| OLD | NEW |
| 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.h" | 5 #include "sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.h" |
| 6 | 6 |
| 7 #include <errno.h> | 7 #include <errno.h> |
| 8 #include <fcntl.h> | 8 #include <fcntl.h> |
| 9 #include <fcntl.h> | 9 #include <fcntl.h> |
| 10 #include <linux/net.h> | 10 #include <linux/net.h> |
| (...skipping 34 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 45 // https://android.googlesource.com/platform/bionic/+/lollipop-release/libc/priv
ate/bionic_prctl.h | 45 // https://android.googlesource.com/platform/bionic/+/lollipop-release/libc/priv
ate/bionic_prctl.h |
| 46 #if !defined(PR_SET_VMA) | 46 #if !defined(PR_SET_VMA) |
| 47 #define PR_SET_VMA 0x53564d41 | 47 #define PR_SET_VMA 0x53564d41 |
| 48 #endif | 48 #endif |
| 49 | 49 |
| 50 // https://android.googlesource.com/platform/system/core/+/lollipop-release/libc
utils/sched_policy.c | 50 // https://android.googlesource.com/platform/system/core/+/lollipop-release/libc
utils/sched_policy.c |
| 51 #if !defined(PR_SET_TIMERSLACK_PID) | 51 #if !defined(PR_SET_TIMERSLACK_PID) |
| 52 #define PR_SET_TIMERSLACK_PID 41 | 52 #define PR_SET_TIMERSLACK_PID 41 |
| 53 #endif | 53 #endif |
| 54 | 54 |
| 55 #ifndef PR_SET_PTRACER |
| 56 #define PR_SET_PTRACER 0x59616d61 |
| 57 #endif |
| 58 |
| 55 #endif // defined(OS_ANDROID) | 59 #endif // defined(OS_ANDROID) |
| 56 | 60 |
| 57 #if defined(__arm__) && !defined(MAP_STACK) | 61 #if defined(__arm__) && !defined(MAP_STACK) |
| 58 #define MAP_STACK 0x20000 // Daisy build environment has old headers. | 62 #define MAP_STACK 0x20000 // Daisy build environment has old headers. |
| 59 #endif | 63 #endif |
| 60 | 64 |
| 61 #if defined(__mips__) && !defined(MAP_STACK) | 65 #if defined(__mips__) && !defined(MAP_STACK) |
| 62 #define MAP_STACK 0x40000 | 66 #define MAP_STACK 0x40000 |
| 63 #endif | 67 #endif |
| 64 namespace { | 68 namespace { |
| (...skipping 71 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 136 } | 140 } |
| 137 | 141 |
| 138 ResultExpr RestrictPrctl() { | 142 ResultExpr RestrictPrctl() { |
| 139 // Will need to add seccomp compositing in the future. PR_SET_PTRACER is | 143 // Will need to add seccomp compositing in the future. PR_SET_PTRACER is |
| 140 // used by breakpad but not needed anymore. | 144 // used by breakpad but not needed anymore. |
| 141 const Arg<int> option(0); | 145 const Arg<int> option(0); |
| 142 return Switch(option) | 146 return Switch(option) |
| 143 .CASES((PR_GET_NAME, PR_SET_NAME, PR_GET_DUMPABLE, PR_SET_DUMPABLE | 147 .CASES((PR_GET_NAME, PR_SET_NAME, PR_GET_DUMPABLE, PR_SET_DUMPABLE |
| 144 #if defined(OS_ANDROID) | 148 #if defined(OS_ANDROID) |
| 145 , | 149 , |
| 146 PR_SET_VMA, PR_SET_TIMERSLACK_PID | 150 PR_SET_VMA, PR_SET_TIMERSLACK_PID, PR_SET_PTRACER |
| 147 #endif | 151 #endif |
| 148 ), | 152 ), |
| 149 Allow()) | 153 Allow()) |
| 150 .Default(CrashSIGSYSPrctl()); | 154 .Default(CrashSIGSYSPrctl()); |
| 151 } | 155 } |
| 152 | 156 |
| 153 ResultExpr RestrictIoctl() { | 157 ResultExpr RestrictIoctl() { |
| 154 const Arg<int> request(1); | 158 const Arg<int> request(1); |
| 155 return Switch(request).CASES((TCGETS, FIONREAD), Allow()).Default( | 159 return Switch(request).CASES((TCGETS, FIONREAD), Allow()).Default( |
| 156 CrashSIGSYSIoctl()); | 160 CrashSIGSYSIoctl()); |
| (...skipping 148 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 305 static_assert(4 == sizeof(clockid_t), "clockid_t is not 32bit"); | 309 static_assert(4 == sizeof(clockid_t), "clockid_t is not 32bit"); |
| 306 const Arg<clockid_t> clockid(0); | 310 const Arg<clockid_t> clockid(0); |
| 307 return Switch(clockid) | 311 return Switch(clockid) |
| 308 .CASES((CLOCK_MONOTONIC, CLOCK_MONOTONIC_COARSE, CLOCK_PROCESS_CPUTIME_ID, | 312 .CASES((CLOCK_MONOTONIC, CLOCK_MONOTONIC_COARSE, CLOCK_PROCESS_CPUTIME_ID, |
| 309 CLOCK_REALTIME, CLOCK_REALTIME_COARSE, CLOCK_THREAD_CPUTIME_ID), | 313 CLOCK_REALTIME, CLOCK_REALTIME_COARSE, CLOCK_THREAD_CPUTIME_ID), |
| 310 Allow()) | 314 Allow()) |
| 311 .Default(CrashSIGSYS()); | 315 .Default(CrashSIGSYS()); |
| 312 } | 316 } |
| 313 | 317 |
| 314 } // namespace sandbox. | 318 } // namespace sandbox. |
| OLD | NEW |