| OLD | NEW |
| 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "sandbox/linux/seccomp-bpf-helpers/baseline_policy.h" | 5 #include "sandbox/linux/seccomp-bpf-helpers/baseline_policy.h" |
| 6 | 6 |
| 7 #include <errno.h> | 7 #include <errno.h> |
| 8 #include <sys/mman.h> | 8 #include <sys/mman.h> |
| 9 #include <sys/socket.h> | 9 #include <sys/socket.h> |
| 10 #include <sys/syscall.h> | 10 #include <sys/syscall.h> |
| (...skipping 213 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 224 SyscallSets::IsDeniedGetOrModifySocket(sysno) || | 224 SyscallSets::IsDeniedGetOrModifySocket(sysno) || |
| 225 SyscallSets::IsProcessPrivilegeChange(sysno)) { | 225 SyscallSets::IsProcessPrivilegeChange(sysno)) { |
| 226 return Error(EPERM); | 226 return Error(EPERM); |
| 227 } | 227 } |
| 228 | 228 |
| 229 #if defined(__i386__) || defined(__mips__) | 229 #if defined(__i386__) || defined(__mips__) |
| 230 if (SyscallSets::IsSocketCall(sysno)) | 230 if (SyscallSets::IsSocketCall(sysno)) |
| 231 return RestrictSocketcallCommand(); | 231 return RestrictSocketcallCommand(); |
| 232 #endif | 232 #endif |
| 233 | 233 |
| 234 #if defined(__x86_64__) | 234 #if !defined(__i386__) |
| 235 if (sysno == __NR_getsockopt || sysno ==__NR_setsockopt) { | 235 if (sysno == __NR_getsockopt || sysno ==__NR_setsockopt) { |
| 236 // Used by Mojo EDK to catch a message pipe being sent over itself. | 236 // Used by Mojo EDK to catch a message pipe being sent over itself. |
| 237 const Arg<int> level(1); | 237 const Arg<int> level(1); |
| 238 const Arg<int> optname(2); | 238 const Arg<int> optname(2); |
| 239 return If(AllOf(level == SOL_SOCKET, optname == SO_PEEK_OFF), Allow()) | 239 return If(AllOf(level == SOL_SOCKET, optname == SO_PEEK_OFF), Allow()) |
| 240 .Else(CrashSIGSYS()); | 240 .Else(CrashSIGSYS()); |
| 241 } | 241 } |
| 242 #endif | 242 #endif |
| 243 | 243 |
| 244 if (IsBaselinePolicyWatched(sysno)) { | 244 if (IsBaselinePolicyWatched(sysno)) { |
| (...skipping 30 matching lines...) Expand all Loading... |
| 275 DCHECK_EQ(sys_getpid(), policy_pid_); | 275 DCHECK_EQ(sys_getpid(), policy_pid_); |
| 276 } | 276 } |
| 277 return EvaluateSyscallImpl(fs_denied_errno_, policy_pid_, sysno); | 277 return EvaluateSyscallImpl(fs_denied_errno_, policy_pid_, sysno); |
| 278 } | 278 } |
| 279 | 279 |
| 280 ResultExpr BaselinePolicy::InvalidSyscall() const { | 280 ResultExpr BaselinePolicy::InvalidSyscall() const { |
| 281 return CrashSIGSYS(); | 281 return CrashSIGSYS(); |
| 282 } | 282 } |
| 283 | 283 |
| 284 } // namespace sandbox. | 284 } // namespace sandbox. |
| OLD | NEW |