OLD | NEW |
1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #ifndef SANDBOX_LINUX_SECCOMP_BPF_HELPERS_SYSCALL_PARAMETERS_RESTRICTIONS_H_ | 5 #ifndef SANDBOX_LINUX_SECCOMP_BPF_HELPERS_SYSCALL_PARAMETERS_RESTRICTIONS_H_ |
6 #define SANDBOX_LINUX_SECCOMP_BPF_HELPERS_SYSCALL_PARAMETERS_RESTRICTIONS_H_ | 6 #define SANDBOX_LINUX_SECCOMP_BPF_HELPERS_SYSCALL_PARAMETERS_RESTRICTIONS_H_ |
7 | 7 |
8 #include <unistd.h> | 8 #include <unistd.h> |
9 | 9 |
10 #include "build/build_config.h" | 10 #include "build/build_config.h" |
(...skipping 39 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
50 | 50 |
51 #if defined(__i386__) || defined(__mips__) | 51 #if defined(__i386__) || defined(__mips__) |
52 // Restrict socketcall(2) to only allow socketpair(2), send(2), recv(2), | 52 // Restrict socketcall(2) to only allow socketpair(2), send(2), recv(2), |
53 // sendto(2), recvfrom(2), shutdown(2), sendmsg(2) and recvmsg(2). | 53 // sendto(2), recvfrom(2), shutdown(2), sendmsg(2) and recvmsg(2). |
54 SANDBOX_EXPORT bpf_dsl::ResultExpr RestrictSocketcallCommand(); | 54 SANDBOX_EXPORT bpf_dsl::ResultExpr RestrictSocketcallCommand(); |
55 #endif | 55 #endif |
56 | 56 |
57 // Restrict |sysno| (which must be kill, tkill or tgkill) by allowing tgkill or | 57 // Restrict |sysno| (which must be kill, tkill or tgkill) by allowing tgkill or |
58 // kill iff the first parameter is |target_pid|, crashing otherwise or if | 58 // kill iff the first parameter is |target_pid|, crashing otherwise or if |
59 // |sysno| is tkill. | 59 // |sysno| is tkill. |
60 bpf_dsl::ResultExpr RestrictKillTarget(pid_t target_pid, int sysno); | 60 SANDBOX_EXPORT bpf_dsl::ResultExpr RestrictKillTarget(pid_t target_pid, |
| 61 int sysno); |
61 | 62 |
62 // Crash if FUTEX_CMP_REQUEUE_PI is used in the second argument of futex(2). | 63 // Crash if FUTEX_CMP_REQUEUE_PI is used in the second argument of futex(2). |
63 bpf_dsl::ResultExpr RestrictFutex(); | 64 SANDBOX_EXPORT bpf_dsl::ResultExpr RestrictFutex(); |
64 | 65 |
65 // Crash if |which| is not PRIO_PROCESS. EPERM if |who| is not 0, neither | 66 // Crash if |which| is not PRIO_PROCESS. EPERM if |who| is not 0, neither |
66 // |target_pid| while calling setpriority(2) / getpriority(2). | 67 // |target_pid| while calling setpriority(2) / getpriority(2). |
67 bpf_dsl::ResultExpr RestrictGetSetpriority(pid_t target_pid); | 68 SANDBOX_EXPORT bpf_dsl::ResultExpr RestrictGetSetpriority(pid_t target_pid); |
68 | 69 |
69 // Restrict |clk_id| for clock_getres(), clock_gettime() and clock_settime(). | 70 // Restrict |clk_id| for clock_getres(), clock_gettime() and clock_settime(). |
70 // We allow accessing only CLOCK_MONOTONIC, CLOCK_PROCESS_CPUTIME_ID, | 71 // We allow accessing only CLOCK_MONOTONIC, CLOCK_PROCESS_CPUTIME_ID, |
71 // CLOCK_REALTIME, and CLOCK_THREAD_CPUTIME_ID. In particular, this disallows | 72 // CLOCK_REALTIME, and CLOCK_THREAD_CPUTIME_ID. In particular, this disallows |
72 // access to arbitrary per-{process,thread} CPU-time clock IDs (such as those | 73 // access to arbitrary per-{process,thread} CPU-time clock IDs (such as those |
73 // returned by {clock,pthread}_getcpuclockid), which can leak information | 74 // returned by {clock,pthread}_getcpuclockid), which can leak information |
74 // about the state of the host OS. | 75 // about the state of the host OS. |
75 // On Chrome OS, base::TimeTicks::kClockSystemTrace is also allowed. | 76 // On Chrome OS, base::TimeTicks::kClockSystemTrace is also allowed. |
76 SANDBOX_EXPORT bpf_dsl::ResultExpr RestrictClockID(); | 77 SANDBOX_EXPORT bpf_dsl::ResultExpr RestrictClockID(); |
77 | 78 |
78 // Restricts |pid| for sched_* syscalls which take a pid as the first argument. | 79 // Restricts |pid| for sched_* syscalls which take a pid as the first argument. |
79 // We only allow calling these syscalls if the pid argument is equal to the pid | 80 // We only allow calling these syscalls if the pid argument is equal to the pid |
80 // of the sandboxed process or 0 (indicating the current thread). The following | 81 // of the sandboxed process or 0 (indicating the current thread). The following |
81 // syscalls are supported: | 82 // syscalls are supported: |
82 // | 83 // |
83 // sched_getaffinity(), sched_getattr(), sched_getparam(), sched_getscheduler(), | 84 // sched_getaffinity(), sched_getattr(), sched_getparam(), sched_getscheduler(), |
84 // sched_rr_get_interval(), sched_setaffinity(), sched_setattr(), | 85 // sched_rr_get_interval(), sched_setaffinity(), sched_setattr(), |
85 // sched_setparam(), sched_setscheduler() | 86 // sched_setparam(), sched_setscheduler() |
86 SANDBOX_EXPORT bpf_dsl::ResultExpr RestrictSchedTarget(pid_t target_pid, | 87 SANDBOX_EXPORT bpf_dsl::ResultExpr RestrictSchedTarget(pid_t target_pid, |
87 int sysno); | 88 int sysno); |
88 | 89 |
89 } // namespace sandbox. | 90 } // namespace sandbox. |
90 | 91 |
91 #endif // SANDBOX_LINUX_SECCOMP_BPF_HELPERS_SYSCALL_PARAMETERS_RESTRICTIONS_H_ | 92 #endif // SANDBOX_LINUX_SECCOMP_BPF_HELPERS_SYSCALL_PARAMETERS_RESTRICTIONS_H_ |
OLD | NEW |