OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "sandbox/linux/seccomp-bpf/sandbox_bpf.h" | 5 #include "sandbox/linux/seccomp-bpf/sandbox_bpf.h" |
6 | 6 |
7 // Some headers on Android are missing cdefs: crbug.com/172337. | 7 // Some headers on Android are missing cdefs: crbug.com/172337. |
8 // (We can't use OS_ANDROID here since build_config.h is not included). | 8 // (We can't use OS_ANDROID here since build_config.h is not included). |
9 #if defined(ANDROID) | 9 #if defined(ANDROID) |
10 #include <sys/cdefs.h> | 10 #include <sys/cdefs.h> |
(...skipping 126 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
137 } | 137 } |
138 | 138 |
139 // Function that can be passed as a callback function to CodeGen::Traverse(). | 139 // Function that can be passed as a callback function to CodeGen::Traverse(). |
140 // Checks whether the "insn" returns an UnsafeTrap() ErrorCode. If so, it | 140 // Checks whether the "insn" returns an UnsafeTrap() ErrorCode. If so, it |
141 // sets the "bool" variable pointed to by "aux". | 141 // sets the "bool" variable pointed to by "aux". |
142 void CheckForUnsafeErrorCodes(Instruction* insn, void* aux) { | 142 void CheckForUnsafeErrorCodes(Instruction* insn, void* aux) { |
143 bool* is_unsafe = static_cast<bool*>(aux); | 143 bool* is_unsafe = static_cast<bool*>(aux); |
144 if (!*is_unsafe) { | 144 if (!*is_unsafe) { |
145 if (BPF_CLASS(insn->code) == BPF_RET && insn->k > SECCOMP_RET_TRAP && | 145 if (BPF_CLASS(insn->code) == BPF_RET && insn->k > SECCOMP_RET_TRAP && |
146 insn->k - SECCOMP_RET_TRAP <= SECCOMP_RET_DATA) { | 146 insn->k - SECCOMP_RET_TRAP <= SECCOMP_RET_DATA) { |
147 const ErrorCode& err = | 147 if (!Trap::IsSafeTrapId(insn->k & SECCOMP_RET_DATA)) { |
148 Trap::ErrorCodeFromTrapId(insn->k & SECCOMP_RET_DATA); | |
149 if (err.error_type() != ErrorCode::ET_INVALID && !err.safe()) { | |
150 *is_unsafe = true; | 148 *is_unsafe = true; |
151 } | 149 } |
152 } | 150 } |
153 } | 151 } |
154 } | 152 } |
155 | 153 |
156 // A Trap() handler that returns an "errno" value. The value is encoded | 154 // A Trap() handler that returns an "errno" value. The value is encoded |
157 // in the "aux" parameter. | 155 // in the "aux" parameter. |
158 intptr_t ReturnErrno(const struct arch_seccomp_data&, void* aux) { | 156 intptr_t ReturnErrno(const struct arch_seccomp_data&, void* aux) { |
159 // TrapFnc functions report error by following the native kernel convention | 157 // TrapFnc functions report error by following the native kernel convention |
(...skipping 853 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
1013 mask, | 1011 mask, |
1014 gen->MakeInstruction( | 1012 gen->MakeInstruction( |
1015 BPF_JMP + BPF_JEQ + BPF_K, value, passed, failed))); | 1013 BPF_JMP + BPF_JEQ + BPF_K, value, passed, failed))); |
1016 } | 1014 } |
1017 | 1015 |
1018 ErrorCode SandboxBPF::Unexpected64bitArgument() { | 1016 ErrorCode SandboxBPF::Unexpected64bitArgument() { |
1019 return Kill("Unexpected 64bit argument detected"); | 1017 return Kill("Unexpected 64bit argument detected"); |
1020 } | 1018 } |
1021 | 1019 |
1022 ErrorCode SandboxBPF::Trap(Trap::TrapFnc fnc, const void* aux) { | 1020 ErrorCode SandboxBPF::Trap(Trap::TrapFnc fnc, const void* aux) { |
1023 return Trap::MakeTrap(fnc, aux, true /* Safe Trap */); | 1021 return ErrorCode(fnc, aux, true /* Safe Trap */); |
1024 } | 1022 } |
1025 | 1023 |
1026 ErrorCode SandboxBPF::UnsafeTrap(Trap::TrapFnc fnc, const void* aux) { | 1024 ErrorCode SandboxBPF::UnsafeTrap(Trap::TrapFnc fnc, const void* aux) { |
1027 return Trap::MakeTrap(fnc, aux, false /* Unsafe Trap */); | 1025 return ErrorCode(fnc, aux, false /* Unsafe Trap */); |
1028 } | 1026 } |
1029 | 1027 |
1030 bool SandboxBPF::IsRequiredForUnsafeTrap(int sysno) { | 1028 bool SandboxBPF::IsRequiredForUnsafeTrap(int sysno) { |
1031 return (sysno == __NR_rt_sigprocmask || sysno == __NR_rt_sigreturn | 1029 return (sysno == __NR_rt_sigprocmask || sysno == __NR_rt_sigreturn |
1032 #if defined(__NR_sigprocmask) | 1030 #if defined(__NR_sigprocmask) |
1033 || | 1031 || |
1034 sysno == __NR_sigprocmask | 1032 sysno == __NR_sigprocmask |
1035 #endif | 1033 #endif |
1036 #if defined(__NR_sigreturn) | 1034 #if defined(__NR_sigreturn) |
1037 || | 1035 || |
(...skipping 67 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
1105 } | 1103 } |
1106 } | 1104 } |
1107 | 1105 |
1108 ErrorCode SandboxBPF::Kill(const char* msg) { | 1106 ErrorCode SandboxBPF::Kill(const char* msg) { |
1109 return Trap(BPFFailure, const_cast<char*>(msg)); | 1107 return Trap(BPFFailure, const_cast<char*>(msg)); |
1110 } | 1108 } |
1111 | 1109 |
1112 SandboxBPF::SandboxStatus SandboxBPF::status_ = STATUS_UNKNOWN; | 1110 SandboxBPF::SandboxStatus SandboxBPF::status_ = STATUS_UNKNOWN; |
1113 | 1111 |
1114 } // namespace sandbox | 1112 } // namespace sandbox |
OLD | NEW |