OLD | NEW |
1 // Copyright 2014 The Chromium Authors. All rights reserved. | 1 // Copyright 2014 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "sandbox/linux/bpf_dsl/bpf_dsl.h" | 5 #include "sandbox/linux/bpf_dsl/bpf_dsl.h" |
6 | 6 |
7 #include <errno.h> | 7 #include <errno.h> |
8 | 8 |
9 #include <limits> | 9 #include <limits> |
10 | 10 |
11 #include "base/logging.h" | 11 #include "base/logging.h" |
12 #include "base/memory/ref_counted.h" | 12 #include "base/memory/ref_counted.h" |
13 #include "sandbox/linux/seccomp-bpf/errorcode.h" | 13 #include "sandbox/linux/seccomp-bpf/errorcode.h" |
14 #include "sandbox/linux/seccomp-bpf/sandbox_bpf.h" | 14 #include "sandbox/linux/seccomp-bpf/sandbox_bpf.h" |
15 | 15 |
16 namespace sandbox { | 16 namespace sandbox { |
17 namespace bpf_dsl { | 17 namespace bpf_dsl { |
18 namespace { | 18 namespace { |
19 | 19 |
20 class AllowResultExprImpl : public internal::ResultExprImpl { | 20 class AllowResultExprImpl : public internal::ResultExprImpl { |
21 public: | 21 public: |
22 AllowResultExprImpl() {} | 22 AllowResultExprImpl() {} |
23 | 23 |
24 virtual ErrorCode Compile(SandboxBPF* sb) const OVERRIDE { | 24 virtual ErrorCode Compile(SandboxBPF* sb) const override { |
25 return ErrorCode(ErrorCode::ERR_ALLOWED); | 25 return ErrorCode(ErrorCode::ERR_ALLOWED); |
26 } | 26 } |
27 | 27 |
28 private: | 28 private: |
29 virtual ~AllowResultExprImpl() {} | 29 virtual ~AllowResultExprImpl() {} |
30 | 30 |
31 DISALLOW_COPY_AND_ASSIGN(AllowResultExprImpl); | 31 DISALLOW_COPY_AND_ASSIGN(AllowResultExprImpl); |
32 }; | 32 }; |
33 | 33 |
34 class ErrorResultExprImpl : public internal::ResultExprImpl { | 34 class ErrorResultExprImpl : public internal::ResultExprImpl { |
35 public: | 35 public: |
36 explicit ErrorResultExprImpl(int err) : err_(err) { | 36 explicit ErrorResultExprImpl(int err) : err_(err) { |
37 CHECK(err_ >= ErrorCode::ERR_MIN_ERRNO && err_ <= ErrorCode::ERR_MAX_ERRNO); | 37 CHECK(err_ >= ErrorCode::ERR_MIN_ERRNO && err_ <= ErrorCode::ERR_MAX_ERRNO); |
38 } | 38 } |
39 | 39 |
40 virtual ErrorCode Compile(SandboxBPF* sb) const OVERRIDE { | 40 virtual ErrorCode Compile(SandboxBPF* sb) const override { |
41 return ErrorCode(err_); | 41 return ErrorCode(err_); |
42 } | 42 } |
43 | 43 |
44 private: | 44 private: |
45 virtual ~ErrorResultExprImpl() {} | 45 virtual ~ErrorResultExprImpl() {} |
46 | 46 |
47 int err_; | 47 int err_; |
48 | 48 |
49 DISALLOW_COPY_AND_ASSIGN(ErrorResultExprImpl); | 49 DISALLOW_COPY_AND_ASSIGN(ErrorResultExprImpl); |
50 }; | 50 }; |
51 | 51 |
52 class KillResultExprImpl : public internal::ResultExprImpl { | 52 class KillResultExprImpl : public internal::ResultExprImpl { |
53 public: | 53 public: |
54 explicit KillResultExprImpl(const char* msg) : msg_(msg) { DCHECK(msg_); } | 54 explicit KillResultExprImpl(const char* msg) : msg_(msg) { DCHECK(msg_); } |
55 | 55 |
56 virtual ErrorCode Compile(SandboxBPF* sb) const OVERRIDE { | 56 virtual ErrorCode Compile(SandboxBPF* sb) const override { |
57 return sb->Kill(msg_); | 57 return sb->Kill(msg_); |
58 } | 58 } |
59 | 59 |
60 private: | 60 private: |
61 virtual ~KillResultExprImpl() {} | 61 virtual ~KillResultExprImpl() {} |
62 | 62 |
63 const char* msg_; | 63 const char* msg_; |
64 | 64 |
65 DISALLOW_COPY_AND_ASSIGN(KillResultExprImpl); | 65 DISALLOW_COPY_AND_ASSIGN(KillResultExprImpl); |
66 }; | 66 }; |
67 | 67 |
68 class TraceResultExprImpl : public internal::ResultExprImpl { | 68 class TraceResultExprImpl : public internal::ResultExprImpl { |
69 public: | 69 public: |
70 TraceResultExprImpl(uint16_t aux) : aux_(aux) {} | 70 TraceResultExprImpl(uint16_t aux) : aux_(aux) {} |
71 | 71 |
72 virtual ErrorCode Compile(SandboxBPF* sb) const OVERRIDE { | 72 virtual ErrorCode Compile(SandboxBPF* sb) const override { |
73 return ErrorCode(ErrorCode::ERR_TRACE + aux_); | 73 return ErrorCode(ErrorCode::ERR_TRACE + aux_); |
74 } | 74 } |
75 | 75 |
76 private: | 76 private: |
77 virtual ~TraceResultExprImpl() {} | 77 virtual ~TraceResultExprImpl() {} |
78 | 78 |
79 uint16_t aux_; | 79 uint16_t aux_; |
80 | 80 |
81 DISALLOW_COPY_AND_ASSIGN(TraceResultExprImpl); | 81 DISALLOW_COPY_AND_ASSIGN(TraceResultExprImpl); |
82 }; | 82 }; |
83 | 83 |
84 class TrapResultExprImpl : public internal::ResultExprImpl { | 84 class TrapResultExprImpl : public internal::ResultExprImpl { |
85 public: | 85 public: |
86 TrapResultExprImpl(Trap::TrapFnc func, const void* arg) | 86 TrapResultExprImpl(Trap::TrapFnc func, const void* arg) |
87 : func_(func), arg_(arg) { | 87 : func_(func), arg_(arg) { |
88 DCHECK(func_); | 88 DCHECK(func_); |
89 } | 89 } |
90 | 90 |
91 virtual ErrorCode Compile(SandboxBPF* sb) const OVERRIDE { | 91 virtual ErrorCode Compile(SandboxBPF* sb) const override { |
92 return sb->Trap(func_, arg_); | 92 return sb->Trap(func_, arg_); |
93 } | 93 } |
94 | 94 |
95 private: | 95 private: |
96 virtual ~TrapResultExprImpl() {} | 96 virtual ~TrapResultExprImpl() {} |
97 | 97 |
98 Trap::TrapFnc func_; | 98 Trap::TrapFnc func_; |
99 const void* arg_; | 99 const void* arg_; |
100 | 100 |
101 DISALLOW_COPY_AND_ASSIGN(TrapResultExprImpl); | 101 DISALLOW_COPY_AND_ASSIGN(TrapResultExprImpl); |
102 }; | 102 }; |
103 | 103 |
104 class UnsafeTrapResultExprImpl : public internal::ResultExprImpl { | 104 class UnsafeTrapResultExprImpl : public internal::ResultExprImpl { |
105 public: | 105 public: |
106 UnsafeTrapResultExprImpl(Trap::TrapFnc func, const void* arg) | 106 UnsafeTrapResultExprImpl(Trap::TrapFnc func, const void* arg) |
107 : func_(func), arg_(arg) { | 107 : func_(func), arg_(arg) { |
108 DCHECK(func_); | 108 DCHECK(func_); |
109 } | 109 } |
110 | 110 |
111 virtual ErrorCode Compile(SandboxBPF* sb) const OVERRIDE { | 111 virtual ErrorCode Compile(SandboxBPF* sb) const override { |
112 return sb->UnsafeTrap(func_, arg_); | 112 return sb->UnsafeTrap(func_, arg_); |
113 } | 113 } |
114 | 114 |
115 private: | 115 private: |
116 virtual ~UnsafeTrapResultExprImpl() {} | 116 virtual ~UnsafeTrapResultExprImpl() {} |
117 | 117 |
118 Trap::TrapFnc func_; | 118 Trap::TrapFnc func_; |
119 const void* arg_; | 119 const void* arg_; |
120 | 120 |
121 DISALLOW_COPY_AND_ASSIGN(UnsafeTrapResultExprImpl); | 121 DISALLOW_COPY_AND_ASSIGN(UnsafeTrapResultExprImpl); |
122 }; | 122 }; |
123 | 123 |
124 class IfThenResultExprImpl : public internal::ResultExprImpl { | 124 class IfThenResultExprImpl : public internal::ResultExprImpl { |
125 public: | 125 public: |
126 IfThenResultExprImpl(const BoolExpr& cond, | 126 IfThenResultExprImpl(const BoolExpr& cond, |
127 const ResultExpr& then_result, | 127 const ResultExpr& then_result, |
128 const ResultExpr& else_result) | 128 const ResultExpr& else_result) |
129 : cond_(cond), then_result_(then_result), else_result_(else_result) {} | 129 : cond_(cond), then_result_(then_result), else_result_(else_result) {} |
130 | 130 |
131 virtual ErrorCode Compile(SandboxBPF* sb) const OVERRIDE { | 131 virtual ErrorCode Compile(SandboxBPF* sb) const override { |
132 return cond_->Compile( | 132 return cond_->Compile( |
133 sb, then_result_->Compile(sb), else_result_->Compile(sb)); | 133 sb, then_result_->Compile(sb), else_result_->Compile(sb)); |
134 } | 134 } |
135 | 135 |
136 private: | 136 private: |
137 virtual ~IfThenResultExprImpl() {} | 137 virtual ~IfThenResultExprImpl() {} |
138 | 138 |
139 BoolExpr cond_; | 139 BoolExpr cond_; |
140 ResultExpr then_result_; | 140 ResultExpr then_result_; |
141 ResultExpr else_result_; | 141 ResultExpr else_result_; |
142 | 142 |
143 DISALLOW_COPY_AND_ASSIGN(IfThenResultExprImpl); | 143 DISALLOW_COPY_AND_ASSIGN(IfThenResultExprImpl); |
144 }; | 144 }; |
145 | 145 |
146 class ConstBoolExprImpl : public internal::BoolExprImpl { | 146 class ConstBoolExprImpl : public internal::BoolExprImpl { |
147 public: | 147 public: |
148 ConstBoolExprImpl(bool value) : value_(value) {} | 148 ConstBoolExprImpl(bool value) : value_(value) {} |
149 | 149 |
150 virtual ErrorCode Compile(SandboxBPF* sb, | 150 virtual ErrorCode Compile(SandboxBPF* sb, |
151 ErrorCode true_ec, | 151 ErrorCode true_ec, |
152 ErrorCode false_ec) const OVERRIDE { | 152 ErrorCode false_ec) const override { |
153 return value_ ? true_ec : false_ec; | 153 return value_ ? true_ec : false_ec; |
154 } | 154 } |
155 | 155 |
156 private: | 156 private: |
157 virtual ~ConstBoolExprImpl() {} | 157 virtual ~ConstBoolExprImpl() {} |
158 | 158 |
159 bool value_; | 159 bool value_; |
160 | 160 |
161 DISALLOW_COPY_AND_ASSIGN(ConstBoolExprImpl); | 161 DISALLOW_COPY_AND_ASSIGN(ConstBoolExprImpl); |
162 }; | 162 }; |
163 | 163 |
164 class PrimitiveBoolExprImpl : public internal::BoolExprImpl { | 164 class PrimitiveBoolExprImpl : public internal::BoolExprImpl { |
165 public: | 165 public: |
166 PrimitiveBoolExprImpl(int argno, | 166 PrimitiveBoolExprImpl(int argno, |
167 ErrorCode::ArgType is_32bit, | 167 ErrorCode::ArgType is_32bit, |
168 uint64_t mask, | 168 uint64_t mask, |
169 uint64_t value) | 169 uint64_t value) |
170 : argno_(argno), is_32bit_(is_32bit), mask_(mask), value_(value) {} | 170 : argno_(argno), is_32bit_(is_32bit), mask_(mask), value_(value) {} |
171 | 171 |
172 virtual ErrorCode Compile(SandboxBPF* sb, | 172 virtual ErrorCode Compile(SandboxBPF* sb, |
173 ErrorCode true_ec, | 173 ErrorCode true_ec, |
174 ErrorCode false_ec) const OVERRIDE { | 174 ErrorCode false_ec) const override { |
175 return sb->CondMaskedEqual( | 175 return sb->CondMaskedEqual( |
176 argno_, is_32bit_, mask_, value_, true_ec, false_ec); | 176 argno_, is_32bit_, mask_, value_, true_ec, false_ec); |
177 } | 177 } |
178 | 178 |
179 private: | 179 private: |
180 virtual ~PrimitiveBoolExprImpl() {} | 180 virtual ~PrimitiveBoolExprImpl() {} |
181 | 181 |
182 int argno_; | 182 int argno_; |
183 ErrorCode::ArgType is_32bit_; | 183 ErrorCode::ArgType is_32bit_; |
184 uint64_t mask_; | 184 uint64_t mask_; |
185 uint64_t value_; | 185 uint64_t value_; |
186 | 186 |
187 DISALLOW_COPY_AND_ASSIGN(PrimitiveBoolExprImpl); | 187 DISALLOW_COPY_AND_ASSIGN(PrimitiveBoolExprImpl); |
188 }; | 188 }; |
189 | 189 |
190 class NegateBoolExprImpl : public internal::BoolExprImpl { | 190 class NegateBoolExprImpl : public internal::BoolExprImpl { |
191 public: | 191 public: |
192 explicit NegateBoolExprImpl(const BoolExpr& cond) : cond_(cond) {} | 192 explicit NegateBoolExprImpl(const BoolExpr& cond) : cond_(cond) {} |
193 | 193 |
194 virtual ErrorCode Compile(SandboxBPF* sb, | 194 virtual ErrorCode Compile(SandboxBPF* sb, |
195 ErrorCode true_ec, | 195 ErrorCode true_ec, |
196 ErrorCode false_ec) const OVERRIDE { | 196 ErrorCode false_ec) const override { |
197 return cond_->Compile(sb, false_ec, true_ec); | 197 return cond_->Compile(sb, false_ec, true_ec); |
198 } | 198 } |
199 | 199 |
200 private: | 200 private: |
201 virtual ~NegateBoolExprImpl() {} | 201 virtual ~NegateBoolExprImpl() {} |
202 | 202 |
203 BoolExpr cond_; | 203 BoolExpr cond_; |
204 | 204 |
205 DISALLOW_COPY_AND_ASSIGN(NegateBoolExprImpl); | 205 DISALLOW_COPY_AND_ASSIGN(NegateBoolExprImpl); |
206 }; | 206 }; |
207 | 207 |
208 class AndBoolExprImpl : public internal::BoolExprImpl { | 208 class AndBoolExprImpl : public internal::BoolExprImpl { |
209 public: | 209 public: |
210 AndBoolExprImpl(const BoolExpr& lhs, const BoolExpr& rhs) | 210 AndBoolExprImpl(const BoolExpr& lhs, const BoolExpr& rhs) |
211 : lhs_(lhs), rhs_(rhs) {} | 211 : lhs_(lhs), rhs_(rhs) {} |
212 | 212 |
213 virtual ErrorCode Compile(SandboxBPF* sb, | 213 virtual ErrorCode Compile(SandboxBPF* sb, |
214 ErrorCode true_ec, | 214 ErrorCode true_ec, |
215 ErrorCode false_ec) const OVERRIDE { | 215 ErrorCode false_ec) const override { |
216 return lhs_->Compile(sb, rhs_->Compile(sb, true_ec, false_ec), false_ec); | 216 return lhs_->Compile(sb, rhs_->Compile(sb, true_ec, false_ec), false_ec); |
217 } | 217 } |
218 | 218 |
219 private: | 219 private: |
220 virtual ~AndBoolExprImpl() {} | 220 virtual ~AndBoolExprImpl() {} |
221 | 221 |
222 BoolExpr lhs_; | 222 BoolExpr lhs_; |
223 BoolExpr rhs_; | 223 BoolExpr rhs_; |
224 | 224 |
225 DISALLOW_COPY_AND_ASSIGN(AndBoolExprImpl); | 225 DISALLOW_COPY_AND_ASSIGN(AndBoolExprImpl); |
226 }; | 226 }; |
227 | 227 |
228 class OrBoolExprImpl : public internal::BoolExprImpl { | 228 class OrBoolExprImpl : public internal::BoolExprImpl { |
229 public: | 229 public: |
230 OrBoolExprImpl(const BoolExpr& lhs, const BoolExpr& rhs) | 230 OrBoolExprImpl(const BoolExpr& lhs, const BoolExpr& rhs) |
231 : lhs_(lhs), rhs_(rhs) {} | 231 : lhs_(lhs), rhs_(rhs) {} |
232 | 232 |
233 virtual ErrorCode Compile(SandboxBPF* sb, | 233 virtual ErrorCode Compile(SandboxBPF* sb, |
234 ErrorCode true_ec, | 234 ErrorCode true_ec, |
235 ErrorCode false_ec) const OVERRIDE { | 235 ErrorCode false_ec) const override { |
236 return lhs_->Compile(sb, true_ec, rhs_->Compile(sb, true_ec, false_ec)); | 236 return lhs_->Compile(sb, true_ec, rhs_->Compile(sb, true_ec, false_ec)); |
237 } | 237 } |
238 | 238 |
239 private: | 239 private: |
240 virtual ~OrBoolExprImpl() {} | 240 virtual ~OrBoolExprImpl() {} |
241 | 241 |
242 BoolExpr lhs_; | 242 BoolExpr lhs_; |
243 BoolExpr rhs_; | 243 BoolExpr rhs_; |
244 | 244 |
245 DISALLOW_COPY_AND_ASSIGN(OrBoolExprImpl); | 245 DISALLOW_COPY_AND_ASSIGN(OrBoolExprImpl); |
(...skipping 129 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
375 ErrorCode SandboxBPFDSLPolicy::InvalidSyscall(SandboxBPF* sb) const { | 375 ErrorCode SandboxBPFDSLPolicy::InvalidSyscall(SandboxBPF* sb) const { |
376 return InvalidSyscall()->Compile(sb); | 376 return InvalidSyscall()->Compile(sb); |
377 } | 377 } |
378 | 378 |
379 ResultExpr SandboxBPFDSLPolicy::Trap(Trap::TrapFnc trap_func, const void* aux) { | 379 ResultExpr SandboxBPFDSLPolicy::Trap(Trap::TrapFnc trap_func, const void* aux) { |
380 return bpf_dsl::Trap(trap_func, aux); | 380 return bpf_dsl::Trap(trap_func, aux); |
381 } | 381 } |
382 | 382 |
383 } // namespace bpf_dsl | 383 } // namespace bpf_dsl |
384 } // namespace sandbox | 384 } // namespace sandbox |
OLD | NEW |