OLD | NEW |
1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.h" | 5 #include "sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.h" |
6 | 6 |
7 #include <errno.h> | 7 #include <errno.h> |
8 #include <fcntl.h> | 8 #include <fcntl.h> |
9 #include <fcntl.h> | 9 #include <fcntl.h> |
10 #include <linux/net.h> | 10 #include <linux/net.h> |
(...skipping 34 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
45 // https://android.googlesource.com/platform/bionic/+/lollipop-release/libc/priv
ate/bionic_prctl.h | 45 // https://android.googlesource.com/platform/bionic/+/lollipop-release/libc/priv
ate/bionic_prctl.h |
46 #if !defined(PR_SET_VMA) | 46 #if !defined(PR_SET_VMA) |
47 #define PR_SET_VMA 0x53564d41 | 47 #define PR_SET_VMA 0x53564d41 |
48 #endif | 48 #endif |
49 | 49 |
50 // https://android.googlesource.com/platform/system/core/+/lollipop-release/libc
utils/sched_policy.c | 50 // https://android.googlesource.com/platform/system/core/+/lollipop-release/libc
utils/sched_policy.c |
51 #if !defined(PR_SET_TIMERSLACK_PID) | 51 #if !defined(PR_SET_TIMERSLACK_PID) |
52 #define PR_SET_TIMERSLACK_PID 41 | 52 #define PR_SET_TIMERSLACK_PID 41 |
53 #endif | 53 #endif |
54 | 54 |
55 #ifndef PR_SET_PTRACER | |
56 #define PR_SET_PTRACER 0x59616d61 | |
57 #endif | |
58 | |
59 #endif // defined(OS_ANDROID) | 55 #endif // defined(OS_ANDROID) |
60 | 56 |
61 #if defined(__arm__) && !defined(MAP_STACK) | 57 #if defined(__arm__) && !defined(MAP_STACK) |
62 #define MAP_STACK 0x20000 // Daisy build environment has old headers. | 58 #define MAP_STACK 0x20000 // Daisy build environment has old headers. |
63 #endif | 59 #endif |
64 | 60 |
65 #if defined(__mips__) && !defined(MAP_STACK) | 61 #if defined(__mips__) && !defined(MAP_STACK) |
66 #define MAP_STACK 0x40000 | 62 #define MAP_STACK 0x40000 |
67 #endif | 63 #endif |
68 namespace { | 64 namespace { |
(...skipping 71 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
140 } | 136 } |
141 | 137 |
142 ResultExpr RestrictPrctl() { | 138 ResultExpr RestrictPrctl() { |
143 // Will need to add seccomp compositing in the future. PR_SET_PTRACER is | 139 // Will need to add seccomp compositing in the future. PR_SET_PTRACER is |
144 // used by breakpad but not needed anymore. | 140 // used by breakpad but not needed anymore. |
145 const Arg<int> option(0); | 141 const Arg<int> option(0); |
146 return Switch(option) | 142 return Switch(option) |
147 .CASES((PR_GET_NAME, PR_SET_NAME, PR_GET_DUMPABLE, PR_SET_DUMPABLE | 143 .CASES((PR_GET_NAME, PR_SET_NAME, PR_GET_DUMPABLE, PR_SET_DUMPABLE |
148 #if defined(OS_ANDROID) | 144 #if defined(OS_ANDROID) |
149 , | 145 , |
150 PR_SET_VMA, PR_SET_TIMERSLACK_PID, PR_SET_PTRACER | 146 PR_SET_VMA, PR_SET_TIMERSLACK_PID |
151 #endif | 147 #endif |
152 ), | 148 ), |
153 Allow()) | 149 Allow()) |
154 .Default(CrashSIGSYSPrctl()); | 150 .Default(CrashSIGSYSPrctl()); |
155 } | 151 } |
156 | 152 |
157 ResultExpr RestrictIoctl() { | 153 ResultExpr RestrictIoctl() { |
158 const Arg<int> request(1); | 154 const Arg<int> request(1); |
159 return Switch(request).CASES((TCGETS, FIONREAD), Allow()).Default( | 155 return Switch(request).CASES((TCGETS, FIONREAD), Allow()).Default( |
160 CrashSIGSYSIoctl()); | 156 CrashSIGSYSIoctl()); |
(...skipping 148 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
309 static_assert(4 == sizeof(clockid_t), "clockid_t is not 32bit"); | 305 static_assert(4 == sizeof(clockid_t), "clockid_t is not 32bit"); |
310 const Arg<clockid_t> clockid(0); | 306 const Arg<clockid_t> clockid(0); |
311 return Switch(clockid) | 307 return Switch(clockid) |
312 .CASES((CLOCK_MONOTONIC, CLOCK_MONOTONIC_COARSE, CLOCK_PROCESS_CPUTIME_ID, | 308 .CASES((CLOCK_MONOTONIC, CLOCK_MONOTONIC_COARSE, CLOCK_PROCESS_CPUTIME_ID, |
313 CLOCK_REALTIME, CLOCK_REALTIME_COARSE, CLOCK_THREAD_CPUTIME_ID), | 309 CLOCK_REALTIME, CLOCK_REALTIME_COARSE, CLOCK_THREAD_CPUTIME_ID), |
314 Allow()) | 310 Allow()) |
315 .Default(CrashSIGSYS()); | 311 .Default(CrashSIGSYS()); |
316 } | 312 } |
317 | 313 |
318 } // namespace sandbox. | 314 } // namespace sandbox. |
OLD | NEW |