| OLD | NEW |
| 1 // Copyright 2014 The Chromium Authors. All rights reserved. | 1 // Copyright 2014 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "content/common/sandbox_linux/android/sandbox_bpf_base_policy_android.h
" | 5 #include "content/common/sandbox_linux/android/sandbox_bpf_base_policy_android.h
" |
| 6 | 6 |
| 7 #include <errno.h> | 7 #include <errno.h> |
| 8 #include <fcntl.h> | 8 #include <fcntl.h> |
| 9 #include <linux/net.h> | 9 #include <linux/net.h> |
| 10 #include <sys/socket.h> | 10 #include <sys/socket.h> |
| (...skipping 22 matching lines...) Expand all Loading... |
| 33 #ifndef SOCK_CLOEXEC | 33 #ifndef SOCK_CLOEXEC |
| 34 #define SOCK_CLOEXEC O_CLOEXEC | 34 #define SOCK_CLOEXEC O_CLOEXEC |
| 35 #endif | 35 #endif |
| 36 | 36 |
| 37 #ifndef SOCK_NONBLOCK | 37 #ifndef SOCK_NONBLOCK |
| 38 #define SOCK_NONBLOCK O_NONBLOCK | 38 #define SOCK_NONBLOCK O_NONBLOCK |
| 39 #endif | 39 #endif |
| 40 | 40 |
| 41 namespace { | 41 namespace { |
| 42 | 42 |
| 43 #if !defined(__i386__) |
| 43 // Restricts the arguments to sys_socket() to AF_UNIX. Returns a BoolExpr that | 44 // Restricts the arguments to sys_socket() to AF_UNIX. Returns a BoolExpr that |
| 44 // evaluates to true if the syscall should be allowed. | 45 // evaluates to true if the syscall should be allowed. |
| 45 BoolExpr RestrictSocketArguments(const Arg<int>& domain, | 46 BoolExpr RestrictSocketArguments(const Arg<int>& domain, |
| 46 const Arg<int>& type, | 47 const Arg<int>& type, |
| 47 const Arg<int>& protocol) { | 48 const Arg<int>& protocol) { |
| 48 const int kSockFlags = SOCK_CLOEXEC | SOCK_NONBLOCK; | 49 const int kSockFlags = SOCK_CLOEXEC | SOCK_NONBLOCK; |
| 49 return AllOf(domain == AF_UNIX, | 50 return AllOf(domain == AF_UNIX, |
| 50 AnyOf((type & ~kSockFlags) == SOCK_DGRAM, | 51 AnyOf((type & ~kSockFlags) == SOCK_DGRAM, |
| 51 (type & ~kSockFlags) == SOCK_STREAM), | 52 (type & ~kSockFlags) == SOCK_STREAM), |
| 52 protocol == 0); | 53 protocol == 0); |
| 53 } | 54 } |
| 55 #endif // !defined(__i386__) |
| 54 | 56 |
| 55 } // namespace | 57 } // namespace |
| 56 | 58 |
| 57 SandboxBPFBasePolicyAndroid::SandboxBPFBasePolicyAndroid() | 59 SandboxBPFBasePolicyAndroid::SandboxBPFBasePolicyAndroid() |
| 58 : SandboxBPFBasePolicy(), | 60 : SandboxBPFBasePolicy(), |
| 59 pid_(getpid()) {} | 61 pid_(getpid()) {} |
| 60 | 62 |
| 61 SandboxBPFBasePolicyAndroid::~SandboxBPFBasePolicyAndroid() {} | 63 SandboxBPFBasePolicyAndroid::~SandboxBPFBasePolicyAndroid() {} |
| 62 | 64 |
| 63 ResultExpr SandboxBPFBasePolicyAndroid::EvaluateSyscall(int sysno) const { | 65 ResultExpr SandboxBPFBasePolicyAndroid::EvaluateSyscall(int sysno) const { |
| (...skipping 124 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 188 } | 190 } |
| 189 #endif | 191 #endif |
| 190 | 192 |
| 191 if (override_and_allow) | 193 if (override_and_allow) |
| 192 return Allow(); | 194 return Allow(); |
| 193 | 195 |
| 194 return SandboxBPFBasePolicy::EvaluateSyscall(sysno); | 196 return SandboxBPFBasePolicy::EvaluateSyscall(sysno); |
| 195 } | 197 } |
| 196 | 198 |
| 197 } // namespace content | 199 } // namespace content |
| OLD | NEW |