| OLD | NEW |
| 1 // Copyright 2014 The Chromium Authors. All rights reserved. | 1 // Copyright 2014 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.h" | 5 #include "sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.h" |
| 6 | 6 |
| 7 #include <errno.h> | 7 #include <errno.h> |
| 8 #include <sched.h> | 8 #include <sched.h> |
| 9 #include <sys/syscall.h> | 9 #include <sys/syscall.h> |
| 10 #include <time.h> | 10 #include <time.h> |
| (...skipping 26 matching lines...) Expand all Loading... |
| 37 | 37 |
| 38 using sandbox::bpf_dsl::Allow; | 38 using sandbox::bpf_dsl::Allow; |
| 39 using sandbox::bpf_dsl::ResultExpr; | 39 using sandbox::bpf_dsl::ResultExpr; |
| 40 using sandbox::bpf_dsl::SandboxBPFDSLPolicy; | 40 using sandbox::bpf_dsl::SandboxBPFDSLPolicy; |
| 41 | 41 |
| 42 class RestrictClockIdPolicy : public SandboxBPFDSLPolicy { | 42 class RestrictClockIdPolicy : public SandboxBPFDSLPolicy { |
| 43 public: | 43 public: |
| 44 RestrictClockIdPolicy() {} | 44 RestrictClockIdPolicy() {} |
| 45 virtual ~RestrictClockIdPolicy() {} | 45 virtual ~RestrictClockIdPolicy() {} |
| 46 | 46 |
| 47 virtual ResultExpr EvaluateSyscall(int sysno) const OVERRIDE { | 47 virtual ResultExpr EvaluateSyscall(int sysno) const override { |
| 48 switch (sysno) { | 48 switch (sysno) { |
| 49 case __NR_clock_gettime: | 49 case __NR_clock_gettime: |
| 50 case __NR_clock_getres: | 50 case __NR_clock_getres: |
| 51 return RestrictClockID(); | 51 return RestrictClockID(); |
| 52 default: | 52 default: |
| 53 return Allow(); | 53 return Allow(); |
| 54 } | 54 } |
| 55 } | 55 } |
| 56 }; | 56 }; |
| 57 | 57 |
| (...skipping 26 matching lines...) Expand all Loading... |
| 84 | 84 |
| 85 // A custom BPF tester delegate to run IsRunningOnChromeOS() before | 85 // A custom BPF tester delegate to run IsRunningOnChromeOS() before |
| 86 // the sandbox is enabled because we cannot run it with non-SFI BPF | 86 // the sandbox is enabled because we cannot run it with non-SFI BPF |
| 87 // sandbox enabled. | 87 // sandbox enabled. |
| 88 class ClockSystemTesterDelegate : public sandbox::BPFTesterDelegate { | 88 class ClockSystemTesterDelegate : public sandbox::BPFTesterDelegate { |
| 89 public: | 89 public: |
| 90 ClockSystemTesterDelegate() | 90 ClockSystemTesterDelegate() |
| 91 : is_running_on_chromeos_(base::SysInfo::IsRunningOnChromeOS()) {} | 91 : is_running_on_chromeos_(base::SysInfo::IsRunningOnChromeOS()) {} |
| 92 virtual ~ClockSystemTesterDelegate() {} | 92 virtual ~ClockSystemTesterDelegate() {} |
| 93 | 93 |
| 94 virtual scoped_ptr<sandbox::SandboxBPFPolicy> GetSandboxBPFPolicy() OVERRIDE { | 94 virtual scoped_ptr<sandbox::SandboxBPFPolicy> GetSandboxBPFPolicy() override { |
| 95 return scoped_ptr<sandbox::SandboxBPFPolicy>( | 95 return scoped_ptr<sandbox::SandboxBPFPolicy>( |
| 96 new RestrictClockIdPolicy()); | 96 new RestrictClockIdPolicy()); |
| 97 } | 97 } |
| 98 virtual void RunTestFunction() OVERRIDE { | 98 virtual void RunTestFunction() override { |
| 99 if (is_running_on_chromeos_) { | 99 if (is_running_on_chromeos_) { |
| 100 CheckClock(base::TimeTicks::kClockSystemTrace); | 100 CheckClock(base::TimeTicks::kClockSystemTrace); |
| 101 } else { | 101 } else { |
| 102 struct timespec ts; | 102 struct timespec ts; |
| 103 // kClockSystemTrace is 11, which is CLOCK_THREAD_CPUTIME_ID of | 103 // kClockSystemTrace is 11, which is CLOCK_THREAD_CPUTIME_ID of |
| 104 // the init process (pid=1). If kernel supports this feature, | 104 // the init process (pid=1). If kernel supports this feature, |
| 105 // this may succeed even if this is not running on Chrome OS. We | 105 // this may succeed even if this is not running on Chrome OS. We |
| 106 // just check this clock_gettime call does not crash. | 106 // just check this clock_gettime call does not crash. |
| 107 clock_gettime(base::TimeTicks::kClockSystemTrace, &ts); | 107 clock_gettime(base::TimeTicks::kClockSystemTrace, &ts); |
| 108 } | 108 } |
| (...skipping 32 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 141 struct timespec ts; | 141 struct timespec ts; |
| 142 clock_gettime(kInitCPUClockID, &ts); | 142 clock_gettime(kInitCPUClockID, &ts); |
| 143 } | 143 } |
| 144 #endif // !defined(OS_ANDROID) | 144 #endif // !defined(OS_ANDROID) |
| 145 | 145 |
| 146 class RestrictSchedPolicy : public SandboxBPFDSLPolicy { | 146 class RestrictSchedPolicy : public SandboxBPFDSLPolicy { |
| 147 public: | 147 public: |
| 148 RestrictSchedPolicy() {} | 148 RestrictSchedPolicy() {} |
| 149 virtual ~RestrictSchedPolicy() {} | 149 virtual ~RestrictSchedPolicy() {} |
| 150 | 150 |
| 151 virtual ResultExpr EvaluateSyscall(int sysno) const OVERRIDE { | 151 virtual ResultExpr EvaluateSyscall(int sysno) const override { |
| 152 switch (sysno) { | 152 switch (sysno) { |
| 153 case __NR_sched_getparam: | 153 case __NR_sched_getparam: |
| 154 return RestrictSchedTarget(getpid(), sysno); | 154 return RestrictSchedTarget(getpid(), sysno); |
| 155 default: | 155 default: |
| 156 return Allow(); | 156 return Allow(); |
| 157 } | 157 } |
| 158 } | 158 } |
| 159 }; | 159 }; |
| 160 | 160 |
| 161 void CheckSchedGetParam(pid_t pid, struct sched_param* param) { | 161 void CheckSchedGetParam(pid_t pid, struct sched_param* param) { |
| (...skipping 43 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 205 DEATH_SEGV_MESSAGE(sandbox::GetErrorMessageContentForTests()), | 205 DEATH_SEGV_MESSAGE(sandbox::GetErrorMessageContentForTests()), |
| 206 RestrictSchedPolicy) { | 206 RestrictSchedPolicy) { |
| 207 const pid_t kInitPID = 1; | 207 const pid_t kInitPID = 1; |
| 208 struct sched_param param; | 208 struct sched_param param; |
| 209 sched_getparam(kInitPID, ¶m); | 209 sched_getparam(kInitPID, ¶m); |
| 210 } | 210 } |
| 211 | 211 |
| 212 } // namespace | 212 } // namespace |
| 213 | 213 |
| 214 } // namespace sandbox | 214 } // namespace sandbox |
| OLD | NEW |