OLD | NEW |
1 // Copyright 2015 The Chromium Authors. All rights reserved. | 1 // Copyright 2015 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "mojo/runner/host/linux_sandbox.h" | 5 #include "mojo/runner/host/linux_sandbox.h" |
6 | 6 |
7 #include <fcntl.h> | 7 #include <fcntl.h> |
8 #include <sys/syscall.h> | 8 #include <sys/syscall.h> |
9 #include <utility> | 9 #include <utility> |
10 | 10 |
(...skipping 66 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
77 // This policy is only advisory/for noticing FS access for the moment. | 77 // This policy is only advisory/for noticing FS access for the moment. |
78 switch (sysno) { | 78 switch (sysno) { |
79 case __NR_access: | 79 case __NR_access: |
80 case __NR_open: | 80 case __NR_open: |
81 case __NR_faccessat: | 81 case __NR_faccessat: |
82 case __NR_openat: | 82 case __NR_openat: |
83 return sandbox::bpf_dsl::Trap(SandboxSIGSYSHandler, broker_process_); | 83 return sandbox::bpf_dsl::Trap(SandboxSIGSYSHandler, broker_process_); |
84 case __NR_sched_getaffinity: | 84 case __NR_sched_getaffinity: |
85 return sandbox::RestrictSchedTarget(policy_pid(), sysno); | 85 return sandbox::RestrictSchedTarget(policy_pid(), sysno); |
86 case __NR_ftruncate: | 86 case __NR_ftruncate: |
87 #if defined(__NR_getrlimit) | 87 #if defined(__i386__) || defined(__x86_64__) || defined(__mips__) |
88 // __NR_getrlimit does not exist on all systems (e.g. in the arm/linux | 88 // Per #ifdefs in |
89 // build). | 89 // content/common/sandbox_linux/bpf_renderer_policy_linux.cc |
90 case __NR_getrlimit: | 90 case __NR_getrlimit: |
91 #endif | 91 #endif |
| 92 #if defined(__i386__) || defined(__arm__) |
| 93 case __NR_ugetrlimit: |
| 94 #endif |
92 case __NR_uname: | 95 case __NR_uname: |
93 case __NR_getsockopt: | 96 case __NR_getsockopt: |
94 case __NR_setsockopt: | 97 case __NR_setsockopt: |
95 return sandbox::bpf_dsl::Allow(); | 98 return sandbox::bpf_dsl::Allow(); |
96 } | 99 } |
97 | 100 |
98 return BaselinePolicy::EvaluateSyscall(sysno); | 101 return BaselinePolicy::EvaluateSyscall(sysno); |
99 } | 102 } |
100 | 103 |
101 private: | 104 private: |
(...skipping 49 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
151 ALLOW_UNUSED_LOCAL(leaked_broker); | 154 ALLOW_UNUSED_LOCAL(leaked_broker); |
152 ANNOTATE_LEAKING_OBJECT_PTR(leaked_broker); | 155 ANNOTATE_LEAKING_OBJECT_PTR(leaked_broker); |
153 } | 156 } |
154 | 157 |
155 void LinuxSandbox::Seal() { | 158 void LinuxSandbox::Seal() { |
156 proc_fd_.reset(); | 159 proc_fd_.reset(); |
157 } | 160 } |
158 | 161 |
159 } // namespace runner | 162 } // namespace runner |
160 } // namespace mojo | 163 } // namespace mojo |
OLD | NEW |