Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(486)

Side by Side Diff: content/common/sandbox_linux/sandbox_bpf_base_policy_linux.h

Issue 299683004: Rewrite all BPF policies to use DSL API Base URL: svn://svn.chromium.org/chrome/trunk/src
Patch Set: Overhaul of DSL and implementation Created 6 years, 7 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch | Annotate | Revision Log
OLDNEW
1 // Copyright 2013 The Chromium Authors. All rights reserved. 1 // Copyright 2013 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be 2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file. 3 // found in the LICENSE file.
4 4
5 #ifndef CONTENT_COMMON_SANDBOX_LINUX_SANDBOX_BPF_BASE_POLICY_LINUX_H_ 5 #ifndef CONTENT_COMMON_SANDBOX_LINUX_SANDBOX_BPF_BASE_POLICY_LINUX_H_
6 #define CONTENT_COMMON_SANDBOX_LINUX_SANDBOX_BPF_BASE_POLICY_LINUX_H_ 6 #define CONTENT_COMMON_SANDBOX_LINUX_SANDBOX_BPF_BASE_POLICY_LINUX_H_
7 7
8 #include "base/basictypes.h" 8 #include "base/basictypes.h"
9 #include "base/memory/scoped_ptr.h" 9 #include "base/memory/scoped_ptr.h"
10 #include "sandbox/linux/seccomp-bpf-helpers/baseline_policy.h" 10 #include "sandbox/linux/seccomp-bpf-helpers/baseline_policy.h"
11 #include "sandbox/linux/seccomp-bpf/sandbox_bpf_policy.h" 11 #include "sandbox/linux/seccomp-bpf/sandbox_bpf_policy.h"
12 12
13 using sandbox::ErrorCode; 13 using sandbox::ErrorCode;
14 using sandbox::SandboxBPF; 14 using sandbox::SandboxBPF;
15 15
16 namespace content { 16 namespace content {
17 17
18 // The "baseline" BPF policy for content/. Any content/ seccomp-bpf policy 18 // The "baseline" BPF policy for content/. Any content/ seccomp-bpf policy
19 // should inherit from it. 19 // should inherit from it.
20 // It implements the main SandboxBPFPolicy interface. Due to its nature 20 // It implements the main SandboxBPFPolicy interface. Due to its nature
21 // as a "kernel attack surface reduction" layer, it's implementation-defined. 21 // as a "kernel attack surface reduction" layer, it's implementation-defined.
22 class SandboxBPFBasePolicy : public sandbox::SandboxBPFPolicy { 22 class SandboxBPFBasePolicy : public sandbox::bpf_dsl::SandboxBPFPolicyDSL {
23 public: 23 public:
24 SandboxBPFBasePolicy(); 24 SandboxBPFBasePolicy();
25 virtual ~SandboxBPFBasePolicy(); 25 virtual ~SandboxBPFBasePolicy();
26 26
27 virtual ErrorCode EvaluateSyscall(SandboxBPF* sandbox_compiler, 27 using sandbox::bpf_dsl::SandboxBPFPolicyDSL::EvaluateSyscall;
28 int system_call_number) const OVERRIDE; 28 virtual sandbox::bpf_dsl::ResultExpr EvaluateSyscall(
29 int system_call_number) const OVERRIDE;
29 30
30 // A policy can implement this hook to run code right before the policy 31 // A policy can implement this hook to run code right before the policy
31 // is passed to the SandboxBPF class and the sandbox is engaged. 32 // is passed to the SandboxBPF class and the sandbox is engaged.
32 // If PreSandboxHook() returns true, the sandbox is guaranteed to be 33 // If PreSandboxHook() returns true, the sandbox is guaranteed to be
33 // engaged afterwards. 34 // engaged afterwards.
34 // This will be used when enabling the sandbox though 35 // This will be used when enabling the sandbox though
35 // SandboxSeccompBPF::StartSandbox(). 36 // SandboxSeccompBPF::StartSandbox().
36 virtual bool PreSandboxHook(); 37 virtual bool PreSandboxHook();
37 38
38 // Get the errno(3) to return for filesystem errors. 39 // Get the errno(3) to return for filesystem errors.
39 static int GetFSDeniedErrno(); 40 static int GetFSDeniedErrno();
40 41
41 private: 42 private:
42 // Compose the BaselinePolicy from sandbox/. 43 // Compose the BaselinePolicy from sandbox/.
43 scoped_ptr<sandbox::BaselinePolicy> baseline_policy_; 44 scoped_ptr<sandbox::BaselinePolicy> baseline_policy_;
44 DISALLOW_COPY_AND_ASSIGN(SandboxBPFBasePolicy); 45 DISALLOW_COPY_AND_ASSIGN(SandboxBPFBasePolicy);
45 }; 46 };
46 47
47 } // namespace content 48 } // namespace content
48 49
49 #endif // CONTENT_COMMON_SANDBOX_LINUX_SANDBOX_BPF_BASE_POLICY_LINUX_H_ 50 #endif // CONTENT_COMMON_SANDBOX_LINUX_SANDBOX_BPF_BASE_POLICY_LINUX_H_
OLDNEW

Powered by Google App Engine
This is Rietveld 408576698