Index: content/common/sandbox_linux/android/sandbox_bpf_base_policy_android.cc |
diff --git a/content/common/sandbox_linux/android/sandbox_bpf_base_policy_android.cc b/content/common/sandbox_linux/android/sandbox_bpf_base_policy_android.cc |
index 7074a2d44f9cc5841cd5b325e8477466613a3f14..c3b1605fc7dc6f091ae5456aad0371bcf2ee7c1a 100644 |
--- a/content/common/sandbox_linux/android/sandbox_bpf_base_policy_android.cc |
+++ b/content/common/sandbox_linux/android/sandbox_bpf_base_policy_android.cc |
@@ -4,32 +4,16 @@ |
#include "content/common/sandbox_linux/android/sandbox_bpf_base_policy_android.h" |
-#include <errno.h> |
-#include <fcntl.h> |
-#include <sys/socket.h> |
#include <sys/syscall.h> |
#include <sys/types.h> |
#include "build/build_config.h" |
#include "sandbox/linux/bpf_dsl/bpf_dsl.h" |
-using sandbox::bpf_dsl::AllOf; |
using sandbox::bpf_dsl::Allow; |
-using sandbox::bpf_dsl::AnyOf; |
-using sandbox::bpf_dsl::Arg; |
-using sandbox::bpf_dsl::If; |
-using sandbox::bpf_dsl::Error; |
using sandbox::bpf_dsl::ResultExpr; |
namespace content { |
- |
-#ifndef SOCK_CLOEXEC |
-#define SOCK_CLOEXEC O_CLOEXEC |
-#endif |
- |
-#ifndef SOCK_NONBLOCK |
-#define SOCK_NONBLOCK O_NONBLOCK |
-#endif |
SandboxBPFBasePolicyAndroid::SandboxBPFBasePolicyAndroid() |
: SandboxBPFBasePolicy() {} |
@@ -46,10 +30,8 @@ |
case __NR_flock: |
#if defined(__x86_64__) || defined(__aarch64__) |
case __NR_newfstatat: |
- case __NR_getdents64: |
#elif defined(__i386__) || defined(__arm__) || defined(__mips__) |
case __NR_fstatat64: |
- case __NR_getdents: |
#endif |
case __NR_getpriority: |
case __NR_ioctl: |
@@ -74,30 +56,8 @@ |
case __NR_getrlimit: |
#endif |
case __NR_uname: |
- |
- // Permit socket operations so that renderers can connect to logd and |
- // debuggerd. The arguments to socket() are further restricted below. |
- case __NR_socket: |
- case __NR_connect: |
- |
- // Ptrace is allowed so the Breakpad Microdumper can fork in a renderer |
- // and then ptrace the parent. |
- case __NR_ptrace: |
override_and_allow = true; |
break; |
- } |
- |
- if (sysno == __NR_socket) { |
- const Arg<int> domain(0); |
- const Arg<int> type(1); |
- const Arg<int> protocol(2); |
- const int kSockFlags = SOCK_CLOEXEC | SOCK_NONBLOCK; |
- return If(AllOf(domain == AF_UNIX, |
- AnyOf((type & ~kSockFlags) == SOCK_DGRAM, |
- (type & ~kSockFlags) == SOCK_STREAM), |
- protocol == 0), |
- Allow()) |
- .Else(Error(EPERM)); |
} |
if (override_and_allow) |