OLD | NEW |
1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #ifndef SANDBOX_LINUX_SECCOMP_BPF_HELPERS_SYSCALL_PARAMETERS_RESTRICTIONS_H_ | 5 #ifndef SANDBOX_LINUX_SECCOMP_BPF_HELPERS_SYSCALL_PARAMETERS_RESTRICTIONS_H_ |
6 #define SANDBOX_LINUX_SECCOMP_BPF_HELPERS_SYSCALL_PARAMETERS_RESTRICTIONS_H_ | 6 #define SANDBOX_LINUX_SECCOMP_BPF_HELPERS_SYSCALL_PARAMETERS_RESTRICTIONS_H_ |
7 | 7 |
8 #include <unistd.h> | 8 #include <unistd.h> |
9 | 9 |
10 #include "build/build_config.h" | 10 #include "build/build_config.h" |
(...skipping 44 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
55 // Restrict socketcall(2) to only allow socketpair(2), send(2), recv(2), | 55 // Restrict socketcall(2) to only allow socketpair(2), send(2), recv(2), |
56 // sendto(2), recvfrom(2), shutdown(2), sendmsg(2) and recvmsg(2). | 56 // sendto(2), recvfrom(2), shutdown(2), sendmsg(2) and recvmsg(2). |
57 SANDBOX_EXPORT ErrorCode RestrictSocketcallCommand(SandboxBPF* sandbox); | 57 SANDBOX_EXPORT ErrorCode RestrictSocketcallCommand(SandboxBPF* sandbox); |
58 #endif | 58 #endif |
59 | 59 |
60 // Restrict |sysno| (which must be kill, tkill or tgkill) by allowing tgkill or | 60 // Restrict |sysno| (which must be kill, tkill or tgkill) by allowing tgkill or |
61 // kill iff the first parameter is |target_pid|, crashing otherwise or if | 61 // kill iff the first parameter is |target_pid|, crashing otherwise or if |
62 // |sysno| is tkill. | 62 // |sysno| is tkill. |
63 ErrorCode RestrictKillTarget(pid_t target_pid, SandboxBPF* sandbox, int sysno); | 63 ErrorCode RestrictKillTarget(pid_t target_pid, SandboxBPF* sandbox, int sysno); |
64 | 64 |
| 65 // Crash if FUTEX_CMP_REQUEUE_PI is used in the second argument of futex(2). |
| 66 ErrorCode RestrictFutex(SandboxBPF* sandbox); |
| 67 |
65 } // namespace sandbox. | 68 } // namespace sandbox. |
66 | 69 |
67 #endif // SANDBOX_LINUX_SECCOMP_BPF_HELPERS_SYSCALL_PARAMETERS_RESTRICTIONS_H_ | 70 #endif // SANDBOX_LINUX_SECCOMP_BPF_HELPERS_SYSCALL_PARAMETERS_RESTRICTIONS_H_ |
OLD | NEW |