OLD | NEW |
1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #ifndef SANDBOX_LINUX_SECCOMP_BPF_HELPERS_SYSCALL_PARAMETERS_RESTRICTIONS_H_ | 5 #ifndef SANDBOX_LINUX_SECCOMP_BPF_HELPERS_SYSCALL_PARAMETERS_RESTRICTIONS_H_ |
6 #define SANDBOX_LINUX_SECCOMP_BPF_HELPERS_SYSCALL_PARAMETERS_RESTRICTIONS_H_ | 6 #define SANDBOX_LINUX_SECCOMP_BPF_HELPERS_SYSCALL_PARAMETERS_RESTRICTIONS_H_ |
7 | 7 |
8 #include <unistd.h> | 8 #include <unistd.h> |
9 | 9 |
10 #include "build/build_config.h" | 10 #include "build/build_config.h" |
11 #include "sandbox/linux/sandbox_export.h" | 11 #include "sandbox/sandbox_export.h" |
12 | 12 |
13 // These are helpers to build seccomp-bpf policies, i.e. policies for a | 13 // These are helpers to build seccomp-bpf policies, i.e. policies for a |
14 // sandbox that reduces the Linux kernel's attack surface. They return an | 14 // sandbox that reduces the Linux kernel's attack surface. They return an |
15 // SANDBOX_EXPORT ErrorCode suitable to restrict certain system call parameters. | 15 // SANDBOX_EXPORT ErrorCode suitable to restrict certain system call parameters. |
16 | 16 |
17 namespace sandbox { | 17 namespace sandbox { |
18 | 18 |
19 class ErrorCode; | 19 class ErrorCode; |
20 class SandboxBPF; | 20 class SandboxBPF; |
21 | 21 |
(...skipping 36 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
58 #endif | 58 #endif |
59 | 59 |
60 // Restrict |sysno| (which must be kill, tkill or tgkill) by allowing tgkill or | 60 // Restrict |sysno| (which must be kill, tkill or tgkill) by allowing tgkill or |
61 // kill iff the first parameter is |target_pid|, crashing otherwise or if | 61 // kill iff the first parameter is |target_pid|, crashing otherwise or if |
62 // |sysno| is tkill. | 62 // |sysno| is tkill. |
63 ErrorCode RestrictKillTarget(pid_t target_pid, SandboxBPF* sandbox, int sysno); | 63 ErrorCode RestrictKillTarget(pid_t target_pid, SandboxBPF* sandbox, int sysno); |
64 | 64 |
65 } // namespace sandbox. | 65 } // namespace sandbox. |
66 | 66 |
67 #endif // SANDBOX_LINUX_SECCOMP_BPF_HELPERS_SYSCALL_PARAMETERS_RESTRICTIONS_H_ | 67 #endif // SANDBOX_LINUX_SECCOMP_BPF_HELPERS_SYSCALL_PARAMETERS_RESTRICTIONS_H_ |
OLD | NEW |