OLD | NEW |
| (Empty) |
1 // Copyright 2014 The Chromium Authors. All rights reserved. | |
2 // Use of this source code is governed by a BSD-style license that can be | |
3 // found in the LICENSE file. | |
4 | |
5 #ifndef COMPONENTS_NACL_LOADER_NONSFI_NONSFI_SANDBOX_H_ | |
6 #define COMPONENTS_NACL_LOADER_NONSFI_NONSFI_SANDBOX_H_ | |
7 | |
8 #include "base/basictypes.h" | |
9 #include "sandbox/linux/seccomp-bpf/sandbox_bpf_policy.h" | |
10 | |
11 namespace nacl { | |
12 namespace nonsfi { | |
13 | |
14 // The seccomp sandbox policy for NaCl non-SFI mode. Note that this | |
15 // policy must be as strong as possible, as non-SFI mode heavily | |
16 // depends on seccomp sandbox. | |
17 class NaClNonSfiBPFSandboxPolicy : public sandbox::SandboxBPFPolicy { | |
18 public: | |
19 explicit NaClNonSfiBPFSandboxPolicy() {} | |
20 virtual ~NaClNonSfiBPFSandboxPolicy() {} | |
21 | |
22 virtual sandbox::ErrorCode EvaluateSyscall(sandbox::SandboxBPF* sb, | |
23 int sysno) const OVERRIDE; | |
24 | |
25 static sandbox::ErrorCode EvaluateSyscallImpl(sandbox::SandboxBPF* sb, | |
26 int sysno, void*); | |
27 | |
28 private: | |
29 DISALLOW_COPY_AND_ASSIGN(NaClNonSfiBPFSandboxPolicy); | |
30 }; | |
31 | |
32 // Initializes seccomp-bpf sandbox for non-SFI NaCl. Returns false on | |
33 // failure. | |
34 bool InitializeBPFSandbox(); | |
35 | |
36 } // namespace nonsfi | |
37 } // namespace nacl | |
38 | |
39 #endif // COMPONENTS_NACL_LOADER_NONSFI_NONSFI_SANDBOX_H_ | |
OLD | NEW |