OLD | NEW |
1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.h" | 5 #include "sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.h" |
6 | 6 |
7 #include <errno.h> | 7 #include <errno.h> |
8 #include <fcntl.h> | 8 #include <fcntl.h> |
9 #include <fcntl.h> | 9 #include <fcntl.h> |
10 #include <linux/futex.h> | 10 #include <linux/futex.h> |
(...skipping 66 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
77 } // namespace. | 77 } // namespace. |
78 | 78 |
79 using sandbox::bpf_dsl::Allow; | 79 using sandbox::bpf_dsl::Allow; |
80 using sandbox::bpf_dsl::Arg; | 80 using sandbox::bpf_dsl::Arg; |
81 using sandbox::bpf_dsl::BoolExpr; | 81 using sandbox::bpf_dsl::BoolExpr; |
82 using sandbox::bpf_dsl::Error; | 82 using sandbox::bpf_dsl::Error; |
83 using sandbox::bpf_dsl::If; | 83 using sandbox::bpf_dsl::If; |
84 using sandbox::bpf_dsl::ResultExpr; | 84 using sandbox::bpf_dsl::ResultExpr; |
85 | 85 |
86 // TODO(mdempsky): Make BoolExpr a standalone class so these operators can | 86 // TODO(mdempsky): Make BoolExpr a standalone class so these operators can |
87 // be resolved via argument-dependant lookup. | 87 // be resolved via argument-dependent lookup. |
88 using sandbox::bpf_dsl::operator||; | 88 using sandbox::bpf_dsl::operator||; |
89 using sandbox::bpf_dsl::operator&&; | 89 using sandbox::bpf_dsl::operator&&; |
90 | 90 |
91 namespace sandbox { | 91 namespace sandbox { |
92 | 92 |
93 // Allow Glibc's and Android pthread creation flags, crash on any other | 93 // Allow Glibc's and Android pthread creation flags, crash on any other |
94 // thread creation attempts and EPERM attempts to use neither | 94 // thread creation attempts and EPERM attempts to use neither |
95 // CLONE_VM, nor CLONE_THREAD, which includes all fork() implementations. | 95 // CLONE_VM, nor CLONE_THREAD, which includes all fork() implementations. |
96 ResultExpr RestrictCloneToThreadsAndEPERMFork() { | 96 ResultExpr RestrictCloneToThreadsAndEPERMFork() { |
97 const Arg<unsigned long> flags(0); | 97 const Arg<unsigned long> flags(0); |
(...skipping 116 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
214 need_to_explicitly_blacklist_more_bits); | 214 need_to_explicitly_blacklist_more_bits); |
215 | 215 |
216 const Arg<int> op(1); | 216 const Arg<int> op(1); |
217 return If(op == FUTEX_CMP_REQUEUE_PI || op == FUTEX_CMP_REQUEUE_PI_PRIVATE || | 217 return If(op == FUTEX_CMP_REQUEUE_PI || op == FUTEX_CMP_REQUEUE_PI_PRIVATE || |
218 op == (FUTEX_CMP_REQUEUE_PI | FUTEX_CLOCK_REALTIME) || | 218 op == (FUTEX_CMP_REQUEUE_PI | FUTEX_CLOCK_REALTIME) || |
219 op == (FUTEX_CMP_REQUEUE_PI_PRIVATE | FUTEX_CLOCK_REALTIME), | 219 op == (FUTEX_CMP_REQUEUE_PI_PRIVATE | FUTEX_CLOCK_REALTIME), |
220 CrashSIGSYSFutex()).Else(Allow()); | 220 CrashSIGSYSFutex()).Else(Allow()); |
221 } | 221 } |
222 | 222 |
223 } // namespace sandbox. | 223 } // namespace sandbox. |
OLD | NEW |