OLD | NEW |
1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.h" | 5 #include "sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.h" |
6 | 6 |
7 #include <errno.h> | 7 #include <errno.h> |
8 #include <fcntl.h> | 8 #include <fcntl.h> |
9 #include <fcntl.h> | 9 #include <fcntl.h> |
10 #include <linux/futex.h> | 10 #include <linux/futex.h> |
(...skipping 11 matching lines...) Expand all Loading... |
22 #include <unistd.h> | 22 #include <unistd.h> |
23 | 23 |
24 #include "base/basictypes.h" | 24 #include "base/basictypes.h" |
25 #include "base/logging.h" | 25 #include "base/logging.h" |
26 #include "base/macros.h" | 26 #include "base/macros.h" |
27 #include "base/time/time.h" | 27 #include "base/time/time.h" |
28 #include "build/build_config.h" | 28 #include "build/build_config.h" |
29 #include "sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.h" | 29 #include "sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.h" |
30 #include "sandbox/linux/seccomp-bpf/linux_seccomp.h" | 30 #include "sandbox/linux/seccomp-bpf/linux_seccomp.h" |
31 #include "sandbox/linux/seccomp-bpf/sandbox_bpf.h" | 31 #include "sandbox/linux/seccomp-bpf/sandbox_bpf.h" |
| 32 #include "sandbox/linux/services/linux_syscalls.h" |
32 | 33 |
33 #if defined(OS_ANDROID) | 34 #if defined(OS_ANDROID) |
34 | 35 |
35 #include "sandbox/linux/services/android_futex.h" | 36 #include "sandbox/linux/services/android_futex.h" |
36 | 37 |
37 #if !defined(F_DUPFD_CLOEXEC) | 38 #if !defined(F_DUPFD_CLOEXEC) |
38 #define F_DUPFD_CLOEXEC (F_LINUX_SPECIFIC_BASE + 6) | 39 #define F_DUPFD_CLOEXEC (F_LINUX_SPECIFIC_BASE + 6) |
39 #endif | 40 #endif |
40 | 41 |
41 #endif // defined(OS_ANDROID) | 42 #endif // defined(OS_ANDROID) |
(...skipping 214 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
256 // Allow the special clock for Chrome OS used by Chrome tracing. | 257 // Allow the special clock for Chrome OS used by Chrome tracing. |
257 clockid == base::TimeTicks::kClockSystemTrace || | 258 clockid == base::TimeTicks::kClockSystemTrace || |
258 #endif | 259 #endif |
259 clockid == CLOCK_MONOTONIC || | 260 clockid == CLOCK_MONOTONIC || |
260 clockid == CLOCK_PROCESS_CPUTIME_ID || | 261 clockid == CLOCK_PROCESS_CPUTIME_ID || |
261 clockid == CLOCK_REALTIME || | 262 clockid == CLOCK_REALTIME || |
262 clockid == CLOCK_THREAD_CPUTIME_ID, | 263 clockid == CLOCK_THREAD_CPUTIME_ID, |
263 Allow()).Else(CrashSIGSYS()); | 264 Allow()).Else(CrashSIGSYS()); |
264 } | 265 } |
265 | 266 |
| 267 ResultExpr RestrictSchedTarget(pid_t target_pid, int sysno) { |
| 268 switch (sysno) { |
| 269 case __NR_sched_getaffinity: |
| 270 case __NR_sched_getattr: |
| 271 case __NR_sched_getparam: |
| 272 case __NR_sched_getscheduler: |
| 273 case __NR_sched_rr_get_interval: |
| 274 case __NR_sched_setaffinity: |
| 275 case __NR_sched_setattr: |
| 276 case __NR_sched_setparam: |
| 277 case __NR_sched_setscheduler: { |
| 278 const Arg<pid_t> pid(0); |
| 279 return If(pid == 0 || pid == target_pid, Allow()) |
| 280 .Else(RewriteSchedSIGSYS()); |
| 281 } |
| 282 default: |
| 283 NOTREACHED(); |
| 284 return CrashSIGSYS(); |
| 285 } |
| 286 } |
| 287 |
| 288 |
266 } // namespace sandbox. | 289 } // namespace sandbox. |
OLD | NEW |