| OLD | NEW |
| 1 // Copyright 2014 The Chromium Authors. All rights reserved. | 1 // Copyright 2014 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "sandbox/linux/bpf_dsl/bpf_dsl.h" | 5 #include "sandbox/linux/bpf_dsl/bpf_dsl.h" |
| 6 | 6 |
| 7 #include <errno.h> | 7 #include <errno.h> |
| 8 | 8 |
| 9 #include <limits> | 9 #include <limits> |
| 10 | 10 |
| 11 #include "base/logging.h" | 11 #include "base/logging.h" |
| 12 #include "base/memory/ref_counted.h" | 12 #include "base/memory/ref_counted.h" |
| 13 #include "sandbox/linux/seccomp-bpf/errorcode.h" | 13 #include "sandbox/linux/seccomp-bpf/errorcode.h" |
| 14 #include "sandbox/linux/seccomp-bpf/sandbox_bpf.h" | 14 #include "sandbox/linux/seccomp-bpf/sandbox_bpf.h" |
| 15 | 15 |
| 16 namespace sandbox { | 16 namespace sandbox { |
| 17 namespace bpf_dsl { | 17 namespace bpf_dsl { |
| 18 namespace { | 18 namespace { |
| 19 | 19 |
| 20 class AllowResultExprImpl : public internal::ResultExprImpl { | 20 class AllowResultExprImpl : public internal::ResultExprImpl { |
| 21 public: | 21 public: |
| 22 AllowResultExprImpl() {} | 22 AllowResultExprImpl() {} |
| 23 | 23 |
| 24 virtual ErrorCode Compile(SandboxBPF* sb) const OVERRIDE { | 24 virtual ErrorCode Compile(SandboxBPF* sb) const override { |
| 25 return ErrorCode(ErrorCode::ERR_ALLOWED); | 25 return ErrorCode(ErrorCode::ERR_ALLOWED); |
| 26 } | 26 } |
| 27 | 27 |
| 28 private: | 28 private: |
| 29 virtual ~AllowResultExprImpl() {} | 29 virtual ~AllowResultExprImpl() {} |
| 30 | 30 |
| 31 DISALLOW_COPY_AND_ASSIGN(AllowResultExprImpl); | 31 DISALLOW_COPY_AND_ASSIGN(AllowResultExprImpl); |
| 32 }; | 32 }; |
| 33 | 33 |
| 34 class ErrorResultExprImpl : public internal::ResultExprImpl { | 34 class ErrorResultExprImpl : public internal::ResultExprImpl { |
| 35 public: | 35 public: |
| 36 explicit ErrorResultExprImpl(int err) : err_(err) { | 36 explicit ErrorResultExprImpl(int err) : err_(err) { |
| 37 CHECK(err_ >= ErrorCode::ERR_MIN_ERRNO && err_ <= ErrorCode::ERR_MAX_ERRNO); | 37 CHECK(err_ >= ErrorCode::ERR_MIN_ERRNO && err_ <= ErrorCode::ERR_MAX_ERRNO); |
| 38 } | 38 } |
| 39 | 39 |
| 40 virtual ErrorCode Compile(SandboxBPF* sb) const OVERRIDE { | 40 virtual ErrorCode Compile(SandboxBPF* sb) const override { |
| 41 return ErrorCode(err_); | 41 return ErrorCode(err_); |
| 42 } | 42 } |
| 43 | 43 |
| 44 private: | 44 private: |
| 45 virtual ~ErrorResultExprImpl() {} | 45 virtual ~ErrorResultExprImpl() {} |
| 46 | 46 |
| 47 int err_; | 47 int err_; |
| 48 | 48 |
| 49 DISALLOW_COPY_AND_ASSIGN(ErrorResultExprImpl); | 49 DISALLOW_COPY_AND_ASSIGN(ErrorResultExprImpl); |
| 50 }; | 50 }; |
| 51 | 51 |
| 52 class KillResultExprImpl : public internal::ResultExprImpl { | 52 class KillResultExprImpl : public internal::ResultExprImpl { |
| 53 public: | 53 public: |
| 54 explicit KillResultExprImpl(const char* msg) : msg_(msg) { DCHECK(msg_); } | 54 explicit KillResultExprImpl(const char* msg) : msg_(msg) { DCHECK(msg_); } |
| 55 | 55 |
| 56 virtual ErrorCode Compile(SandboxBPF* sb) const OVERRIDE { | 56 virtual ErrorCode Compile(SandboxBPF* sb) const override { |
| 57 return sb->Kill(msg_); | 57 return sb->Kill(msg_); |
| 58 } | 58 } |
| 59 | 59 |
| 60 private: | 60 private: |
| 61 virtual ~KillResultExprImpl() {} | 61 virtual ~KillResultExprImpl() {} |
| 62 | 62 |
| 63 const char* msg_; | 63 const char* msg_; |
| 64 | 64 |
| 65 DISALLOW_COPY_AND_ASSIGN(KillResultExprImpl); | 65 DISALLOW_COPY_AND_ASSIGN(KillResultExprImpl); |
| 66 }; | 66 }; |
| 67 | 67 |
| 68 class TraceResultExprImpl : public internal::ResultExprImpl { | 68 class TraceResultExprImpl : public internal::ResultExprImpl { |
| 69 public: | 69 public: |
| 70 TraceResultExprImpl(uint16_t aux) : aux_(aux) {} | 70 TraceResultExprImpl(uint16_t aux) : aux_(aux) {} |
| 71 | 71 |
| 72 virtual ErrorCode Compile(SandboxBPF* sb) const OVERRIDE { | 72 virtual ErrorCode Compile(SandboxBPF* sb) const override { |
| 73 return ErrorCode(ErrorCode::ERR_TRACE + aux_); | 73 return ErrorCode(ErrorCode::ERR_TRACE + aux_); |
| 74 } | 74 } |
| 75 | 75 |
| 76 private: | 76 private: |
| 77 virtual ~TraceResultExprImpl() {} | 77 virtual ~TraceResultExprImpl() {} |
| 78 | 78 |
| 79 uint16_t aux_; | 79 uint16_t aux_; |
| 80 | 80 |
| 81 DISALLOW_COPY_AND_ASSIGN(TraceResultExprImpl); | 81 DISALLOW_COPY_AND_ASSIGN(TraceResultExprImpl); |
| 82 }; | 82 }; |
| 83 | 83 |
| 84 class TrapResultExprImpl : public internal::ResultExprImpl { | 84 class TrapResultExprImpl : public internal::ResultExprImpl { |
| 85 public: | 85 public: |
| 86 TrapResultExprImpl(Trap::TrapFnc func, const void* arg) | 86 TrapResultExprImpl(Trap::TrapFnc func, const void* arg) |
| 87 : func_(func), arg_(arg) { | 87 : func_(func), arg_(arg) { |
| 88 DCHECK(func_); | 88 DCHECK(func_); |
| 89 } | 89 } |
| 90 | 90 |
| 91 virtual ErrorCode Compile(SandboxBPF* sb) const OVERRIDE { | 91 virtual ErrorCode Compile(SandboxBPF* sb) const override { |
| 92 return sb->Trap(func_, arg_); | 92 return sb->Trap(func_, arg_); |
| 93 } | 93 } |
| 94 | 94 |
| 95 private: | 95 private: |
| 96 virtual ~TrapResultExprImpl() {} | 96 virtual ~TrapResultExprImpl() {} |
| 97 | 97 |
| 98 Trap::TrapFnc func_; | 98 Trap::TrapFnc func_; |
| 99 const void* arg_; | 99 const void* arg_; |
| 100 | 100 |
| 101 DISALLOW_COPY_AND_ASSIGN(TrapResultExprImpl); | 101 DISALLOW_COPY_AND_ASSIGN(TrapResultExprImpl); |
| 102 }; | 102 }; |
| 103 | 103 |
| 104 class UnsafeTrapResultExprImpl : public internal::ResultExprImpl { | 104 class UnsafeTrapResultExprImpl : public internal::ResultExprImpl { |
| 105 public: | 105 public: |
| 106 UnsafeTrapResultExprImpl(Trap::TrapFnc func, const void* arg) | 106 UnsafeTrapResultExprImpl(Trap::TrapFnc func, const void* arg) |
| 107 : func_(func), arg_(arg) { | 107 : func_(func), arg_(arg) { |
| 108 DCHECK(func_); | 108 DCHECK(func_); |
| 109 } | 109 } |
| 110 | 110 |
| 111 virtual ErrorCode Compile(SandboxBPF* sb) const OVERRIDE { | 111 virtual ErrorCode Compile(SandboxBPF* sb) const override { |
| 112 return sb->UnsafeTrap(func_, arg_); | 112 return sb->UnsafeTrap(func_, arg_); |
| 113 } | 113 } |
| 114 | 114 |
| 115 private: | 115 private: |
| 116 virtual ~UnsafeTrapResultExprImpl() {} | 116 virtual ~UnsafeTrapResultExprImpl() {} |
| 117 | 117 |
| 118 Trap::TrapFnc func_; | 118 Trap::TrapFnc func_; |
| 119 const void* arg_; | 119 const void* arg_; |
| 120 | 120 |
| 121 DISALLOW_COPY_AND_ASSIGN(UnsafeTrapResultExprImpl); | 121 DISALLOW_COPY_AND_ASSIGN(UnsafeTrapResultExprImpl); |
| 122 }; | 122 }; |
| 123 | 123 |
| 124 class IfThenResultExprImpl : public internal::ResultExprImpl { | 124 class IfThenResultExprImpl : public internal::ResultExprImpl { |
| 125 public: | 125 public: |
| 126 IfThenResultExprImpl(const BoolExpr& cond, | 126 IfThenResultExprImpl(const BoolExpr& cond, |
| 127 const ResultExpr& then_result, | 127 const ResultExpr& then_result, |
| 128 const ResultExpr& else_result) | 128 const ResultExpr& else_result) |
| 129 : cond_(cond), then_result_(then_result), else_result_(else_result) {} | 129 : cond_(cond), then_result_(then_result), else_result_(else_result) {} |
| 130 | 130 |
| 131 virtual ErrorCode Compile(SandboxBPF* sb) const OVERRIDE { | 131 virtual ErrorCode Compile(SandboxBPF* sb) const override { |
| 132 return cond_->Compile( | 132 return cond_->Compile( |
| 133 sb, then_result_->Compile(sb), else_result_->Compile(sb)); | 133 sb, then_result_->Compile(sb), else_result_->Compile(sb)); |
| 134 } | 134 } |
| 135 | 135 |
| 136 private: | 136 private: |
| 137 virtual ~IfThenResultExprImpl() {} | 137 virtual ~IfThenResultExprImpl() {} |
| 138 | 138 |
| 139 BoolExpr cond_; | 139 BoolExpr cond_; |
| 140 ResultExpr then_result_; | 140 ResultExpr then_result_; |
| 141 ResultExpr else_result_; | 141 ResultExpr else_result_; |
| 142 | 142 |
| 143 DISALLOW_COPY_AND_ASSIGN(IfThenResultExprImpl); | 143 DISALLOW_COPY_AND_ASSIGN(IfThenResultExprImpl); |
| 144 }; | 144 }; |
| 145 | 145 |
| 146 class ConstBoolExprImpl : public internal::BoolExprImpl { | 146 class ConstBoolExprImpl : public internal::BoolExprImpl { |
| 147 public: | 147 public: |
| 148 ConstBoolExprImpl(bool value) : value_(value) {} | 148 ConstBoolExprImpl(bool value) : value_(value) {} |
| 149 | 149 |
| 150 virtual ErrorCode Compile(SandboxBPF* sb, | 150 virtual ErrorCode Compile(SandboxBPF* sb, |
| 151 ErrorCode true_ec, | 151 ErrorCode true_ec, |
| 152 ErrorCode false_ec) const OVERRIDE { | 152 ErrorCode false_ec) const override { |
| 153 return value_ ? true_ec : false_ec; | 153 return value_ ? true_ec : false_ec; |
| 154 } | 154 } |
| 155 | 155 |
| 156 private: | 156 private: |
| 157 virtual ~ConstBoolExprImpl() {} | 157 virtual ~ConstBoolExprImpl() {} |
| 158 | 158 |
| 159 bool value_; | 159 bool value_; |
| 160 | 160 |
| 161 DISALLOW_COPY_AND_ASSIGN(ConstBoolExprImpl); | 161 DISALLOW_COPY_AND_ASSIGN(ConstBoolExprImpl); |
| 162 }; | 162 }; |
| 163 | 163 |
| 164 class PrimitiveBoolExprImpl : public internal::BoolExprImpl { | 164 class PrimitiveBoolExprImpl : public internal::BoolExprImpl { |
| 165 public: | 165 public: |
| 166 PrimitiveBoolExprImpl(int argno, | 166 PrimitiveBoolExprImpl(int argno, |
| 167 ErrorCode::ArgType is_32bit, | 167 ErrorCode::ArgType is_32bit, |
| 168 uint64_t mask, | 168 uint64_t mask, |
| 169 uint64_t value) | 169 uint64_t value) |
| 170 : argno_(argno), is_32bit_(is_32bit), mask_(mask), value_(value) {} | 170 : argno_(argno), is_32bit_(is_32bit), mask_(mask), value_(value) {} |
| 171 | 171 |
| 172 virtual ErrorCode Compile(SandboxBPF* sb, | 172 virtual ErrorCode Compile(SandboxBPF* sb, |
| 173 ErrorCode true_ec, | 173 ErrorCode true_ec, |
| 174 ErrorCode false_ec) const OVERRIDE { | 174 ErrorCode false_ec) const override { |
| 175 return sb->CondMaskedEqual( | 175 return sb->CondMaskedEqual( |
| 176 argno_, is_32bit_, mask_, value_, true_ec, false_ec); | 176 argno_, is_32bit_, mask_, value_, true_ec, false_ec); |
| 177 } | 177 } |
| 178 | 178 |
| 179 private: | 179 private: |
| 180 virtual ~PrimitiveBoolExprImpl() {} | 180 virtual ~PrimitiveBoolExprImpl() {} |
| 181 | 181 |
| 182 int argno_; | 182 int argno_; |
| 183 ErrorCode::ArgType is_32bit_; | 183 ErrorCode::ArgType is_32bit_; |
| 184 uint64_t mask_; | 184 uint64_t mask_; |
| 185 uint64_t value_; | 185 uint64_t value_; |
| 186 | 186 |
| 187 DISALLOW_COPY_AND_ASSIGN(PrimitiveBoolExprImpl); | 187 DISALLOW_COPY_AND_ASSIGN(PrimitiveBoolExprImpl); |
| 188 }; | 188 }; |
| 189 | 189 |
| 190 class NegateBoolExprImpl : public internal::BoolExprImpl { | 190 class NegateBoolExprImpl : public internal::BoolExprImpl { |
| 191 public: | 191 public: |
| 192 explicit NegateBoolExprImpl(const BoolExpr& cond) : cond_(cond) {} | 192 explicit NegateBoolExprImpl(const BoolExpr& cond) : cond_(cond) {} |
| 193 | 193 |
| 194 virtual ErrorCode Compile(SandboxBPF* sb, | 194 virtual ErrorCode Compile(SandboxBPF* sb, |
| 195 ErrorCode true_ec, | 195 ErrorCode true_ec, |
| 196 ErrorCode false_ec) const OVERRIDE { | 196 ErrorCode false_ec) const override { |
| 197 return cond_->Compile(sb, false_ec, true_ec); | 197 return cond_->Compile(sb, false_ec, true_ec); |
| 198 } | 198 } |
| 199 | 199 |
| 200 private: | 200 private: |
| 201 virtual ~NegateBoolExprImpl() {} | 201 virtual ~NegateBoolExprImpl() {} |
| 202 | 202 |
| 203 BoolExpr cond_; | 203 BoolExpr cond_; |
| 204 | 204 |
| 205 DISALLOW_COPY_AND_ASSIGN(NegateBoolExprImpl); | 205 DISALLOW_COPY_AND_ASSIGN(NegateBoolExprImpl); |
| 206 }; | 206 }; |
| 207 | 207 |
| 208 class AndBoolExprImpl : public internal::BoolExprImpl { | 208 class AndBoolExprImpl : public internal::BoolExprImpl { |
| 209 public: | 209 public: |
| 210 AndBoolExprImpl(const BoolExpr& lhs, const BoolExpr& rhs) | 210 AndBoolExprImpl(const BoolExpr& lhs, const BoolExpr& rhs) |
| 211 : lhs_(lhs), rhs_(rhs) {} | 211 : lhs_(lhs), rhs_(rhs) {} |
| 212 | 212 |
| 213 virtual ErrorCode Compile(SandboxBPF* sb, | 213 virtual ErrorCode Compile(SandboxBPF* sb, |
| 214 ErrorCode true_ec, | 214 ErrorCode true_ec, |
| 215 ErrorCode false_ec) const OVERRIDE { | 215 ErrorCode false_ec) const override { |
| 216 return lhs_->Compile(sb, rhs_->Compile(sb, true_ec, false_ec), false_ec); | 216 return lhs_->Compile(sb, rhs_->Compile(sb, true_ec, false_ec), false_ec); |
| 217 } | 217 } |
| 218 | 218 |
| 219 private: | 219 private: |
| 220 virtual ~AndBoolExprImpl() {} | 220 virtual ~AndBoolExprImpl() {} |
| 221 | 221 |
| 222 BoolExpr lhs_; | 222 BoolExpr lhs_; |
| 223 BoolExpr rhs_; | 223 BoolExpr rhs_; |
| 224 | 224 |
| 225 DISALLOW_COPY_AND_ASSIGN(AndBoolExprImpl); | 225 DISALLOW_COPY_AND_ASSIGN(AndBoolExprImpl); |
| 226 }; | 226 }; |
| 227 | 227 |
| 228 class OrBoolExprImpl : public internal::BoolExprImpl { | 228 class OrBoolExprImpl : public internal::BoolExprImpl { |
| 229 public: | 229 public: |
| 230 OrBoolExprImpl(const BoolExpr& lhs, const BoolExpr& rhs) | 230 OrBoolExprImpl(const BoolExpr& lhs, const BoolExpr& rhs) |
| 231 : lhs_(lhs), rhs_(rhs) {} | 231 : lhs_(lhs), rhs_(rhs) {} |
| 232 | 232 |
| 233 virtual ErrorCode Compile(SandboxBPF* sb, | 233 virtual ErrorCode Compile(SandboxBPF* sb, |
| 234 ErrorCode true_ec, | 234 ErrorCode true_ec, |
| 235 ErrorCode false_ec) const OVERRIDE { | 235 ErrorCode false_ec) const override { |
| 236 return lhs_->Compile(sb, true_ec, rhs_->Compile(sb, true_ec, false_ec)); | 236 return lhs_->Compile(sb, true_ec, rhs_->Compile(sb, true_ec, false_ec)); |
| 237 } | 237 } |
| 238 | 238 |
| 239 private: | 239 private: |
| 240 virtual ~OrBoolExprImpl() {} | 240 virtual ~OrBoolExprImpl() {} |
| 241 | 241 |
| 242 BoolExpr lhs_; | 242 BoolExpr lhs_; |
| 243 BoolExpr rhs_; | 243 BoolExpr rhs_; |
| 244 | 244 |
| 245 DISALLOW_COPY_AND_ASSIGN(OrBoolExprImpl); | 245 DISALLOW_COPY_AND_ASSIGN(OrBoolExprImpl); |
| (...skipping 129 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 375 ErrorCode SandboxBPFDSLPolicy::InvalidSyscall(SandboxBPF* sb) const { | 375 ErrorCode SandboxBPFDSLPolicy::InvalidSyscall(SandboxBPF* sb) const { |
| 376 return InvalidSyscall()->Compile(sb); | 376 return InvalidSyscall()->Compile(sb); |
| 377 } | 377 } |
| 378 | 378 |
| 379 ResultExpr SandboxBPFDSLPolicy::Trap(Trap::TrapFnc trap_func, const void* aux) { | 379 ResultExpr SandboxBPFDSLPolicy::Trap(Trap::TrapFnc trap_func, const void* aux) { |
| 380 return bpf_dsl::Trap(trap_func, aux); | 380 return bpf_dsl::Trap(trap_func, aux); |
| 381 } | 381 } |
| 382 | 382 |
| 383 } // namespace bpf_dsl | 383 } // namespace bpf_dsl |
| 384 } // namespace sandbox | 384 } // namespace sandbox |
| OLD | NEW |