OLD | NEW |
---|---|
1 // Copyright 2014 The Chromium Authors. All rights reserved. | 1 // Copyright 2014 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "components/nacl/loader/nonsfi/nonsfi_sandbox.h" | 5 #include "components/nacl/loader/nonsfi/nonsfi_sandbox.h" |
6 | 6 |
7 #include <errno.h> | 7 #include <errno.h> |
8 #include <fcntl.h> | 8 #include <fcntl.h> |
9 #include <linux/net.h> | 9 #include <linux/net.h> |
10 #include <sys/prctl.h> | 10 #include <sys/prctl.h> |
(...skipping 10 matching lines...) Expand all Loading... | |
21 #include "sandbox/linux/bpf_dsl/bpf_dsl.h" | 21 #include "sandbox/linux/bpf_dsl/bpf_dsl.h" |
22 #include "sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.h" | 22 #include "sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.h" |
23 #include "sandbox/linux/seccomp-bpf/sandbox_bpf_policy.h" | 23 #include "sandbox/linux/seccomp-bpf/sandbox_bpf_policy.h" |
24 #include "sandbox/linux/services/linux_syscalls.h" | 24 #include "sandbox/linux/services/linux_syscalls.h" |
25 | 25 |
26 #if defined(__arm__) && !defined(MAP_STACK) | 26 #if defined(__arm__) && !defined(MAP_STACK) |
27 // Chrome OS Daisy (ARM) build environment has old headers. | 27 // Chrome OS Daisy (ARM) build environment has old headers. |
28 #define MAP_STACK 0x20000 | 28 #define MAP_STACK 0x20000 |
29 #endif | 29 #endif |
30 | 30 |
31 using namespace sandbox::bpf_dsl; | |
32 using sandbox::CrashSIGSYS; | 31 using sandbox::CrashSIGSYS; |
33 using sandbox::CrashSIGSYSClone; | 32 using sandbox::CrashSIGSYSClone; |
34 using sandbox::CrashSIGSYSPrctl; | 33 using sandbox::CrashSIGSYSPrctl; |
34 using sandbox::bpf_dsl::Allow; | |
35 using sandbox::bpf_dsl::Arg; | |
36 using sandbox::bpf_dsl::Error; | |
37 using sandbox::bpf_dsl::If; | |
38 using sandbox::bpf_dsl::ResultExpr; | |
39 | |
40 // TODO(mdempsky): Make BoolExpr a standalone class so these operators can | |
41 // be resolved via argument-dependant lookup. | |
Mark Seaborn
2014/08/04 19:44:58
"dependent"
mdempsky
2014/08/04 20:01:56
Done.
| |
42 using sandbox::bpf_dsl::operator&&; | |
43 using sandbox::bpf_dsl::operator||; | |
35 | 44 |
36 namespace nacl { | 45 namespace nacl { |
37 namespace nonsfi { | 46 namespace nonsfi { |
38 namespace { | 47 namespace { |
39 | 48 |
40 ResultExpr RestrictFcntlCommands() { | 49 ResultExpr RestrictFcntlCommands() { |
41 const Arg<int> cmd(1); | 50 const Arg<int> cmd(1); |
42 const Arg<long> long_arg(2); | 51 const Arg<long> long_arg(2); |
43 | 52 |
44 // We allow following cases: | 53 // We allow following cases: |
(...skipping 251 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
296 scoped_ptr<sandbox::SandboxBPFPolicy>( | 305 scoped_ptr<sandbox::SandboxBPFPolicy>( |
297 new nacl::nonsfi::NaClNonSfiBPFSandboxPolicy())); | 306 new nacl::nonsfi::NaClNonSfiBPFSandboxPolicy())); |
298 if (!sandbox_is_initialized) | 307 if (!sandbox_is_initialized) |
299 return false; | 308 return false; |
300 RunSandboxSanityChecks(); | 309 RunSandboxSanityChecks(); |
301 return true; | 310 return true; |
302 } | 311 } |
303 | 312 |
304 } // namespace nonsfi | 313 } // namespace nonsfi |
305 } // namespace nacl | 314 } // namespace nacl |
OLD | NEW |