| OLD | NEW |
| 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.h" | 5 #include "sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.h" |
| 6 | 6 |
| 7 #include <errno.h> | 7 #include <errno.h> |
| 8 #include <fcntl.h> | 8 #include <fcntl.h> |
| 9 #include <fcntl.h> | 9 #include <fcntl.h> |
| 10 #include <linux/net.h> | 10 #include <linux/net.h> |
| (...skipping 34 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 45 // https://android.googlesource.com/platform/bionic/+/lollipop-release/libc/priv
ate/bionic_prctl.h | 45 // https://android.googlesource.com/platform/bionic/+/lollipop-release/libc/priv
ate/bionic_prctl.h |
| 46 #if !defined(PR_SET_VMA) | 46 #if !defined(PR_SET_VMA) |
| 47 #define PR_SET_VMA 0x53564d41 | 47 #define PR_SET_VMA 0x53564d41 |
| 48 #endif | 48 #endif |
| 49 | 49 |
| 50 // https://android.googlesource.com/platform/system/core/+/lollipop-release/libc
utils/sched_policy.c | 50 // https://android.googlesource.com/platform/system/core/+/lollipop-release/libc
utils/sched_policy.c |
| 51 #if !defined(PR_SET_TIMERSLACK_PID) | 51 #if !defined(PR_SET_TIMERSLACK_PID) |
| 52 #define PR_SET_TIMERSLACK_PID 41 | 52 #define PR_SET_TIMERSLACK_PID 41 |
| 53 #endif | 53 #endif |
| 54 | 54 |
| 55 #ifndef PR_SET_PTRACER | |
| 56 #define PR_SET_PTRACER 0x59616d61 | |
| 57 #endif | |
| 58 | |
| 59 #endif // defined(OS_ANDROID) | 55 #endif // defined(OS_ANDROID) |
| 60 | 56 |
| 61 #if defined(__arm__) && !defined(MAP_STACK) | 57 #if defined(__arm__) && !defined(MAP_STACK) |
| 62 #define MAP_STACK 0x20000 // Daisy build environment has old headers. | 58 #define MAP_STACK 0x20000 // Daisy build environment has old headers. |
| 63 #endif | 59 #endif |
| 64 | 60 |
| 65 #if defined(__mips__) && !defined(MAP_STACK) | 61 #if defined(__mips__) && !defined(MAP_STACK) |
| 66 #define MAP_STACK 0x40000 | 62 #define MAP_STACK 0x40000 |
| 67 #endif | 63 #endif |
| 68 namespace { | 64 namespace { |
| (...skipping 71 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 140 } | 136 } |
| 141 | 137 |
| 142 ResultExpr RestrictPrctl() { | 138 ResultExpr RestrictPrctl() { |
| 143 // Will need to add seccomp compositing in the future. PR_SET_PTRACER is | 139 // Will need to add seccomp compositing in the future. PR_SET_PTRACER is |
| 144 // used by breakpad but not needed anymore. | 140 // used by breakpad but not needed anymore. |
| 145 const Arg<int> option(0); | 141 const Arg<int> option(0); |
| 146 return Switch(option) | 142 return Switch(option) |
| 147 .CASES((PR_GET_NAME, PR_SET_NAME, PR_GET_DUMPABLE, PR_SET_DUMPABLE | 143 .CASES((PR_GET_NAME, PR_SET_NAME, PR_GET_DUMPABLE, PR_SET_DUMPABLE |
| 148 #if defined(OS_ANDROID) | 144 #if defined(OS_ANDROID) |
| 149 , | 145 , |
| 150 PR_SET_VMA, PR_SET_TIMERSLACK_PID, PR_SET_PTRACER | 146 PR_SET_VMA, PR_SET_TIMERSLACK_PID |
| 151 #endif | 147 #endif |
| 152 ), | 148 ), |
| 153 Allow()) | 149 Allow()) |
| 154 .Default(CrashSIGSYSPrctl()); | 150 .Default(CrashSIGSYSPrctl()); |
| 155 } | 151 } |
| 156 | 152 |
| 157 ResultExpr RestrictIoctl() { | 153 ResultExpr RestrictIoctl() { |
| 158 const Arg<int> request(1); | 154 const Arg<int> request(1); |
| 159 return Switch(request).CASES((TCGETS, FIONREAD), Allow()).Default( | 155 return Switch(request).CASES((TCGETS, FIONREAD), Allow()).Default( |
| 160 CrashSIGSYSIoctl()); | 156 CrashSIGSYSIoctl()); |
| (...skipping 148 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 309 static_assert(4 == sizeof(clockid_t), "clockid_t is not 32bit"); | 305 static_assert(4 == sizeof(clockid_t), "clockid_t is not 32bit"); |
| 310 const Arg<clockid_t> clockid(0); | 306 const Arg<clockid_t> clockid(0); |
| 311 return Switch(clockid) | 307 return Switch(clockid) |
| 312 .CASES((CLOCK_MONOTONIC, CLOCK_MONOTONIC_COARSE, CLOCK_PROCESS_CPUTIME_ID, | 308 .CASES((CLOCK_MONOTONIC, CLOCK_MONOTONIC_COARSE, CLOCK_PROCESS_CPUTIME_ID, |
| 313 CLOCK_REALTIME, CLOCK_REALTIME_COARSE, CLOCK_THREAD_CPUTIME_ID), | 309 CLOCK_REALTIME, CLOCK_REALTIME_COARSE, CLOCK_THREAD_CPUTIME_ID), |
| 314 Allow()) | 310 Allow()) |
| 315 .Default(CrashSIGSYS()); | 311 .Default(CrashSIGSYS()); |
| 316 } | 312 } |
| 317 | 313 |
| 318 } // namespace sandbox. | 314 } // namespace sandbox. |
| OLD | NEW |