Chromium Code Reviews| OLD | NEW |
|---|---|
| 1 // Copyright 2014 The Chromium Authors. All rights reserved. | 1 // Copyright 2014 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "components/nacl/loader/nonsfi/nonsfi_sandbox.h" | 5 #include "components/nacl/loader/nonsfi/nonsfi_sandbox.h" |
| 6 | 6 |
| 7 #include <errno.h> | 7 #include <errno.h> |
| 8 #include <fcntl.h> | 8 #include <fcntl.h> |
| 9 #include <linux/net.h> | 9 #include <linux/net.h> |
| 10 #include <sys/prctl.h> | 10 #include <sys/prctl.h> |
| (...skipping 10 matching lines...) Expand all Loading... | |
| 21 #include "sandbox/linux/bpf_dsl/bpf_dsl.h" | 21 #include "sandbox/linux/bpf_dsl/bpf_dsl.h" |
| 22 #include "sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.h" | 22 #include "sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.h" |
| 23 #include "sandbox/linux/seccomp-bpf/sandbox_bpf_policy.h" | 23 #include "sandbox/linux/seccomp-bpf/sandbox_bpf_policy.h" |
| 24 #include "sandbox/linux/services/linux_syscalls.h" | 24 #include "sandbox/linux/services/linux_syscalls.h" |
| 25 | 25 |
| 26 #if defined(__arm__) && !defined(MAP_STACK) | 26 #if defined(__arm__) && !defined(MAP_STACK) |
| 27 // Chrome OS Daisy (ARM) build environment has old headers. | 27 // Chrome OS Daisy (ARM) build environment has old headers. |
| 28 #define MAP_STACK 0x20000 | 28 #define MAP_STACK 0x20000 |
| 29 #endif | 29 #endif |
| 30 | 30 |
| 31 using namespace sandbox::bpf_dsl; | |
| 32 using sandbox::CrashSIGSYS; | 31 using sandbox::CrashSIGSYS; |
| 33 using sandbox::CrashSIGSYSClone; | 32 using sandbox::CrashSIGSYSClone; |
| 34 using sandbox::CrashSIGSYSPrctl; | 33 using sandbox::CrashSIGSYSPrctl; |
| 34 using sandbox::bpf_dsl::Allow; | |
| 35 using sandbox::bpf_dsl::Arg; | |
| 36 using sandbox::bpf_dsl::Error; | |
| 37 using sandbox::bpf_dsl::If; | |
| 38 using sandbox::bpf_dsl::ResultExpr; | |
| 39 | |
| 40 // TODO(mdempsky): Make BoolExpr a standalone class so these operators can | |
| 41 // be resolved via argument-dependant lookup. | |
|
Mark Seaborn
2014/08/04 19:44:58
"dependent"
mdempsky
2014/08/04 20:01:56
Done.
| |
| 42 using sandbox::bpf_dsl::operator&&; | |
| 43 using sandbox::bpf_dsl::operator||; | |
| 35 | 44 |
| 36 namespace nacl { | 45 namespace nacl { |
| 37 namespace nonsfi { | 46 namespace nonsfi { |
| 38 namespace { | 47 namespace { |
| 39 | 48 |
| 40 ResultExpr RestrictFcntlCommands() { | 49 ResultExpr RestrictFcntlCommands() { |
| 41 const Arg<int> cmd(1); | 50 const Arg<int> cmd(1); |
| 42 const Arg<long> long_arg(2); | 51 const Arg<long> long_arg(2); |
| 43 | 52 |
| 44 // We allow following cases: | 53 // We allow following cases: |
| (...skipping 251 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
| 296 scoped_ptr<sandbox::SandboxBPFPolicy>( | 305 scoped_ptr<sandbox::SandboxBPFPolicy>( |
| 297 new nacl::nonsfi::NaClNonSfiBPFSandboxPolicy())); | 306 new nacl::nonsfi::NaClNonSfiBPFSandboxPolicy())); |
| 298 if (!sandbox_is_initialized) | 307 if (!sandbox_is_initialized) |
| 299 return false; | 308 return false; |
| 300 RunSandboxSanityChecks(); | 309 RunSandboxSanityChecks(); |
| 301 return true; | 310 return true; |
| 302 } | 311 } |
| 303 | 312 |
| 304 } // namespace nonsfi | 313 } // namespace nonsfi |
| 305 } // namespace nacl | 314 } // namespace nacl |
| OLD | NEW |