | 28 using sandbox::syscall_broker::BrokerFilePermission; |
28 | 29 |
29 namespace mojo { | 30 namespace mojo { |
30 namespace runner { | 31 namespace runner { |
31 | 32 |
32 namespace { | 33 namespace { |
33 | 34 |
34 intptr_t SandboxSIGSYSHandler(const struct sandbox::arch_seccomp_data& args, | 35 intptr_t SandboxSIGSYSHandler(const struct sandbox::arch_seccomp_data& args, |
35 void* aux) { | 36 void* aux) { |
(...skipping 110 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
146 ALLOW_UNUSED_LOCAL(leaked_broker); | 147 ALLOW_UNUSED_LOCAL(leaked_broker); |
147 ANNOTATE_LEAKING_OBJECT_PTR(leaked_broker); | 148 ANNOTATE_LEAKING_OBJECT_PTR(leaked_broker); |
148 } | 149 } |
149 | 150 |
150 void LinuxSandbox::Seal() { | 151 void LinuxSandbox::Seal() { |
151 proc_fd_.reset(); | 152 proc_fd_.reset(); |
152 } | 153 } |
153 | 154 |
154 } // namespace runner | 155 } // namespace runner |
155 } // namespace mojo | 156 } // namespace mojo |
OLD | NEW |