OLD | NEW |
1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "sandbox/linux/seccomp-bpf-helpers/baseline_policy.h" | 5 #include "sandbox/linux/seccomp-bpf-helpers/baseline_policy.h" |
6 | 6 |
7 #include <errno.h> | 7 #include <errno.h> |
8 #include <sys/mman.h> | 8 #include <sys/mman.h> |
9 #include <sys/socket.h> | 9 #include <sys/socket.h> |
10 #include <sys/syscall.h> | 10 #include <sys/syscall.h> |
(...skipping 14 matching lines...) Expand all Loading... |
25 | 25 |
26 namespace sandbox { | 26 namespace sandbox { |
27 | 27 |
28 namespace { | 28 namespace { |
29 | 29 |
30 bool IsBaselinePolicyAllowed(int sysno) { | 30 bool IsBaselinePolicyAllowed(int sysno) { |
31 return SyscallSets::IsAllowedAddressSpaceAccess(sysno) || | 31 return SyscallSets::IsAllowedAddressSpaceAccess(sysno) || |
32 SyscallSets::IsAllowedBasicScheduler(sysno) || | 32 SyscallSets::IsAllowedBasicScheduler(sysno) || |
33 SyscallSets::IsAllowedEpoll(sysno) || | 33 SyscallSets::IsAllowedEpoll(sysno) || |
34 SyscallSets::IsAllowedFileSystemAccessViaFd(sysno) || | 34 SyscallSets::IsAllowedFileSystemAccessViaFd(sysno) || |
| 35 SyscallSets::IsAllowedFutex(sysno) || |
35 SyscallSets::IsAllowedGeneralIo(sysno) || | 36 SyscallSets::IsAllowedGeneralIo(sysno) || |
36 SyscallSets::IsAllowedGetOrModifySocket(sysno) || | 37 SyscallSets::IsAllowedGetOrModifySocket(sysno) || |
37 SyscallSets::IsAllowedGettime(sysno) || | 38 SyscallSets::IsAllowedGettime(sysno) || |
38 SyscallSets::IsAllowedPrctl(sysno) || | 39 SyscallSets::IsAllowedPrctl(sysno) || |
39 SyscallSets::IsAllowedProcessStartOrDeath(sysno) || | 40 SyscallSets::IsAllowedProcessStartOrDeath(sysno) || |
40 SyscallSets::IsAllowedSignalHandling(sysno) || | 41 SyscallSets::IsAllowedSignalHandling(sysno) || |
41 SyscallSets::IsFutex(sysno) || | |
42 SyscallSets::IsGetSimpleId(sysno) || | 42 SyscallSets::IsGetSimpleId(sysno) || |
43 SyscallSets::IsKernelInternalApi(sysno) || | 43 SyscallSets::IsKernelInternalApi(sysno) || |
44 #if defined(__arm__) | 44 #if defined(__arm__) |
45 SyscallSets::IsArmPrivate(sysno) || | 45 SyscallSets::IsArmPrivate(sysno) || |
46 #endif | 46 #endif |
47 SyscallSets::IsAllowedOperationOnFd(sysno); | 47 SyscallSets::IsAllowedOperationOnFd(sysno); |
48 } | 48 } |
49 | 49 |
50 // System calls that will trigger the crashing SIGSYS handler. | 50 // System calls that will trigger the crashing SIGSYS handler. |
51 bool IsBaselinePolicyWatched(int sysno) { | 51 bool IsBaselinePolicyWatched(int sysno) { |
(...skipping 52 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
104 #if defined(__x86_64__) || defined(__arm__) | 104 #if defined(__x86_64__) || defined(__arm__) |
105 if (sysno == __NR_socketpair) { | 105 if (sysno == __NR_socketpair) { |
106 // Only allow AF_UNIX, PF_UNIX. Crash if anything else is seen. | 106 // Only allow AF_UNIX, PF_UNIX. Crash if anything else is seen. |
107 COMPILE_ASSERT(AF_UNIX == PF_UNIX, af_unix_pf_unix_different); | 107 COMPILE_ASSERT(AF_UNIX == PF_UNIX, af_unix_pf_unix_different); |
108 return sandbox->Cond(0, ErrorCode::TP_32BIT, ErrorCode::OP_EQUAL, AF_UNIX, | 108 return sandbox->Cond(0, ErrorCode::TP_32BIT, ErrorCode::OP_EQUAL, AF_UNIX, |
109 ErrorCode(ErrorCode::ERR_ALLOWED), | 109 ErrorCode(ErrorCode::ERR_ALLOWED), |
110 sandbox->Trap(CrashSIGSYS_Handler, NULL)); | 110 sandbox->Trap(CrashSIGSYS_Handler, NULL)); |
111 } | 111 } |
112 #endif | 112 #endif |
113 | 113 |
| 114 if (sysno == __NR_futex) |
| 115 return RestrictFutex(sandbox); |
| 116 |
114 if (sysno == __NR_madvise) { | 117 if (sysno == __NR_madvise) { |
115 // Only allow MADV_DONTNEED (aka MADV_FREE). | 118 // Only allow MADV_DONTNEED (aka MADV_FREE). |
116 return sandbox->Cond(2, ErrorCode::TP_32BIT, | 119 return sandbox->Cond(2, ErrorCode::TP_32BIT, |
117 ErrorCode::OP_EQUAL, MADV_DONTNEED, | 120 ErrorCode::OP_EQUAL, MADV_DONTNEED, |
118 ErrorCode(ErrorCode::ERR_ALLOWED), | 121 ErrorCode(ErrorCode::ERR_ALLOWED), |
119 ErrorCode(EPERM)); | 122 ErrorCode(EPERM)); |
120 } | 123 } |
121 | 124 |
122 #if defined(__i386__) || defined(__x86_64__) | 125 #if defined(__i386__) || defined(__x86_64__) |
123 if (sysno == __NR_mmap) | 126 if (sysno == __NR_mmap) |
(...skipping 70 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
194 ErrorCode BaselinePolicy::EvaluateSyscall(SandboxBPF* sandbox, | 197 ErrorCode BaselinePolicy::EvaluateSyscall(SandboxBPF* sandbox, |
195 int sysno) const { | 198 int sysno) const { |
196 // Make sure that this policy is used in the creating process. | 199 // Make sure that this policy is used in the creating process. |
197 if (1 == sysno) { | 200 if (1 == sysno) { |
198 DCHECK_EQ(syscall(__NR_getpid), current_pid_); | 201 DCHECK_EQ(syscall(__NR_getpid), current_pid_); |
199 } | 202 } |
200 return EvaluateSyscallImpl(fs_denied_errno_, current_pid_, sandbox, sysno); | 203 return EvaluateSyscallImpl(fs_denied_errno_, current_pid_, sandbox, sysno); |
201 } | 204 } |
202 | 205 |
203 } // namespace sandbox. | 206 } // namespace sandbox. |
OLD | NEW |