| OLD | NEW |
| 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.h" | 5 #include "sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.h" |
| 6 | 6 |
| 7 #include <errno.h> | 7 #include <errno.h> |
| 8 #include <fcntl.h> | 8 #include <fcntl.h> |
| 9 #include <fcntl.h> | 9 #include <fcntl.h> |
| 10 #include <linux/futex.h> | 10 #include <linux/futex.h> |
| (...skipping 70 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 81 | 81 |
| 82 #define CASES SANDBOX_BPF_DSL_CASES | 82 #define CASES SANDBOX_BPF_DSL_CASES |
| 83 | 83 |
| 84 using sandbox::bpf_dsl::Allow; | 84 using sandbox::bpf_dsl::Allow; |
| 85 using sandbox::bpf_dsl::Arg; | 85 using sandbox::bpf_dsl::Arg; |
| 86 using sandbox::bpf_dsl::BoolExpr; | 86 using sandbox::bpf_dsl::BoolExpr; |
| 87 using sandbox::bpf_dsl::Error; | 87 using sandbox::bpf_dsl::Error; |
| 88 using sandbox::bpf_dsl::If; | 88 using sandbox::bpf_dsl::If; |
| 89 using sandbox::bpf_dsl::ResultExpr; | 89 using sandbox::bpf_dsl::ResultExpr; |
| 90 | 90 |
| 91 // TODO(mdempsky): Make BoolExpr a standalone class so these operators can | |
| 92 // be resolved via argument-dependent lookup. | |
| 93 using sandbox::bpf_dsl::operator||; | |
| 94 using sandbox::bpf_dsl::operator&&; | |
| 95 | |
| 96 namespace sandbox { | 91 namespace sandbox { |
| 97 | 92 |
| 98 // Allow Glibc's and Android pthread creation flags, crash on any other | 93 // Allow Glibc's and Android pthread creation flags, crash on any other |
| 99 // thread creation attempts and EPERM attempts to use neither | 94 // thread creation attempts and EPERM attempts to use neither |
| 100 // CLONE_VM, nor CLONE_THREAD, which includes all fork() implementations. | 95 // CLONE_VM, nor CLONE_THREAD, which includes all fork() implementations. |
| 101 ResultExpr RestrictCloneToThreadsAndEPERMFork() { | 96 ResultExpr RestrictCloneToThreadsAndEPERMFork() { |
| 102 const Arg<unsigned long> flags(0); | 97 const Arg<unsigned long> flags(0); |
| 103 | 98 |
| 104 // TODO(mdempsky): Extend DSL to support (flags & ~mask1) == mask2. | 99 // TODO(mdempsky): Extend DSL to support (flags & ~mask1) == mask2. |
| 105 const uint64_t kAndroidCloneMask = CLONE_VM | CLONE_FS | CLONE_FILES | | 100 const uint64_t kAndroidCloneMask = CLONE_VM | CLONE_FS | CLONE_FILES | |
| (...skipping 132 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 238 FUTEX_REQUEUE, | 233 FUTEX_REQUEUE, |
| 239 FUTEX_CMP_REQUEUE, | 234 FUTEX_CMP_REQUEUE, |
| 240 FUTEX_WAKE_OP, | 235 FUTEX_WAKE_OP, |
| 241 FUTEX_WAIT_BITSET, | 236 FUTEX_WAIT_BITSET, |
| 242 FUTEX_WAKE_BITSET), | 237 FUTEX_WAKE_BITSET), |
| 243 Allow()) | 238 Allow()) |
| 244 .Default(CrashSIGSYSFutex()); | 239 .Default(CrashSIGSYSFutex()); |
| 245 } | 240 } |
| 246 | 241 |
| 247 } // namespace sandbox. | 242 } // namespace sandbox. |
| OLD | NEW |