| OLD | NEW |
| 1 // Copyright 2014 The Chromium Authors. All rights reserved. | 1 // Copyright 2014 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #ifndef SANDBOX_LINUX_BPF_DSL_BPF_DSL_H_ | 5 #ifndef SANDBOX_LINUX_BPF_DSL_BPF_DSL_H_ |
| 6 #define SANDBOX_LINUX_BPF_DSL_BPF_DSL_H_ | 6 #define SANDBOX_LINUX_BPF_DSL_BPF_DSL_H_ |
| 7 | 7 |
| 8 #include <stdint.h> | 8 #include <stdint.h> |
| 9 | 9 |
| 10 #include <utility> | 10 #include <utility> |
| (...skipping 21 matching lines...) Expand all Loading... |
| 32 // would be: | 32 // would be: |
| 33 // | 33 // |
| 34 // #include "sandbox/linux/bpf_dsl/bpf_dsl.h" | 34 // #include "sandbox/linux/bpf_dsl/bpf_dsl.h" |
| 35 // | 35 // |
| 36 // using namespace sandbox::bpf_dsl; | 36 // using namespace sandbox::bpf_dsl; |
| 37 // | 37 // |
| 38 // class SillyPolicy : public SandboxBPFDSLPolicy { | 38 // class SillyPolicy : public SandboxBPFDSLPolicy { |
| 39 // public: | 39 // public: |
| 40 // SillyPolicy() {} | 40 // SillyPolicy() {} |
| 41 // virtual ~SillyPolicy() {} | 41 // virtual ~SillyPolicy() {} |
| 42 // virtual ResultExpr EvaluateSyscall(int sysno) const OVERRIDE { | 42 // virtual ResultExpr EvaluateSyscall(int sysno) const override { |
| 43 // if (sysno == __NR_fcntl) { | 43 // if (sysno == __NR_fcntl) { |
| 44 // Arg<int> fd(0), cmd(1); | 44 // Arg<int> fd(0), cmd(1); |
| 45 // Arg<unsigned long> flags(2); | 45 // Arg<unsigned long> flags(2); |
| 46 // const uint64_t kGoodFlags = O_ACCMODE | O_NONBLOCK; | 46 // const uint64_t kGoodFlags = O_ACCMODE | O_NONBLOCK; |
| 47 // return If(fd == 0 && cmd == F_SETFL && (flags & ~kGoodFlags) == 0, | 47 // return If(fd == 0 && cmd == F_SETFL && (flags & ~kGoodFlags) == 0, |
| 48 // Allow()) | 48 // Allow()) |
| 49 // .ElseIf(cmd == F_DUPFD || cmd == F_DUPFD_CLOEXEC, | 49 // .ElseIf(cmd == F_DUPFD || cmd == F_DUPFD_CLOEXEC, |
| 50 // Error(EMFILE)) | 50 // Error(EMFILE)) |
| 51 // .Else(Trap(SetFlagHandler, NULL)); | 51 // .Else(Trap(SetFlagHandler, NULL)); |
| 52 // } else { | 52 // } else { |
| (...skipping 46 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 99 SandboxBPFDSLPolicy() : SandboxBPFPolicy() {} | 99 SandboxBPFDSLPolicy() : SandboxBPFPolicy() {} |
| 100 virtual ~SandboxBPFDSLPolicy() {} | 100 virtual ~SandboxBPFDSLPolicy() {} |
| 101 | 101 |
| 102 // User extension point for writing custom sandbox policies. | 102 // User extension point for writing custom sandbox policies. |
| 103 virtual ResultExpr EvaluateSyscall(int sysno) const = 0; | 103 virtual ResultExpr EvaluateSyscall(int sysno) const = 0; |
| 104 | 104 |
| 105 // Optional overload for specifying alternate behavior for invalid | 105 // Optional overload for specifying alternate behavior for invalid |
| 106 // system calls. The default is to return ENOSYS. | 106 // system calls. The default is to return ENOSYS. |
| 107 virtual ResultExpr InvalidSyscall() const; | 107 virtual ResultExpr InvalidSyscall() const; |
| 108 | 108 |
| 109 // Override implementations from SandboxBPFPolicy. Marked as FINAL | 109 // Override implementations from SandboxBPFPolicy. Marked as final |
| 110 // to prevent mixups with child classes accidentally overloading | 110 // to prevent mixups with child classes accidentally overloading |
| 111 // these instead of the above methods. | 111 // these instead of the above methods. |
| 112 virtual ErrorCode EvaluateSyscall(SandboxBPF* sb, | 112 virtual ErrorCode EvaluateSyscall(SandboxBPF* sb, |
| 113 int sysno) const OVERRIDE FINAL; | 113 int sysno) const override final; |
| 114 virtual ErrorCode InvalidSyscall(SandboxBPF* sb) const OVERRIDE FINAL; | 114 virtual ErrorCode InvalidSyscall(SandboxBPF* sb) const override final; |
| 115 | 115 |
| 116 // Helper method so policies can just write Trap(func, aux). | 116 // Helper method so policies can just write Trap(func, aux). |
| 117 static ResultExpr Trap(Trap::TrapFnc trap_func, const void* aux); | 117 static ResultExpr Trap(Trap::TrapFnc trap_func, const void* aux); |
| 118 | 118 |
| 119 private: | 119 private: |
| 120 DISALLOW_COPY_AND_ASSIGN(SandboxBPFDSLPolicy); | 120 DISALLOW_COPY_AND_ASSIGN(SandboxBPFDSLPolicy); |
| 121 }; | 121 }; |
| 122 | 122 |
| 123 // Allow specifies a result that the system call should be allowed to | 123 // Allow specifies a result that the system call should be allowed to |
| 124 // execute normally. | 124 // execute normally. |
| (...skipping 255 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 380 | 380 |
| 381 template <typename T> | 381 template <typename T> |
| 382 ResultExpr Caser<T>::Default(ResultExpr result) const { | 382 ResultExpr Caser<T>::Default(ResultExpr result) const { |
| 383 return elser_.Else(result); | 383 return elser_.Else(result); |
| 384 } | 384 } |
| 385 | 385 |
| 386 } // namespace bpf_dsl | 386 } // namespace bpf_dsl |
| 387 } // namespace sandbox | 387 } // namespace sandbox |
| 388 | 388 |
| 389 #endif // SANDBOX_LINUX_BPF_DSL_BPF_DSL_H_ | 389 #endif // SANDBOX_LINUX_BPF_DSL_BPF_DSL_H_ |
| OLD | NEW |