OLD | NEW |
1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "sandbox/linux/seccomp-bpf-helpers/baseline_policy.h" | 5 #include "sandbox/linux/seccomp-bpf-helpers/baseline_policy.h" |
6 | 6 |
7 #include <errno.h> | 7 #include <errno.h> |
8 #include <sys/mman.h> | 8 #include <sys/mman.h> |
9 #include <sys/socket.h> | 9 #include <sys/socket.h> |
10 #include <sys/syscall.h> | 10 #include <sys/syscall.h> |
(...skipping 14 matching lines...) Expand all Loading... |
25 | 25 |
26 namespace sandbox { | 26 namespace sandbox { |
27 | 27 |
28 namespace { | 28 namespace { |
29 | 29 |
30 bool IsBaselinePolicyAllowed(int sysno) { | 30 bool IsBaselinePolicyAllowed(int sysno) { |
31 return SyscallSets::IsAllowedAddressSpaceAccess(sysno) || | 31 return SyscallSets::IsAllowedAddressSpaceAccess(sysno) || |
32 SyscallSets::IsAllowedBasicScheduler(sysno) || | 32 SyscallSets::IsAllowedBasicScheduler(sysno) || |
33 SyscallSets::IsAllowedEpoll(sysno) || | 33 SyscallSets::IsAllowedEpoll(sysno) || |
34 SyscallSets::IsAllowedFileSystemAccessViaFd(sysno) || | 34 SyscallSets::IsAllowedFileSystemAccessViaFd(sysno) || |
| 35 SyscallSets::IsAllowedFutex(sysno) || |
35 SyscallSets::IsAllowedGeneralIo(sysno) || | 36 SyscallSets::IsAllowedGeneralIo(sysno) || |
36 SyscallSets::IsAllowedGetOrModifySocket(sysno) || | 37 SyscallSets::IsAllowedGetOrModifySocket(sysno) || |
37 SyscallSets::IsAllowedGettime(sysno) || | 38 SyscallSets::IsAllowedGettime(sysno) || |
38 SyscallSets::IsAllowedPrctl(sysno) || | 39 SyscallSets::IsAllowedPrctl(sysno) || |
39 SyscallSets::IsAllowedProcessStartOrDeath(sysno) || | 40 SyscallSets::IsAllowedProcessStartOrDeath(sysno) || |
40 SyscallSets::IsAllowedSignalHandling(sysno) || | 41 SyscallSets::IsAllowedSignalHandling(sysno) || |
41 SyscallSets::IsFutex(sysno) || | |
42 SyscallSets::IsGetSimpleId(sysno) || | 42 SyscallSets::IsGetSimpleId(sysno) || |
43 SyscallSets::IsKernelInternalApi(sysno) || | 43 SyscallSets::IsKernelInternalApi(sysno) || |
44 #if defined(__arm__) | 44 #if defined(__arm__) |
45 SyscallSets::IsArmPrivate(sysno) || | 45 SyscallSets::IsArmPrivate(sysno) || |
46 #endif | 46 #endif |
47 SyscallSets::IsAllowedOperationOnFd(sysno); | 47 SyscallSets::IsAllowedOperationOnFd(sysno); |
48 } | 48 } |
49 | 49 |
50 // System calls that will trigger the crashing SIGSYS handler. | 50 // System calls that will trigger the crashing SIGSYS handler. |
51 bool IsBaselinePolicyWatched(int sysno) { | 51 bool IsBaselinePolicyWatched(int sysno) { |
(...skipping 62 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
114 } | 114 } |
115 | 115 |
116 if (sysno == __NR_fcntl) | 116 if (sysno == __NR_fcntl) |
117 return RestrictFcntlCommands(sandbox); | 117 return RestrictFcntlCommands(sandbox); |
118 | 118 |
119 #if defined(__i386__) || defined(__arm__) | 119 #if defined(__i386__) || defined(__arm__) |
120 if (sysno == __NR_fcntl64) | 120 if (sysno == __NR_fcntl64) |
121 return RestrictFcntlCommands(sandbox); | 121 return RestrictFcntlCommands(sandbox); |
122 #endif | 122 #endif |
123 | 123 |
| 124 if (sysno == __NR_futex) |
| 125 return RestrictFutex(sandbox); |
| 126 |
124 if (sysno == __NR_madvise) { | 127 if (sysno == __NR_madvise) { |
125 // Only allow MADV_DONTNEED (aka MADV_FREE). | 128 // Only allow MADV_DONTNEED (aka MADV_FREE). |
126 return sandbox->Cond(2, ErrorCode::TP_32BIT, | 129 return sandbox->Cond(2, ErrorCode::TP_32BIT, |
127 ErrorCode::OP_EQUAL, MADV_DONTNEED, | 130 ErrorCode::OP_EQUAL, MADV_DONTNEED, |
128 ErrorCode(ErrorCode::ERR_ALLOWED), | 131 ErrorCode(ErrorCode::ERR_ALLOWED), |
129 ErrorCode(EPERM)); | 132 ErrorCode(EPERM)); |
130 } | 133 } |
131 | 134 |
132 #if defined(__i386__) || defined(__x86_64__) | 135 #if defined(__i386__) || defined(__x86_64__) |
133 if (sysno == __NR_mmap) | 136 if (sysno == __NR_mmap) |
(...skipping 72 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
206 ErrorCode BaselinePolicy::EvaluateSyscall(SandboxBPF* sandbox, | 209 ErrorCode BaselinePolicy::EvaluateSyscall(SandboxBPF* sandbox, |
207 int sysno) const { | 210 int sysno) const { |
208 // Make sure that this policy is used in the creating process. | 211 // Make sure that this policy is used in the creating process. |
209 if (1 == sysno) { | 212 if (1 == sysno) { |
210 DCHECK_EQ(syscall(__NR_getpid), current_pid_); | 213 DCHECK_EQ(syscall(__NR_getpid), current_pid_); |
211 } | 214 } |
212 return EvaluateSyscallImpl(fs_denied_errno_, current_pid_, sandbox, sysno); | 215 return EvaluateSyscallImpl(fs_denied_errno_, current_pid_, sandbox, sysno); |
213 } | 216 } |
214 | 217 |
215 } // namespace sandbox. | 218 } // namespace sandbox. |
OLD | NEW |