OLD | NEW |
1 // Copyright 2013 The Chromium Authors. All rights reserved. | 1 // Copyright 2013 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #ifndef CONTENT_COMMON_SANDBOX_LINUX_SANDBOX_BPF_BASE_POLICY_LINUX_H_ | 5 #ifndef CONTENT_COMMON_SANDBOX_LINUX_SANDBOX_BPF_BASE_POLICY_LINUX_H_ |
6 #define CONTENT_COMMON_SANDBOX_LINUX_SANDBOX_BPF_BASE_POLICY_LINUX_H_ | 6 #define CONTENT_COMMON_SANDBOX_LINUX_SANDBOX_BPF_BASE_POLICY_LINUX_H_ |
7 | 7 |
8 #include "base/basictypes.h" | 8 #include "base/basictypes.h" |
9 #include "base/memory/scoped_ptr.h" | 9 #include "base/memory/scoped_ptr.h" |
10 #include "sandbox/linux/bpf_dsl/bpf_dsl.h" | 10 #include "sandbox/linux/bpf_dsl/bpf_dsl.h" |
11 #include "sandbox/linux/seccomp-bpf-helpers/baseline_policy.h" | 11 #include "sandbox/linux/seccomp-bpf-helpers/baseline_policy.h" |
12 | 12 |
13 namespace content { | 13 namespace content { |
14 | 14 |
15 // The "baseline" BPF policy for content/. Any content/ seccomp-bpf policy | 15 // The "baseline" BPF policy for content/. Any content/ seccomp-bpf policy |
16 // should inherit from it. | 16 // should inherit from it. |
17 // It implements the main SandboxBPFDSLPolicy interface. Due to its nature | 17 // It implements the main SandboxBPFDSLPolicy interface. Due to its nature |
18 // as a "kernel attack surface reduction" layer, it's implementation-defined. | 18 // as a "kernel attack surface reduction" layer, it's implementation-defined. |
19 class SandboxBPFBasePolicy : public sandbox::bpf_dsl::SandboxBPFDSLPolicy { | 19 class SandboxBPFBasePolicy : public sandbox::bpf_dsl::SandboxBPFDSLPolicy { |
20 public: | 20 public: |
21 SandboxBPFBasePolicy(); | 21 SandboxBPFBasePolicy(); |
22 virtual ~SandboxBPFBasePolicy(); | 22 virtual ~SandboxBPFBasePolicy(); |
23 | 23 |
24 virtual sandbox::bpf_dsl::ResultExpr EvaluateSyscall( | 24 virtual sandbox::bpf_dsl::ResultExpr EvaluateSyscall( |
25 int system_call_number) const OVERRIDE; | 25 int system_call_number) const override; |
26 virtual sandbox::bpf_dsl::ResultExpr InvalidSyscall() const OVERRIDE; | 26 virtual sandbox::bpf_dsl::ResultExpr InvalidSyscall() const override; |
27 | 27 |
28 // A policy can implement this hook to run code right before the policy | 28 // A policy can implement this hook to run code right before the policy |
29 // is passed to the BPF compiler and the sandbox is engaged. | 29 // is passed to the BPF compiler and the sandbox is engaged. |
30 // If PreSandboxHook() returns true, the sandbox is guaranteed to be | 30 // If PreSandboxHook() returns true, the sandbox is guaranteed to be |
31 // engaged afterwards. | 31 // engaged afterwards. |
32 // This will be used when enabling the sandbox though | 32 // This will be used when enabling the sandbox though |
33 // SandboxSeccompBPF::StartSandbox(). | 33 // SandboxSeccompBPF::StartSandbox(). |
34 virtual bool PreSandboxHook(); | 34 virtual bool PreSandboxHook(); |
35 | 35 |
36 // Get the errno(3) to return for filesystem errors. | 36 // Get the errno(3) to return for filesystem errors. |
37 static int GetFSDeniedErrno(); | 37 static int GetFSDeniedErrno(); |
38 | 38 |
39 pid_t GetPolicyPid() const { return baseline_policy_->policy_pid(); } | 39 pid_t GetPolicyPid() const { return baseline_policy_->policy_pid(); } |
40 | 40 |
41 private: | 41 private: |
42 // Compose the BaselinePolicy from sandbox/. | 42 // Compose the BaselinePolicy from sandbox/. |
43 scoped_ptr<sandbox::BaselinePolicy> baseline_policy_; | 43 scoped_ptr<sandbox::BaselinePolicy> baseline_policy_; |
44 DISALLOW_COPY_AND_ASSIGN(SandboxBPFBasePolicy); | 44 DISALLOW_COPY_AND_ASSIGN(SandboxBPFBasePolicy); |
45 }; | 45 }; |
46 | 46 |
47 } // namespace content | 47 } // namespace content |
48 | 48 |
49 #endif // CONTENT_COMMON_SANDBOX_LINUX_SANDBOX_BPF_BASE_POLICY_LINUX_H_ | 49 #endif // CONTENT_COMMON_SANDBOX_LINUX_SANDBOX_BPF_BASE_POLICY_LINUX_H_ |
OLD | NEW |