OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "sandbox/linux/bpf_dsl/policy_compiler.h" | 5 #include "sandbox/linux/bpf_dsl/policy_compiler.h" |
6 | 6 |
7 #include <errno.h> | 7 #include <errno.h> |
8 #include <linux/filter.h> | 8 #include <linux/filter.h> |
9 #include <sys/syscall.h> | 9 #include <sys/syscall.h> |
10 | 10 |
(...skipping 59 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
70 // ultimately do so for us. | 70 // ultimately do so for us. |
71 int err = reinterpret_cast<intptr_t>(aux) & SECCOMP_RET_DATA; | 71 int err = reinterpret_cast<intptr_t>(aux) & SECCOMP_RET_DATA; |
72 return -err; | 72 return -err; |
73 } | 73 } |
74 | 74 |
75 intptr_t BPFFailure(const struct arch_seccomp_data&, void* aux) { | 75 intptr_t BPFFailure(const struct arch_seccomp_data&, void* aux) { |
76 SANDBOX_DIE(static_cast<char*>(aux)); | 76 SANDBOX_DIE(static_cast<char*>(aux)); |
77 } | 77 } |
78 | 78 |
79 bool HasUnsafeTraps(const Policy* policy) { | 79 bool HasUnsafeTraps(const Policy* policy) { |
80 for (uint32_t sysnum : SyscallSet::All()) { | 80 for (uint32_t sysnum : SyscallSet::ValidOnly()) { |
81 if (SyscallSet::IsValid(sysnum) && | 81 if (policy->EvaluateSyscall(sysnum)->HasUnsafeTraps()) { |
82 policy->EvaluateSyscall(sysnum)->HasUnsafeTraps()) { | |
83 return true; | 82 return true; |
84 } | 83 } |
85 } | 84 } |
86 return policy->InvalidSyscall()->HasUnsafeTraps(); | 85 return policy->InvalidSyscall()->HasUnsafeTraps(); |
87 } | 86 } |
88 | 87 |
89 } // namespace | 88 } // namespace |
90 | 89 |
91 struct PolicyCompiler::Range { | 90 struct PolicyCompiler::Range { |
92 Range(uint32_t f, const ErrorCode& e) : from(f), err(e) {} | 91 Range(uint32_t f, const ErrorCode& e) : from(f), err(e) {} |
(...skipping 421 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
514 &*conds_.insert(passed).first, | 513 &*conds_.insert(passed).first, |
515 &*conds_.insert(failed).first); | 514 &*conds_.insert(failed).first); |
516 } | 515 } |
517 | 516 |
518 ErrorCode PolicyCompiler::Kill(const char* msg) { | 517 ErrorCode PolicyCompiler::Kill(const char* msg) { |
519 return Trap(BPFFailure, const_cast<char*>(msg)); | 518 return Trap(BPFFailure, const_cast<char*>(msg)); |
520 } | 519 } |
521 | 520 |
522 } // namespace bpf_dsl | 521 } // namespace bpf_dsl |
523 } // namespace sandbox | 522 } // namespace sandbox |
OLD | NEW |