| OLD | NEW |
| 1 // Copyright 2014 The Chromium Authors. All rights reserved. | 1 // Copyright 2014 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "components/nacl/loader/nonsfi/nonsfi_sandbox.h" | 5 #include "components/nacl/loader/nonsfi/nonsfi_sandbox.h" |
| 6 | 6 |
| 7 #include <errno.h> | 7 #include <errno.h> |
| 8 #include <fcntl.h> | 8 #include <fcntl.h> |
| 9 #include <linux/net.h> | 9 #include <linux/net.h> |
| 10 #include <sys/prctl.h> | 10 #include <sys/prctl.h> |
| (...skipping 19 matching lines...) Expand all Loading... |
| 30 | 30 |
| 31 using sandbox::CrashSIGSYS; | 31 using sandbox::CrashSIGSYS; |
| 32 using sandbox::CrashSIGSYSClone; | 32 using sandbox::CrashSIGSYSClone; |
| 33 using sandbox::CrashSIGSYSPrctl; | 33 using sandbox::CrashSIGSYSPrctl; |
| 34 using sandbox::bpf_dsl::Allow; | 34 using sandbox::bpf_dsl::Allow; |
| 35 using sandbox::bpf_dsl::Arg; | 35 using sandbox::bpf_dsl::Arg; |
| 36 using sandbox::bpf_dsl::Error; | 36 using sandbox::bpf_dsl::Error; |
| 37 using sandbox::bpf_dsl::If; | 37 using sandbox::bpf_dsl::If; |
| 38 using sandbox::bpf_dsl::ResultExpr; | 38 using sandbox::bpf_dsl::ResultExpr; |
| 39 | 39 |
| 40 // TODO(mdempsky): Make BoolExpr a standalone class so these operators can | |
| 41 // be resolved via argument-dependent lookup. | |
| 42 using sandbox::bpf_dsl::operator&&; | |
| 43 using sandbox::bpf_dsl::operator||; | |
| 44 | |
| 45 namespace nacl { | 40 namespace nacl { |
| 46 namespace nonsfi { | 41 namespace nonsfi { |
| 47 namespace { | 42 namespace { |
| 48 | 43 |
| 49 ResultExpr RestrictFcntlCommands() { | 44 ResultExpr RestrictFcntlCommands() { |
| 50 const Arg<int> cmd(1); | 45 const Arg<int> cmd(1); |
| 51 const Arg<long> long_arg(2); | 46 const Arg<long> long_arg(2); |
| 52 | 47 |
| 53 // We allow following cases: | 48 // We allow following cases: |
| 54 // 1. F_SETFD + FD_CLOEXEC: libevent's epoll_init uses this. | 49 // 1. F_SETFD + FD_CLOEXEC: libevent's epoll_init uses this. |
| (...skipping 252 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 307 scoped_ptr<sandbox::SandboxBPFPolicy>( | 302 scoped_ptr<sandbox::SandboxBPFPolicy>( |
| 308 new nacl::nonsfi::NaClNonSfiBPFSandboxPolicy())); | 303 new nacl::nonsfi::NaClNonSfiBPFSandboxPolicy())); |
| 309 if (!sandbox_is_initialized) | 304 if (!sandbox_is_initialized) |
| 310 return false; | 305 return false; |
| 311 RunSandboxSanityChecks(); | 306 RunSandboxSanityChecks(); |
| 312 return true; | 307 return true; |
| 313 } | 308 } |
| 314 | 309 |
| 315 } // namespace nonsfi | 310 } // namespace nonsfi |
| 316 } // namespace nacl | 311 } // namespace nacl |
| OLD | NEW |