| OLD | NEW | 
|    1 // Copyright 2015 The Chromium Authors. All rights reserved. |    1 // Copyright 2015 The Chromium Authors. All rights reserved. | 
|    2 // Use of this source code is governed by a BSD-style license that can be |    2 // Use of this source code is governed by a BSD-style license that can be | 
|    3 // found in the LICENSE file. |    3 // found in the LICENSE file. | 
|    4  |    4  | 
|    5 #include "mojo/runner/host/linux_sandbox.h" |    5 #include "mojo/runner/host/linux_sandbox.h" | 
|    6  |    6  | 
|    7 #include <fcntl.h> |    7 #include <fcntl.h> | 
|    8 #include <sys/syscall.h> |    8 #include <sys/syscall.h> | 
|    9 #include <utility> |    9 #include <utility> | 
|   10  |   10  | 
| (...skipping 66 matching lines...) Expand 10 before | Expand all | Expand 10 after  Loading... | 
|   77     // This policy is only advisory/for noticing FS access for the moment. |   77     // This policy is only advisory/for noticing FS access for the moment. | 
|   78     switch (sysno) { |   78     switch (sysno) { | 
|   79       case __NR_access: |   79       case __NR_access: | 
|   80       case __NR_open: |   80       case __NR_open: | 
|   81       case __NR_faccessat: |   81       case __NR_faccessat: | 
|   82       case __NR_openat: |   82       case __NR_openat: | 
|   83         return sandbox::bpf_dsl::Trap(SandboxSIGSYSHandler, broker_process_); |   83         return sandbox::bpf_dsl::Trap(SandboxSIGSYSHandler, broker_process_); | 
|   84       case __NR_sched_getaffinity: |   84       case __NR_sched_getaffinity: | 
|   85         return sandbox::RestrictSchedTarget(policy_pid(), sysno); |   85         return sandbox::RestrictSchedTarget(policy_pid(), sysno); | 
|   86       case __NR_ftruncate: |   86       case __NR_ftruncate: | 
|   87 #if defined(__NR_getrlimit) |   87 #if defined(__i386__) || defined(__x86_64__) || defined(__mips__) | 
|   88       // __NR_getrlimit does not exist on all systems (e.g. in the arm/linux |   88       // Per #ifdefs in | 
|   89       // build). |   89       // content/common/sandbox_linux/bpf_renderer_policy_linux.cc | 
|   90       case __NR_getrlimit: |   90       case __NR_getrlimit: | 
|   91 #endif |   91 #endif | 
 |   92 #if defined(__i386__) || defined(__arm__) | 
 |   93       case __NR_ugetrlimit: | 
 |   94 #endif | 
|   92       case __NR_uname: |   95       case __NR_uname: | 
|   93       case __NR_getsockopt: |   96       case __NR_getsockopt: | 
|   94       case __NR_setsockopt: |   97       case __NR_setsockopt: | 
|   95         return sandbox::bpf_dsl::Allow(); |   98         return sandbox::bpf_dsl::Allow(); | 
|   96     } |   99     } | 
|   97  |  100  | 
|   98     return BaselinePolicy::EvaluateSyscall(sysno); |  101     return BaselinePolicy::EvaluateSyscall(sysno); | 
|   99   } |  102   } | 
|  100  |  103  | 
|  101  private: |  104  private: | 
| (...skipping 49 matching lines...) Expand 10 before | Expand all | Expand 10 after  Loading... | 
|  151   ALLOW_UNUSED_LOCAL(leaked_broker); |  154   ALLOW_UNUSED_LOCAL(leaked_broker); | 
|  152   ANNOTATE_LEAKING_OBJECT_PTR(leaked_broker); |  155   ANNOTATE_LEAKING_OBJECT_PTR(leaked_broker); | 
|  153 } |  156 } | 
|  154  |  157  | 
|  155 void LinuxSandbox::Seal() { |  158 void LinuxSandbox::Seal() { | 
|  156   proc_fd_.reset(); |  159   proc_fd_.reset(); | 
|  157 } |  160 } | 
|  158  |  161  | 
|  159 }  // namespace runner |  162 }  // namespace runner | 
|  160 }  // namespace mojo |  163 }  // namespace mojo | 
| OLD | NEW |