| OLD | NEW |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "sandbox/linux/seccomp-bpf/syscall.h" | 5 #include "sandbox/linux/seccomp-bpf/syscall.h" |
| 6 | 6 |
| 7 #include <asm/unistd.h> | 7 #include <asm/unistd.h> |
| 8 #include <fcntl.h> | 8 #include <fcntl.h> |
| 9 #include <sys/mman.h> | 9 #include <sys/mman.h> |
| 10 #include <sys/syscall.h> | 10 #include <sys/syscall.h> |
| 11 #include <sys/types.h> | 11 #include <sys/types.h> |
| 12 #include <unistd.h> | 12 #include <unistd.h> |
| 13 | 13 |
| 14 #include <vector> | 14 #include <vector> |
| 15 | 15 |
| 16 #include "base/basictypes.h" | 16 #include "base/basictypes.h" |
| 17 #include "base/posix/eintr_wrapper.h" | 17 #include "base/posix/eintr_wrapper.h" |
| 18 #include "build/build_config.h" | 18 #include "build/build_config.h" |
| 19 #include "sandbox/linux/bpf_dsl/bpf_dsl.h" | 19 #include "sandbox/linux/bpf_dsl/bpf_dsl.h" |
| 20 #include "sandbox/linux/bpf_dsl/policy.h" |
| 20 #include "sandbox/linux/seccomp-bpf/bpf_tests.h" | 21 #include "sandbox/linux/seccomp-bpf/bpf_tests.h" |
| 21 #include "sandbox/linux/seccomp-bpf/sandbox_bpf.h" | 22 #include "sandbox/linux/seccomp-bpf/sandbox_bpf.h" |
| 22 #include "sandbox/linux/tests/unit_tests.h" | 23 #include "sandbox/linux/tests/unit_tests.h" |
| 23 #include "testing/gtest/include/gtest/gtest.h" | 24 #include "testing/gtest/include/gtest/gtest.h" |
| 24 | 25 |
| 25 using sandbox::bpf_dsl::Allow; | 26 using sandbox::bpf_dsl::Allow; |
| 26 using sandbox::bpf_dsl::ResultExpr; | 27 using sandbox::bpf_dsl::ResultExpr; |
| 27 using sandbox::bpf_dsl::Trap; | 28 using sandbox::bpf_dsl::Trap; |
| 28 using sandbox::bpf_dsl::SandboxBPFDSLPolicy; | |
| 29 | 29 |
| 30 namespace sandbox { | 30 namespace sandbox { |
| 31 | 31 |
| 32 namespace { | 32 namespace { |
| 33 | 33 |
| 34 // Different platforms use different symbols for the six-argument version | 34 // Different platforms use different symbols for the six-argument version |
| 35 // of the mmap() system call. Test for the correct symbol at compile time. | 35 // of the mmap() system call. Test for the correct symbol at compile time. |
| 36 #ifdef __NR_mmap2 | 36 #ifdef __NR_mmap2 |
| 37 const int kMMapNr = __NR_mmap2; | 37 const int kMMapNr = __NR_mmap2; |
| 38 #else | 38 #else |
| (...skipping 59 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 98 // SIGSYS trap handler that will be called on __NR_uname. | 98 // SIGSYS trap handler that will be called on __NR_uname. |
| 99 intptr_t CopySyscallArgsToAux(const struct arch_seccomp_data& args, void* aux) { | 99 intptr_t CopySyscallArgsToAux(const struct arch_seccomp_data& args, void* aux) { |
| 100 // |aux| is our BPF_AUX pointer. | 100 // |aux| is our BPF_AUX pointer. |
| 101 std::vector<uint64_t>* const seen_syscall_args = | 101 std::vector<uint64_t>* const seen_syscall_args = |
| 102 static_cast<std::vector<uint64_t>*>(aux); | 102 static_cast<std::vector<uint64_t>*>(aux); |
| 103 BPF_ASSERT(arraysize(args.args) == 6); | 103 BPF_ASSERT(arraysize(args.args) == 6); |
| 104 seen_syscall_args->assign(args.args, args.args + arraysize(args.args)); | 104 seen_syscall_args->assign(args.args, args.args + arraysize(args.args)); |
| 105 return -ENOMEM; | 105 return -ENOMEM; |
| 106 } | 106 } |
| 107 | 107 |
| 108 class CopyAllArgsOnUnamePolicy : public SandboxBPFDSLPolicy { | 108 class CopyAllArgsOnUnamePolicy : public bpf_dsl::Policy { |
| 109 public: | 109 public: |
| 110 explicit CopyAllArgsOnUnamePolicy(std::vector<uint64_t>* aux) : aux_(aux) {} | 110 explicit CopyAllArgsOnUnamePolicy(std::vector<uint64_t>* aux) : aux_(aux) {} |
| 111 virtual ~CopyAllArgsOnUnamePolicy() {} | 111 virtual ~CopyAllArgsOnUnamePolicy() {} |
| 112 | 112 |
| 113 virtual ResultExpr EvaluateSyscall(int sysno) const override { | 113 virtual ResultExpr EvaluateSyscall(int sysno) const override { |
| 114 DCHECK(SandboxBPF::IsValidSyscallNumber(sysno)); | 114 DCHECK(SandboxBPF::IsValidSyscallNumber(sysno)); |
| 115 if (sysno == __NR_uname) { | 115 if (sysno == __NR_uname) { |
| 116 return Trap(CopySyscallArgsToAux, aux_); | 116 return Trap(CopySyscallArgsToAux, aux_); |
| 117 } else { | 117 } else { |
| 118 return Allow(); | 118 return Allow(); |
| (...skipping 113 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 232 | 232 |
| 233 // Clean up | 233 // Clean up |
| 234 EXPECT_EQ(0, Syscall::Call(__NR_munmap, addr2, 8192L)); | 234 EXPECT_EQ(0, Syscall::Call(__NR_munmap, addr2, 8192L)); |
| 235 EXPECT_EQ(0, Syscall::Call(__NR_munmap, addr3, 4096L)); | 235 EXPECT_EQ(0, Syscall::Call(__NR_munmap, addr3, 4096L)); |
| 236 EXPECT_EQ(0, IGNORE_EINTR(Syscall::Call(__NR_close, fd))); | 236 EXPECT_EQ(0, IGNORE_EINTR(Syscall::Call(__NR_close, fd))); |
| 237 } | 237 } |
| 238 | 238 |
| 239 } // namespace | 239 } // namespace |
| 240 | 240 |
| 241 } // namespace sandbox | 241 } // namespace sandbox |
| OLD | NEW |