OLD | NEW |
1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "sandbox/linux/seccomp-bpf-helpers/baseline_policy.h" | 5 #include "sandbox/linux/seccomp-bpf-helpers/baseline_policy.h" |
6 | 6 |
7 #include <errno.h> | 7 #include <errno.h> |
8 #include <sys/mman.h> | 8 #include <sys/mman.h> |
9 #include <sys/socket.h> | 9 #include <sys/socket.h> |
10 #include <sys/syscall.h> | 10 #include <sys/syscall.h> |
(...skipping 213 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
224 SyscallSets::IsDeniedGetOrModifySocket(sysno) || | 224 SyscallSets::IsDeniedGetOrModifySocket(sysno) || |
225 SyscallSets::IsProcessPrivilegeChange(sysno)) { | 225 SyscallSets::IsProcessPrivilegeChange(sysno)) { |
226 return Error(EPERM); | 226 return Error(EPERM); |
227 } | 227 } |
228 | 228 |
229 #if defined(__i386__) || defined(__mips__) | 229 #if defined(__i386__) || defined(__mips__) |
230 if (SyscallSets::IsSocketCall(sysno)) | 230 if (SyscallSets::IsSocketCall(sysno)) |
231 return RestrictSocketcallCommand(); | 231 return RestrictSocketcallCommand(); |
232 #endif | 232 #endif |
233 | 233 |
234 #if defined(__x86_64__) | 234 #if !defined(__i386__) |
235 if (sysno == __NR_getsockopt || sysno ==__NR_setsockopt) { | 235 if (sysno == __NR_getsockopt || sysno ==__NR_setsockopt) { |
236 // Used by Mojo EDK to catch a message pipe being sent over itself. | 236 // Used by Mojo EDK to catch a message pipe being sent over itself. |
237 const Arg<int> level(1); | 237 const Arg<int> level(1); |
238 const Arg<int> optname(2); | 238 const Arg<int> optname(2); |
239 return If(AllOf(level == SOL_SOCKET, optname == SO_PEEK_OFF), Allow()) | 239 return If(AllOf(level == SOL_SOCKET, optname == SO_PEEK_OFF), Allow()) |
240 .Else(CrashSIGSYS()); | 240 .Else(CrashSIGSYS()); |
241 } | 241 } |
242 #endif | 242 #endif |
243 | 243 |
244 if (IsBaselinePolicyWatched(sysno)) { | 244 if (IsBaselinePolicyWatched(sysno)) { |
(...skipping 30 matching lines...) Expand all Loading... |
275 DCHECK_EQ(sys_getpid(), policy_pid_); | 275 DCHECK_EQ(sys_getpid(), policy_pid_); |
276 } | 276 } |
277 return EvaluateSyscallImpl(fs_denied_errno_, policy_pid_, sysno); | 277 return EvaluateSyscallImpl(fs_denied_errno_, policy_pid_, sysno); |
278 } | 278 } |
279 | 279 |
280 ResultExpr BaselinePolicy::InvalidSyscall() const { | 280 ResultExpr BaselinePolicy::InvalidSyscall() const { |
281 return CrashSIGSYS(); | 281 return CrashSIGSYS(); |
282 } | 282 } |
283 | 283 |
284 } // namespace sandbox. | 284 } // namespace sandbox. |
OLD | NEW |