Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(905)

Side by Side Diff: content/common/sandbox_linux/bpf_ppapi_policy_linux.cc

Issue 598203004: Linux sandbox: Restrict sched_* syscalls on the GPU and ppapi processes. (Closed) Base URL: https://chromium.googlesource.com/chromium/src.git@master
Patch Set: Created 6 years, 2 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
OLDNEW
1 // Copyright 2013 The Chromium Authors. All rights reserved. 1 // Copyright 2013 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be 2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file. 3 // found in the LICENSE file.
4 4
5 #include "content/common/sandbox_linux/bpf_ppapi_policy_linux.h" 5 #include "content/common/sandbox_linux/bpf_ppapi_policy_linux.h"
6 6
7 #include <errno.h> 7 #include <errno.h>
8 8
9 #include "base/basictypes.h" 9 #include "base/basictypes.h"
10 #include "build/build_config.h" 10 #include "build/build_config.h"
(...skipping 13 matching lines...) Expand all
24 PpapiProcessPolicy::~PpapiProcessPolicy() {} 24 PpapiProcessPolicy::~PpapiProcessPolicy() {}
25 25
26 ResultExpr PpapiProcessPolicy::EvaluateSyscall(int sysno) const { 26 ResultExpr PpapiProcessPolicy::EvaluateSyscall(int sysno) const {
27 switch (sysno) { 27 switch (sysno) {
28 // TODO(jln): restrict prctl. 28 // TODO(jln): restrict prctl.
29 case __NR_prctl: 29 case __NR_prctl:
30 case __NR_pread64: 30 case __NR_pread64:
31 case __NR_pwrite64: 31 case __NR_pwrite64:
32 case __NR_sched_get_priority_max: 32 case __NR_sched_get_priority_max:
33 case __NR_sched_get_priority_min: 33 case __NR_sched_get_priority_min:
34 case __NR_times:
35 return Allow();
34 case __NR_sched_getaffinity: 36 case __NR_sched_getaffinity:
35 case __NR_sched_getparam: 37 case __NR_sched_getparam:
36 case __NR_sched_getscheduler: 38 case __NR_sched_getscheduler:
37 case __NR_sched_setscheduler: 39 case __NR_sched_setscheduler:
38 case __NR_times: 40 return sandbox::RestrictSchedTarget(current_pid(), sysno);
39 return Allow();
40 case __NR_ioctl: 41 case __NR_ioctl:
41 return Error(ENOTTY); // Flash Access. 42 return Error(ENOTTY); // Flash Access.
42 default: 43 default:
43 // Default on the baseline policy. 44 // Default on the baseline policy.
44 return SandboxBPFBasePolicy::EvaluateSyscall(sysno); 45 return SandboxBPFBasePolicy::EvaluateSyscall(sysno);
45 } 46 }
46 } 47 }
47 48
48 } // namespace content 49 } // namespace content
OLDNEW

Powered by Google App Engine
This is Rietveld 408576698