| OLD | NEW |
| 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.h" | 5 #include "sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.h" |
| 6 | 6 |
| 7 #include <errno.h> | 7 #include <errno.h> |
| 8 #include <fcntl.h> | 8 #include <fcntl.h> |
| 9 #include <fcntl.h> | 9 #include <fcntl.h> |
| 10 #include <linux/futex.h> | 10 #include <linux/futex.h> |
| (...skipping 66 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 77 } // namespace. | 77 } // namespace. |
| 78 | 78 |
| 79 using sandbox::bpf_dsl::Allow; | 79 using sandbox::bpf_dsl::Allow; |
| 80 using sandbox::bpf_dsl::Arg; | 80 using sandbox::bpf_dsl::Arg; |
| 81 using sandbox::bpf_dsl::BoolExpr; | 81 using sandbox::bpf_dsl::BoolExpr; |
| 82 using sandbox::bpf_dsl::Error; | 82 using sandbox::bpf_dsl::Error; |
| 83 using sandbox::bpf_dsl::If; | 83 using sandbox::bpf_dsl::If; |
| 84 using sandbox::bpf_dsl::ResultExpr; | 84 using sandbox::bpf_dsl::ResultExpr; |
| 85 | 85 |
| 86 // TODO(mdempsky): Make BoolExpr a standalone class so these operators can | 86 // TODO(mdempsky): Make BoolExpr a standalone class so these operators can |
| 87 // be resolved via argument-dependant lookup. | 87 // be resolved via argument-dependent lookup. |
| 88 using sandbox::bpf_dsl::operator||; | 88 using sandbox::bpf_dsl::operator||; |
| 89 using sandbox::bpf_dsl::operator&&; | 89 using sandbox::bpf_dsl::operator&&; |
| 90 | 90 |
| 91 namespace sandbox { | 91 namespace sandbox { |
| 92 | 92 |
| 93 // Allow Glibc's and Android pthread creation flags, crash on any other | 93 // Allow Glibc's and Android pthread creation flags, crash on any other |
| 94 // thread creation attempts and EPERM attempts to use neither | 94 // thread creation attempts and EPERM attempts to use neither |
| 95 // CLONE_VM, nor CLONE_THREAD, which includes all fork() implementations. | 95 // CLONE_VM, nor CLONE_THREAD, which includes all fork() implementations. |
| 96 ResultExpr RestrictCloneToThreadsAndEPERMFork() { | 96 ResultExpr RestrictCloneToThreadsAndEPERMFork() { |
| 97 const Arg<unsigned long> flags(0); | 97 const Arg<unsigned long> flags(0); |
| (...skipping 116 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 214 need_to_explicitly_blacklist_more_bits); | 214 need_to_explicitly_blacklist_more_bits); |
| 215 | 215 |
| 216 const Arg<int> op(1); | 216 const Arg<int> op(1); |
| 217 return If(op == FUTEX_CMP_REQUEUE_PI || op == FUTEX_CMP_REQUEUE_PI_PRIVATE || | 217 return If(op == FUTEX_CMP_REQUEUE_PI || op == FUTEX_CMP_REQUEUE_PI_PRIVATE || |
| 218 op == (FUTEX_CMP_REQUEUE_PI | FUTEX_CLOCK_REALTIME) || | 218 op == (FUTEX_CMP_REQUEUE_PI | FUTEX_CLOCK_REALTIME) || |
| 219 op == (FUTEX_CMP_REQUEUE_PI_PRIVATE | FUTEX_CLOCK_REALTIME), | 219 op == (FUTEX_CMP_REQUEUE_PI_PRIVATE | FUTEX_CLOCK_REALTIME), |
| 220 CrashSIGSYSFutex()).Else(Allow()); | 220 CrashSIGSYSFutex()).Else(Allow()); |
| 221 } | 221 } |
| 222 | 222 |
| 223 } // namespace sandbox. | 223 } // namespace sandbox. |
| OLD | NEW |