| OLD | NEW |
| 1 // Copyright 2014 The Chromium Authors. All rights reserved. | 1 // Copyright 2014 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "sandbox/linux/bpf_dsl/bpf_dsl.h" | 5 #include "sandbox/linux/bpf_dsl/bpf_dsl.h" |
| 6 | 6 |
| 7 #include <errno.h> | 7 #include <errno.h> |
| 8 #include <netinet/in.h> | 8 #include <netinet/in.h> |
| 9 #include <sys/socket.h> | 9 #include <sys/socket.h> |
| 10 #include <sys/utsname.h> | 10 #include <sys/utsname.h> |
| (...skipping 49 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 60 | 60 |
| 61 class BasicPolicy : public SandboxBPFDSLPolicy { | 61 class BasicPolicy : public SandboxBPFDSLPolicy { |
| 62 public: | 62 public: |
| 63 BasicPolicy() {} | 63 BasicPolicy() {} |
| 64 virtual ~BasicPolicy() {} | 64 virtual ~BasicPolicy() {} |
| 65 virtual ResultExpr EvaluateSyscall(int sysno) const OVERRIDE { | 65 virtual ResultExpr EvaluateSyscall(int sysno) const OVERRIDE { |
| 66 if (sysno == __NR_getpgid) { | 66 if (sysno == __NR_getpgid) { |
| 67 const Arg<pid_t> pid(0); | 67 const Arg<pid_t> pid(0); |
| 68 return If(pid == 0, Error(EPERM)).Else(Error(EINVAL)); | 68 return If(pid == 0, Error(EPERM)).Else(Error(EINVAL)); |
| 69 } | 69 } |
| 70 if (sysno == __NR_setuid) { |
| 71 const Arg<uid_t> uid(0); |
| 72 return If(uid != 42, Error(ESRCH)).Else(Error(ENOMEM)); |
| 73 } |
| 70 return Allow(); | 74 return Allow(); |
| 71 } | 75 } |
| 72 | 76 |
| 73 private: | 77 private: |
| 74 DISALLOW_COPY_AND_ASSIGN(BasicPolicy); | 78 DISALLOW_COPY_AND_ASSIGN(BasicPolicy); |
| 75 }; | 79 }; |
| 76 | 80 |
| 77 BPF_TEST_C(BPFDSL, Basic, BasicPolicy) { | 81 BPF_TEST_C(BPFDSL, Basic, BasicPolicy) { |
| 78 ASSERT_SYSCALL_RESULT(-EPERM, getpgid, 0); | 82 ASSERT_SYSCALL_RESULT(-EPERM, getpgid, 0); |
| 79 ASSERT_SYSCALL_RESULT(-EINVAL, getpgid, 1); | 83 ASSERT_SYSCALL_RESULT(-EINVAL, getpgid, 1); |
| 84 |
| 85 ASSERT_SYSCALL_RESULT(-ENOMEM, setuid, 42); |
| 86 ASSERT_SYSCALL_RESULT(-ESRCH, setuid, 43); |
| 80 } | 87 } |
| 81 | 88 |
| 82 /* On IA-32, socketpair() is implemented via socketcall(). :-( */ | 89 /* On IA-32, socketpair() is implemented via socketcall(). :-( */ |
| 83 #if !defined(ARCH_CPU_X86) | 90 #if !defined(ARCH_CPU_X86) |
| 84 class BooleanLogicPolicy : public SandboxBPFDSLPolicy { | 91 class BooleanLogicPolicy : public SandboxBPFDSLPolicy { |
| 85 public: | 92 public: |
| 86 BooleanLogicPolicy() {} | 93 BooleanLogicPolicy() {} |
| 87 virtual ~BooleanLogicPolicy() {} | 94 virtual ~BooleanLogicPolicy() {} |
| 88 virtual ResultExpr EvaluateSyscall(int sysno) const OVERRIDE { | 95 virtual ResultExpr EvaluateSyscall(int sysno) const OVERRIDE { |
| 89 if (sysno == __NR_socketpair) { | 96 if (sysno == __NR_socketpair) { |
| (...skipping 224 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 314 ASSERT_SYSCALL_RESULT(-EINVAL, fcntl, sock_fd.get(), F_SETFD, 0); | 321 ASSERT_SYSCALL_RESULT(-EINVAL, fcntl, sock_fd.get(), F_SETFD, 0); |
| 315 | 322 |
| 316 ASSERT_SYSCALL_RESULT(-EPERM, fcntl, sock_fd.get(), F_SETFL, O_RDONLY); | 323 ASSERT_SYSCALL_RESULT(-EPERM, fcntl, sock_fd.get(), F_SETFL, O_RDONLY); |
| 317 | 324 |
| 318 ASSERT_SYSCALL_RESULT(-EACCES, fcntl, sock_fd.get(), F_DUPFD, 0); | 325 ASSERT_SYSCALL_RESULT(-EACCES, fcntl, sock_fd.get(), F_DUPFD, 0); |
| 319 } | 326 } |
| 320 | 327 |
| 321 } // namespace | 328 } // namespace |
| 322 } // namespace bpf_dsl | 329 } // namespace bpf_dsl |
| 323 } // namespace sandbox | 330 } // namespace sandbox |
| OLD | NEW |