OLD | NEW |
1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.h" | 5 #include "sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.h" |
6 | 6 |
7 #include <errno.h> | 7 #include <errno.h> |
8 #include <fcntl.h> | 8 #include <fcntl.h> |
9 #include <fcntl.h> | 9 #include <fcntl.h> |
10 #include <linux/futex.h> | 10 #include <linux/futex.h> |
(...skipping 70 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
81 | 81 |
82 #define CASES SANDBOX_BPF_DSL_CASES | 82 #define CASES SANDBOX_BPF_DSL_CASES |
83 | 83 |
84 using sandbox::bpf_dsl::Allow; | 84 using sandbox::bpf_dsl::Allow; |
85 using sandbox::bpf_dsl::Arg; | 85 using sandbox::bpf_dsl::Arg; |
86 using sandbox::bpf_dsl::BoolExpr; | 86 using sandbox::bpf_dsl::BoolExpr; |
87 using sandbox::bpf_dsl::Error; | 87 using sandbox::bpf_dsl::Error; |
88 using sandbox::bpf_dsl::If; | 88 using sandbox::bpf_dsl::If; |
89 using sandbox::bpf_dsl::ResultExpr; | 89 using sandbox::bpf_dsl::ResultExpr; |
90 | 90 |
91 // TODO(mdempsky): Make BoolExpr a standalone class so these operators can | |
92 // be resolved via argument-dependent lookup. | |
93 using sandbox::bpf_dsl::operator||; | |
94 using sandbox::bpf_dsl::operator&&; | |
95 | |
96 namespace sandbox { | 91 namespace sandbox { |
97 | 92 |
98 // Allow Glibc's and Android pthread creation flags, crash on any other | 93 // Allow Glibc's and Android pthread creation flags, crash on any other |
99 // thread creation attempts and EPERM attempts to use neither | 94 // thread creation attempts and EPERM attempts to use neither |
100 // CLONE_VM, nor CLONE_THREAD, which includes all fork() implementations. | 95 // CLONE_VM, nor CLONE_THREAD, which includes all fork() implementations. |
101 ResultExpr RestrictCloneToThreadsAndEPERMFork() { | 96 ResultExpr RestrictCloneToThreadsAndEPERMFork() { |
102 const Arg<unsigned long> flags(0); | 97 const Arg<unsigned long> flags(0); |
103 | 98 |
104 // TODO(mdempsky): Extend DSL to support (flags & ~mask1) == mask2. | 99 // TODO(mdempsky): Extend DSL to support (flags & ~mask1) == mask2. |
105 const uint64_t kAndroidCloneMask = CLONE_VM | CLONE_FS | CLONE_FILES | | 100 const uint64_t kAndroidCloneMask = CLONE_VM | CLONE_FS | CLONE_FILES | |
(...skipping 132 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
238 FUTEX_REQUEUE, | 233 FUTEX_REQUEUE, |
239 FUTEX_CMP_REQUEUE, | 234 FUTEX_CMP_REQUEUE, |
240 FUTEX_WAKE_OP, | 235 FUTEX_WAKE_OP, |
241 FUTEX_WAIT_BITSET, | 236 FUTEX_WAIT_BITSET, |
242 FUTEX_WAKE_BITSET), | 237 FUTEX_WAKE_BITSET), |
243 Allow()) | 238 Allow()) |
244 .Default(CrashSIGSYSFutex()); | 239 .Default(CrashSIGSYSFutex()); |
245 } | 240 } |
246 | 241 |
247 } // namespace sandbox. | 242 } // namespace sandbox. |
OLD | NEW |