| OLD | NEW |
| 1 // Copyright 2014 The Chromium Authors. All rights reserved. | 1 // Copyright 2014 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "sandbox/linux/bpf_dsl/bpf_dsl.h" | 5 #include "sandbox/linux/bpf_dsl/bpf_dsl.h" |
| 6 | 6 |
| 7 #include <errno.h> | 7 #include <errno.h> |
| 8 | 8 |
| 9 #include <limits> | 9 #include <limits> |
| 10 | 10 |
| 11 #include "base/logging.h" | 11 #include "base/logging.h" |
| 12 #include "base/memory/ref_counted.h" | 12 #include "base/memory/ref_counted.h" |
| 13 #include "sandbox/linux/bpf_dsl/bpf_dsl_impl.h" | 13 #include "sandbox/linux/bpf_dsl/bpf_dsl_impl.h" |
| 14 #include "sandbox/linux/bpf_dsl/policy_compiler.h" | 14 #include "sandbox/linux/bpf_dsl/policy_compiler.h" |
| 15 #include "sandbox/linux/seccomp-bpf/errorcode.h" | 15 #include "sandbox/linux/seccomp-bpf/errorcode.h" |
| 16 #include "sandbox/linux/seccomp-bpf/syscall_iterator.h" | |
| 17 | 16 |
| 18 namespace sandbox { | 17 namespace sandbox { |
| 19 namespace bpf_dsl { | 18 namespace bpf_dsl { |
| 20 namespace { | 19 namespace { |
| 21 | 20 |
| 22 class AllowResultExprImpl : public internal::ResultExprImpl { | 21 class AllowResultExprImpl : public internal::ResultExprImpl { |
| 23 public: | 22 public: |
| 24 AllowResultExprImpl() {} | 23 AllowResultExprImpl() {} |
| 25 | 24 |
| 26 virtual ErrorCode Compile(PolicyCompiler* pc) const override { | 25 virtual ErrorCode Compile(PolicyCompiler* pc) const override { |
| (...skipping 343 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 370 expr = ResultExpr( | 369 expr = ResultExpr( |
| 371 new const IfThenResultExprImpl(clause.first, clause.second, expr)); | 370 new const IfThenResultExprImpl(clause.first, clause.second, expr)); |
| 372 } | 371 } |
| 373 return expr; | 372 return expr; |
| 374 } | 373 } |
| 375 | 374 |
| 376 ResultExpr SandboxBPFDSLPolicy::InvalidSyscall() const { | 375 ResultExpr SandboxBPFDSLPolicy::InvalidSyscall() const { |
| 377 return Error(ENOSYS); | 376 return Error(ENOSYS); |
| 378 } | 377 } |
| 379 | 378 |
| 380 ErrorCode SandboxBPFDSLPolicy::EvaluateSyscall(PolicyCompiler* pc, | |
| 381 int sysno) const { | |
| 382 return EvaluateSyscall(sysno)->Compile(pc); | |
| 383 } | |
| 384 | |
| 385 ErrorCode SandboxBPFDSLPolicy::InvalidSyscall(PolicyCompiler* pc) const { | |
| 386 return InvalidSyscall()->Compile(pc); | |
| 387 } | |
| 388 | |
| 389 bool SandboxBPFDSLPolicy::HasUnsafeTraps() const { | |
| 390 for (SyscallIterator iter(false); !iter.Done();) { | |
| 391 uint32_t sysnum = iter.Next(); | |
| 392 if (SyscallIterator::IsValid(sysnum) && | |
| 393 EvaluateSyscall(sysnum)->HasUnsafeTraps()) { | |
| 394 return true; | |
| 395 } | |
| 396 } | |
| 397 return InvalidSyscall()->HasUnsafeTraps(); | |
| 398 } | |
| 399 | |
| 400 ResultExpr SandboxBPFDSLPolicy::Trap(TrapRegistry::TrapFnc trap_func, | 379 ResultExpr SandboxBPFDSLPolicy::Trap(TrapRegistry::TrapFnc trap_func, |
| 401 const void* aux) { | 380 const void* aux) { |
| 402 return bpf_dsl::Trap(trap_func, aux); | 381 return bpf_dsl::Trap(trap_func, aux); |
| 403 } | 382 } |
| 404 | 383 |
| 405 } // namespace bpf_dsl | 384 } // namespace bpf_dsl |
| 406 } // namespace sandbox | 385 } // namespace sandbox |
| 407 | 386 |
| 408 template class scoped_refptr<const sandbox::bpf_dsl::internal::BoolExprImpl>; | 387 template class scoped_refptr<const sandbox::bpf_dsl::internal::BoolExprImpl>; |
| 409 template class scoped_refptr<const sandbox::bpf_dsl::internal::ResultExprImpl>; | 388 template class scoped_refptr<const sandbox::bpf_dsl::internal::ResultExprImpl>; |
| OLD | NEW |