Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(149)

Side by Side Diff: sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.cc

Issue 543333002: bpf_dsl: fix argument-dependent lookup of BoolExpr operators (Closed) Base URL: https://chromium.googlesource.com/chromium/src.git@master
Patch Set: Created 6 years, 3 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
« no previous file with comments | « sandbox/linux/bpf_dsl/bpf_dsl.h ('k') | no next file » | no next file with comments »
Toggle Intra-line Diffs ('i') | Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
OLDNEW
1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be 2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file. 3 // found in the LICENSE file.
4 4
5 #include "sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.h" 5 #include "sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.h"
6 6
7 #include <errno.h> 7 #include <errno.h>
8 #include <fcntl.h> 8 #include <fcntl.h>
9 #include <fcntl.h> 9 #include <fcntl.h>
10 #include <linux/futex.h> 10 #include <linux/futex.h>
(...skipping 70 matching lines...) Expand 10 before | Expand all | Expand 10 after
81 81
82 #define CASES SANDBOX_BPF_DSL_CASES 82 #define CASES SANDBOX_BPF_DSL_CASES
83 83
84 using sandbox::bpf_dsl::Allow; 84 using sandbox::bpf_dsl::Allow;
85 using sandbox::bpf_dsl::Arg; 85 using sandbox::bpf_dsl::Arg;
86 using sandbox::bpf_dsl::BoolExpr; 86 using sandbox::bpf_dsl::BoolExpr;
87 using sandbox::bpf_dsl::Error; 87 using sandbox::bpf_dsl::Error;
88 using sandbox::bpf_dsl::If; 88 using sandbox::bpf_dsl::If;
89 using sandbox::bpf_dsl::ResultExpr; 89 using sandbox::bpf_dsl::ResultExpr;
90 90
91 // TODO(mdempsky): Make BoolExpr a standalone class so these operators can
92 // be resolved via argument-dependent lookup.
93 using sandbox::bpf_dsl::operator||;
94 using sandbox::bpf_dsl::operator&&;
95
96 namespace sandbox { 91 namespace sandbox {
97 92
98 // Allow Glibc's and Android pthread creation flags, crash on any other 93 // Allow Glibc's and Android pthread creation flags, crash on any other
99 // thread creation attempts and EPERM attempts to use neither 94 // thread creation attempts and EPERM attempts to use neither
100 // CLONE_VM, nor CLONE_THREAD, which includes all fork() implementations. 95 // CLONE_VM, nor CLONE_THREAD, which includes all fork() implementations.
101 ResultExpr RestrictCloneToThreadsAndEPERMFork() { 96 ResultExpr RestrictCloneToThreadsAndEPERMFork() {
102 const Arg<unsigned long> flags(0); 97 const Arg<unsigned long> flags(0);
103 98
104 // TODO(mdempsky): Extend DSL to support (flags & ~mask1) == mask2. 99 // TODO(mdempsky): Extend DSL to support (flags & ~mask1) == mask2.
105 const uint64_t kAndroidCloneMask = CLONE_VM | CLONE_FS | CLONE_FILES | 100 const uint64_t kAndroidCloneMask = CLONE_VM | CLONE_FS | CLONE_FILES |
(...skipping 132 matching lines...) Expand 10 before | Expand all | Expand 10 after
238 FUTEX_REQUEUE, 233 FUTEX_REQUEUE,
239 FUTEX_CMP_REQUEUE, 234 FUTEX_CMP_REQUEUE,
240 FUTEX_WAKE_OP, 235 FUTEX_WAKE_OP,
241 FUTEX_WAIT_BITSET, 236 FUTEX_WAIT_BITSET,
242 FUTEX_WAKE_BITSET), 237 FUTEX_WAKE_BITSET),
243 Allow()) 238 Allow())
244 .Default(CrashSIGSYSFutex()); 239 .Default(CrashSIGSYSFutex());
245 } 240 }
246 241
247 } // namespace sandbox. 242 } // namespace sandbox.
OLDNEW
« no previous file with comments | « sandbox/linux/bpf_dsl/bpf_dsl.h ('k') | no next file » | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698