| OLD | NEW |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "sandbox/linux/seccomp-bpf/syscall.h" | 5 #include "sandbox/linux/seccomp-bpf/syscall.h" |
| 6 | 6 |
| 7 #include <asm/unistd.h> | 7 #include <asm/unistd.h> |
| 8 #include <fcntl.h> | 8 #include <fcntl.h> |
| 9 #include <sys/mman.h> | 9 #include <sys/mman.h> |
| 10 #include <sys/syscall.h> | 10 #include <sys/syscall.h> |
| (...skipping 81 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 92 // SIGSYS trap handler that will be called on __NR_uname. | 92 // SIGSYS trap handler that will be called on __NR_uname. |
| 93 intptr_t CopySyscallArgsToAux(const struct arch_seccomp_data& args, void* aux) { | 93 intptr_t CopySyscallArgsToAux(const struct arch_seccomp_data& args, void* aux) { |
| 94 // |aux| is our BPF_AUX pointer. | 94 // |aux| is our BPF_AUX pointer. |
| 95 std::vector<uint64_t>* const seen_syscall_args = | 95 std::vector<uint64_t>* const seen_syscall_args = |
| 96 static_cast<std::vector<uint64_t>*>(aux); | 96 static_cast<std::vector<uint64_t>*>(aux); |
| 97 BPF_ASSERT(arraysize(args.args) == 6); | 97 BPF_ASSERT(arraysize(args.args) == 6); |
| 98 seen_syscall_args->assign(args.args, args.args + arraysize(args.args)); | 98 seen_syscall_args->assign(args.args, args.args + arraysize(args.args)); |
| 99 return -ENOMEM; | 99 return -ENOMEM; |
| 100 } | 100 } |
| 101 | 101 |
| 102 ErrorCode CopyAllArgsOnUnamePolicy(SandboxBPF* sandbox, | 102 class CopyAllArgsOnUnamePolicy : public SandboxBPFPolicy { |
| 103 int sysno, | 103 public: |
| 104 std::vector<uint64_t>* aux) { | 104 explicit CopyAllArgsOnUnamePolicy(std::vector<uint64_t>* aux) : aux_(aux) {} |
| 105 if (!SandboxBPF::IsValidSyscallNumber(sysno)) { | 105 virtual ~CopyAllArgsOnUnamePolicy() {} |
| 106 return ErrorCode(ENOSYS); | 106 |
| 107 virtual ErrorCode EvaluateSyscall(SandboxBPF* sandbox, |
| 108 int sysno) const OVERRIDE { |
| 109 DCHECK(SandboxBPF::IsValidSyscallNumber(sysno)); |
| 110 if (sysno == __NR_uname) { |
| 111 return sandbox->Trap(CopySyscallArgsToAux, aux_); |
| 112 } else { |
| 113 return ErrorCode(ErrorCode::ERR_ALLOWED); |
| 114 } |
| 107 } | 115 } |
| 108 if (sysno == __NR_uname) { | 116 |
| 109 return sandbox->Trap(CopySyscallArgsToAux, aux); | 117 private: |
| 110 } else { | 118 std::vector<uint64_t>* aux_; |
| 111 return ErrorCode(ErrorCode::ERR_ALLOWED); | 119 |
| 112 } | 120 DISALLOW_COPY_AND_ASSIGN(CopyAllArgsOnUnamePolicy); |
| 113 } | 121 }; |
| 114 | 122 |
| 115 // We are testing Syscall::Call() by making use of a BPF filter that | 123 // We are testing Syscall::Call() by making use of a BPF filter that |
| 116 // allows us | 124 // allows us |
| 117 // to inspect the system call arguments that the kernel saw. | 125 // to inspect the system call arguments that the kernel saw. |
| 118 BPF_TEST(Syscall, | 126 BPF_TEST(Syscall, |
| 119 SyntheticSixArgs, | 127 SyntheticSixArgs, |
| 120 CopyAllArgsOnUnamePolicy, | 128 CopyAllArgsOnUnamePolicy, |
| 121 std::vector<uint64_t> /* (*BPF_AUX) */) { | 129 std::vector<uint64_t> /* (*BPF_AUX) */) { |
| 122 const int kExpectedValue = 42; | 130 const int kExpectedValue = 42; |
| 123 // In this test we only pass integers to the kernel. We might want to make | 131 // In this test we only pass integers to the kernel. We might want to make |
| (...skipping 95 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 219 | 227 |
| 220 // Clean up | 228 // Clean up |
| 221 EXPECT_EQ(0, Syscall::Call(__NR_munmap, addr2, 8192L)); | 229 EXPECT_EQ(0, Syscall::Call(__NR_munmap, addr2, 8192L)); |
| 222 EXPECT_EQ(0, Syscall::Call(__NR_munmap, addr3, 4096L)); | 230 EXPECT_EQ(0, Syscall::Call(__NR_munmap, addr3, 4096L)); |
| 223 EXPECT_EQ(0, IGNORE_EINTR(Syscall::Call(__NR_close, fd))); | 231 EXPECT_EQ(0, IGNORE_EINTR(Syscall::Call(__NR_close, fd))); |
| 224 } | 232 } |
| 225 | 233 |
| 226 } // namespace | 234 } // namespace |
| 227 | 235 |
| 228 } // namespace sandbox | 236 } // namespace sandbox |
| OLD | NEW |