OLD | NEW |
1 // Copyright 2014 The Chromium Authors. All rights reserved. | 1 // Copyright 2014 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #ifndef SANDBOX_LINUX_BPF_DSL_BPF_DSL_H_ | 5 #ifndef SANDBOX_LINUX_BPF_DSL_BPF_DSL_H_ |
6 #define SANDBOX_LINUX_BPF_DSL_BPF_DSL_H_ | 6 #define SANDBOX_LINUX_BPF_DSL_BPF_DSL_H_ |
7 | 7 |
8 #include <stdint.h> | 8 #include <stdint.h> |
9 | 9 |
10 #include <utility> | 10 #include <utility> |
(...skipping 21 matching lines...) Expand all Loading... |
32 // would be: | 32 // would be: |
33 // | 33 // |
34 // #include "sandbox/linux/bpf_dsl/bpf_dsl.h" | 34 // #include "sandbox/linux/bpf_dsl/bpf_dsl.h" |
35 // | 35 // |
36 // using namespace sandbox::bpf_dsl; | 36 // using namespace sandbox::bpf_dsl; |
37 // | 37 // |
38 // class SillyPolicy : public SandboxBPFDSLPolicy { | 38 // class SillyPolicy : public SandboxBPFDSLPolicy { |
39 // public: | 39 // public: |
40 // SillyPolicy() {} | 40 // SillyPolicy() {} |
41 // virtual ~SillyPolicy() {} | 41 // virtual ~SillyPolicy() {} |
42 // virtual ResultExpr EvaluateSyscall(int sysno) const OVERRIDE { | 42 // virtual ResultExpr EvaluateSyscall(int sysno) const override { |
43 // if (sysno == __NR_fcntl) { | 43 // if (sysno == __NR_fcntl) { |
44 // Arg<int> fd(0), cmd(1); | 44 // Arg<int> fd(0), cmd(1); |
45 // Arg<unsigned long> flags(2); | 45 // Arg<unsigned long> flags(2); |
46 // const uint64_t kGoodFlags = O_ACCMODE | O_NONBLOCK; | 46 // const uint64_t kGoodFlags = O_ACCMODE | O_NONBLOCK; |
47 // return If(fd == 0 && cmd == F_SETFL && (flags & ~kGoodFlags) == 0, | 47 // return If(fd == 0 && cmd == F_SETFL && (flags & ~kGoodFlags) == 0, |
48 // Allow()) | 48 // Allow()) |
49 // .ElseIf(cmd == F_DUPFD || cmd == F_DUPFD_CLOEXEC, | 49 // .ElseIf(cmd == F_DUPFD || cmd == F_DUPFD_CLOEXEC, |
50 // Error(EMFILE)) | 50 // Error(EMFILE)) |
51 // .Else(Trap(SetFlagHandler, NULL)); | 51 // .Else(Trap(SetFlagHandler, NULL)); |
52 // } else { | 52 // } else { |
(...skipping 46 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
99 SandboxBPFDSLPolicy() : SandboxBPFPolicy() {} | 99 SandboxBPFDSLPolicy() : SandboxBPFPolicy() {} |
100 virtual ~SandboxBPFDSLPolicy() {} | 100 virtual ~SandboxBPFDSLPolicy() {} |
101 | 101 |
102 // User extension point for writing custom sandbox policies. | 102 // User extension point for writing custom sandbox policies. |
103 virtual ResultExpr EvaluateSyscall(int sysno) const = 0; | 103 virtual ResultExpr EvaluateSyscall(int sysno) const = 0; |
104 | 104 |
105 // Optional overload for specifying alternate behavior for invalid | 105 // Optional overload for specifying alternate behavior for invalid |
106 // system calls. The default is to return ENOSYS. | 106 // system calls. The default is to return ENOSYS. |
107 virtual ResultExpr InvalidSyscall() const; | 107 virtual ResultExpr InvalidSyscall() const; |
108 | 108 |
109 // Override implementations from SandboxBPFPolicy. Marked as FINAL | 109 // Override implementations from SandboxBPFPolicy. Marked as final |
110 // to prevent mixups with child classes accidentally overloading | 110 // to prevent mixups with child classes accidentally overloading |
111 // these instead of the above methods. | 111 // these instead of the above methods. |
112 virtual ErrorCode EvaluateSyscall(SandboxBPF* sb, | 112 virtual ErrorCode EvaluateSyscall(SandboxBPF* sb, |
113 int sysno) const OVERRIDE FINAL; | 113 int sysno) const override final; |
114 virtual ErrorCode InvalidSyscall(SandboxBPF* sb) const OVERRIDE FINAL; | 114 virtual ErrorCode InvalidSyscall(SandboxBPF* sb) const override final; |
115 | 115 |
116 // Helper method so policies can just write Trap(func, aux). | 116 // Helper method so policies can just write Trap(func, aux). |
117 static ResultExpr Trap(Trap::TrapFnc trap_func, const void* aux); | 117 static ResultExpr Trap(Trap::TrapFnc trap_func, const void* aux); |
118 | 118 |
119 private: | 119 private: |
120 DISALLOW_COPY_AND_ASSIGN(SandboxBPFDSLPolicy); | 120 DISALLOW_COPY_AND_ASSIGN(SandboxBPFDSLPolicy); |
121 }; | 121 }; |
122 | 122 |
123 // Allow specifies a result that the system call should be allowed to | 123 // Allow specifies a result that the system call should be allowed to |
124 // execute normally. | 124 // execute normally. |
(...skipping 255 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
380 | 380 |
381 template <typename T> | 381 template <typename T> |
382 ResultExpr Caser<T>::Default(ResultExpr result) const { | 382 ResultExpr Caser<T>::Default(ResultExpr result) const { |
383 return elser_.Else(result); | 383 return elser_.Else(result); |
384 } | 384 } |
385 | 385 |
386 } // namespace bpf_dsl | 386 } // namespace bpf_dsl |
387 } // namespace sandbox | 387 } // namespace sandbox |
388 | 388 |
389 #endif // SANDBOX_LINUX_BPF_DSL_BPF_DSL_H_ | 389 #endif // SANDBOX_LINUX_BPF_DSL_BPF_DSL_H_ |
OLD | NEW |