| OLD | NEW |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "content/common/sandbox_linux/sandbox_seccomp_bpf_linux.h" | 5 #include "content/common/sandbox_linux/sandbox_seccomp_bpf_linux.h" |
| 6 | 6 |
| 7 #include <errno.h> | 7 #include <errno.h> |
| 8 #include <fcntl.h> | 8 #include <fcntl.h> |
| 9 #include <sys/socket.h> | 9 #include <sys/socket.h> |
| 10 #include <sys/stat.h> | 10 #include <sys/stat.h> |
| (...skipping 96 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 107 // Allow all syscalls. | 107 // Allow all syscalls. |
| 108 // This will still deny x32 or IA32 calls in 64 bits mode or | 108 // This will still deny x32 or IA32 calls in 64 bits mode or |
| 109 // 64 bits system calls in compatibility mode. | 109 // 64 bits system calls in compatibility mode. |
| 110 ResultExpr AllowAllPolicy::EvaluateSyscall(int sysno) const { | 110 ResultExpr AllowAllPolicy::EvaluateSyscall(int sysno) const { |
| 111 return Allow(); | 111 return Allow(); |
| 112 } | 112 } |
| 113 | 113 |
| 114 // If a BPF policy is engaged for |process_type|, run a few sanity checks. | 114 // If a BPF policy is engaged for |process_type|, run a few sanity checks. |
| 115 void RunSandboxSanityChecks(const std::string& process_type) { | 115 void RunSandboxSanityChecks(const std::string& process_type) { |
| 116 if (process_type == switches::kRendererProcess || | 116 if (process_type == switches::kRendererProcess || |
| 117 process_type == switches::kWorkerProcess || | |
| 118 process_type == switches::kGpuProcess || | 117 process_type == switches::kGpuProcess || |
| 119 process_type == switches::kPpapiPluginProcess) { | 118 process_type == switches::kPpapiPluginProcess) { |
| 120 int syscall_ret; | 119 int syscall_ret; |
| 121 errno = 0; | 120 errno = 0; |
| 122 | 121 |
| 123 // Without the sandbox, this would EBADF. | 122 // Without the sandbox, this would EBADF. |
| 124 syscall_ret = fchmod(-1, 07777); | 123 syscall_ret = fchmod(-1, 07777); |
| 125 CHECK_EQ(-1, syscall_ret); | 124 CHECK_EQ(-1, syscall_ret); |
| 126 CHECK_EQ(EPERM, errno); | 125 CHECK_EQ(EPERM, errno); |
| 127 | 126 |
| (...skipping 45 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 173 } | 172 } |
| 174 } | 173 } |
| 175 | 174 |
| 176 // Initialize the seccomp-bpf sandbox. | 175 // Initialize the seccomp-bpf sandbox. |
| 177 bool StartBPFSandbox(const CommandLine& command_line, | 176 bool StartBPFSandbox(const CommandLine& command_line, |
| 178 const std::string& process_type) { | 177 const std::string& process_type) { |
| 179 scoped_ptr<SandboxBPFBasePolicy> policy; | 178 scoped_ptr<SandboxBPFBasePolicy> policy; |
| 180 | 179 |
| 181 if (process_type == switches::kGpuProcess) { | 180 if (process_type == switches::kGpuProcess) { |
| 182 policy.reset(GetGpuProcessSandbox().release()); | 181 policy.reset(GetGpuProcessSandbox().release()); |
| 183 } else if (process_type == switches::kRendererProcess || | 182 } else if (process_type == switches::kRendererProcess) { |
| 184 process_type == switches::kWorkerProcess) { | |
| 185 policy.reset(new RendererProcessPolicy); | 183 policy.reset(new RendererProcessPolicy); |
| 186 } else if (process_type == switches::kPpapiPluginProcess) { | 184 } else if (process_type == switches::kPpapiPluginProcess) { |
| 187 policy.reset(new PpapiProcessPolicy); | 185 policy.reset(new PpapiProcessPolicy); |
| 188 } else if (process_type == switches::kUtilityProcess) { | 186 } else if (process_type == switches::kUtilityProcess) { |
| 189 policy.reset(new UtilityProcessPolicy); | 187 policy.reset(new UtilityProcessPolicy); |
| 190 } else { | 188 } else { |
| 191 NOTREACHED(); | 189 NOTREACHED(); |
| 192 policy.reset(new AllowAllPolicy); | 190 policy.reset(new AllowAllPolicy); |
| 193 } | 191 } |
| 194 | 192 |
| (...skipping 91 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 286 scoped_ptr<sandbox::SandboxBPFPolicy> | 284 scoped_ptr<sandbox::SandboxBPFPolicy> |
| 287 SandboxSeccompBPF::GetBaselinePolicy() { | 285 SandboxSeccompBPF::GetBaselinePolicy() { |
| 288 #if defined(USE_SECCOMP_BPF) | 286 #if defined(USE_SECCOMP_BPF) |
| 289 return scoped_ptr<sandbox::SandboxBPFPolicy>(new BaselinePolicy); | 287 return scoped_ptr<sandbox::SandboxBPFPolicy>(new BaselinePolicy); |
| 290 #else | 288 #else |
| 291 return scoped_ptr<sandbox::SandboxBPFPolicy>(); | 289 return scoped_ptr<sandbox::SandboxBPFPolicy>(); |
| 292 #endif // defined(USE_SECCOMP_BPF) | 290 #endif // defined(USE_SECCOMP_BPF) |
| 293 } | 291 } |
| 294 | 292 |
| 295 } // namespace content | 293 } // namespace content |
| OLD | NEW |