| OLD | NEW |
| 1 // Copyright 2014 The Chromium Authors. All rights reserved. | 1 // Copyright 2014 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "sandbox/linux/bpf_dsl/bpf_dsl.h" | 5 #include "sandbox/linux/bpf_dsl/bpf_dsl.h" |
| 6 | 6 |
| 7 #include <limits> | 7 #include <limits> |
| 8 | 8 |
| 9 #include "base/logging.h" | 9 #include "base/logging.h" |
| 10 #include "base/memory/ref_counted.h" | 10 #include "base/memory/ref_counted.h" |
| 11 #include "sandbox/linux/bpf_dsl/bpf_dsl_impl.h" | 11 #include "sandbox/linux/bpf_dsl/bpf_dsl_impl.h" |
| 12 #include "sandbox/linux/bpf_dsl/policy_compiler.h" | 12 #include "sandbox/linux/bpf_dsl/policy_compiler.h" |
| 13 #include "sandbox/linux/seccomp-bpf/errorcode.h" | 13 #include "sandbox/linux/seccomp-bpf/errorcode.h" |
| 14 | 14 |
| 15 namespace sandbox { | 15 namespace sandbox { |
| 16 namespace bpf_dsl { | 16 namespace bpf_dsl { |
| 17 namespace { | 17 namespace { |
| 18 | 18 |
| 19 class AllowResultExprImpl : public internal::ResultExprImpl { | 19 class AllowResultExprImpl : public internal::ResultExprImpl { |
| 20 public: | 20 public: |
| 21 AllowResultExprImpl() {} | 21 AllowResultExprImpl() {} |
| 22 | 22 |
| 23 virtual ErrorCode Compile(PolicyCompiler* pc) const override { | 23 ErrorCode Compile(PolicyCompiler* pc) const override { |
| 24 return ErrorCode(ErrorCode::ERR_ALLOWED); | 24 return ErrorCode(ErrorCode::ERR_ALLOWED); |
| 25 } | 25 } |
| 26 | 26 |
| 27 private: | 27 private: |
| 28 virtual ~AllowResultExprImpl() {} | 28 ~AllowResultExprImpl() override {} |
| 29 | 29 |
| 30 DISALLOW_COPY_AND_ASSIGN(AllowResultExprImpl); | 30 DISALLOW_COPY_AND_ASSIGN(AllowResultExprImpl); |
| 31 }; | 31 }; |
| 32 | 32 |
| 33 class ErrorResultExprImpl : public internal::ResultExprImpl { | 33 class ErrorResultExprImpl : public internal::ResultExprImpl { |
| 34 public: | 34 public: |
| 35 explicit ErrorResultExprImpl(int err) : err_(err) { | 35 explicit ErrorResultExprImpl(int err) : err_(err) { |
| 36 CHECK(err_ >= ErrorCode::ERR_MIN_ERRNO && err_ <= ErrorCode::ERR_MAX_ERRNO); | 36 CHECK(err_ >= ErrorCode::ERR_MIN_ERRNO && err_ <= ErrorCode::ERR_MAX_ERRNO); |
| 37 } | 37 } |
| 38 | 38 |
| 39 virtual ErrorCode Compile(PolicyCompiler* pc) const override { | 39 ErrorCode Compile(PolicyCompiler* pc) const override { |
| 40 return pc->Error(err_); | 40 return pc->Error(err_); |
| 41 } | 41 } |
| 42 | 42 |
| 43 private: | 43 private: |
| 44 virtual ~ErrorResultExprImpl() {} | 44 ~ErrorResultExprImpl() override {} |
| 45 | 45 |
| 46 int err_; | 46 int err_; |
| 47 | 47 |
| 48 DISALLOW_COPY_AND_ASSIGN(ErrorResultExprImpl); | 48 DISALLOW_COPY_AND_ASSIGN(ErrorResultExprImpl); |
| 49 }; | 49 }; |
| 50 | 50 |
| 51 class KillResultExprImpl : public internal::ResultExprImpl { | 51 class KillResultExprImpl : public internal::ResultExprImpl { |
| 52 public: | 52 public: |
| 53 explicit KillResultExprImpl(const char* msg) : msg_(msg) { DCHECK(msg_); } | 53 explicit KillResultExprImpl(const char* msg) : msg_(msg) { DCHECK(msg_); } |
| 54 | 54 |
| 55 virtual ErrorCode Compile(PolicyCompiler* pc) const override { | 55 ErrorCode Compile(PolicyCompiler* pc) const override { |
| 56 return pc->Kill(msg_); | 56 return pc->Kill(msg_); |
| 57 } | 57 } |
| 58 | 58 |
| 59 private: | 59 private: |
| 60 virtual ~KillResultExprImpl() {} | 60 ~KillResultExprImpl() override {} |
| 61 | 61 |
| 62 const char* msg_; | 62 const char* msg_; |
| 63 | 63 |
| 64 DISALLOW_COPY_AND_ASSIGN(KillResultExprImpl); | 64 DISALLOW_COPY_AND_ASSIGN(KillResultExprImpl); |
| 65 }; | 65 }; |
| 66 | 66 |
| 67 class TraceResultExprImpl : public internal::ResultExprImpl { | 67 class TraceResultExprImpl : public internal::ResultExprImpl { |
| 68 public: | 68 public: |
| 69 TraceResultExprImpl(uint16_t aux) : aux_(aux) {} | 69 TraceResultExprImpl(uint16_t aux) : aux_(aux) {} |
| 70 | 70 |
| 71 virtual ErrorCode Compile(PolicyCompiler* pc) const override { | 71 ErrorCode Compile(PolicyCompiler* pc) const override { |
| 72 return ErrorCode(ErrorCode::ERR_TRACE + aux_); | 72 return ErrorCode(ErrorCode::ERR_TRACE + aux_); |
| 73 } | 73 } |
| 74 | 74 |
| 75 private: | 75 private: |
| 76 virtual ~TraceResultExprImpl() {} | 76 ~TraceResultExprImpl() override {} |
| 77 | 77 |
| 78 uint16_t aux_; | 78 uint16_t aux_; |
| 79 | 79 |
| 80 DISALLOW_COPY_AND_ASSIGN(TraceResultExprImpl); | 80 DISALLOW_COPY_AND_ASSIGN(TraceResultExprImpl); |
| 81 }; | 81 }; |
| 82 | 82 |
| 83 class TrapResultExprImpl : public internal::ResultExprImpl { | 83 class TrapResultExprImpl : public internal::ResultExprImpl { |
| 84 public: | 84 public: |
| 85 TrapResultExprImpl(TrapRegistry::TrapFnc func, const void* arg) | 85 TrapResultExprImpl(TrapRegistry::TrapFnc func, const void* arg) |
| 86 : func_(func), arg_(arg) { | 86 : func_(func), arg_(arg) { |
| 87 DCHECK(func_); | 87 DCHECK(func_); |
| 88 } | 88 } |
| 89 | 89 |
| 90 virtual ErrorCode Compile(PolicyCompiler* pc) const override { | 90 ErrorCode Compile(PolicyCompiler* pc) const override { |
| 91 return pc->Trap(func_, arg_); | 91 return pc->Trap(func_, arg_); |
| 92 } | 92 } |
| 93 | 93 |
| 94 private: | 94 private: |
| 95 virtual ~TrapResultExprImpl() {} | 95 ~TrapResultExprImpl() override {} |
| 96 | 96 |
| 97 TrapRegistry::TrapFnc func_; | 97 TrapRegistry::TrapFnc func_; |
| 98 const void* arg_; | 98 const void* arg_; |
| 99 | 99 |
| 100 DISALLOW_COPY_AND_ASSIGN(TrapResultExprImpl); | 100 DISALLOW_COPY_AND_ASSIGN(TrapResultExprImpl); |
| 101 }; | 101 }; |
| 102 | 102 |
| 103 class UnsafeTrapResultExprImpl : public internal::ResultExprImpl { | 103 class UnsafeTrapResultExprImpl : public internal::ResultExprImpl { |
| 104 public: | 104 public: |
| 105 UnsafeTrapResultExprImpl(TrapRegistry::TrapFnc func, const void* arg) | 105 UnsafeTrapResultExprImpl(TrapRegistry::TrapFnc func, const void* arg) |
| 106 : func_(func), arg_(arg) { | 106 : func_(func), arg_(arg) { |
| 107 DCHECK(func_); | 107 DCHECK(func_); |
| 108 } | 108 } |
| 109 | 109 |
| 110 virtual ErrorCode Compile(PolicyCompiler* pc) const override { | 110 ErrorCode Compile(PolicyCompiler* pc) const override { |
| 111 return pc->UnsafeTrap(func_, arg_); | 111 return pc->UnsafeTrap(func_, arg_); |
| 112 } | 112 } |
| 113 | 113 |
| 114 virtual bool HasUnsafeTraps() const override { return true; } | 114 bool HasUnsafeTraps() const override { return true; } |
| 115 | 115 |
| 116 private: | 116 private: |
| 117 virtual ~UnsafeTrapResultExprImpl() {} | 117 ~UnsafeTrapResultExprImpl() override {} |
| 118 | 118 |
| 119 TrapRegistry::TrapFnc func_; | 119 TrapRegistry::TrapFnc func_; |
| 120 const void* arg_; | 120 const void* arg_; |
| 121 | 121 |
| 122 DISALLOW_COPY_AND_ASSIGN(UnsafeTrapResultExprImpl); | 122 DISALLOW_COPY_AND_ASSIGN(UnsafeTrapResultExprImpl); |
| 123 }; | 123 }; |
| 124 | 124 |
| 125 class IfThenResultExprImpl : public internal::ResultExprImpl { | 125 class IfThenResultExprImpl : public internal::ResultExprImpl { |
| 126 public: | 126 public: |
| 127 IfThenResultExprImpl(const BoolExpr& cond, | 127 IfThenResultExprImpl(const BoolExpr& cond, |
| 128 const ResultExpr& then_result, | 128 const ResultExpr& then_result, |
| 129 const ResultExpr& else_result) | 129 const ResultExpr& else_result) |
| 130 : cond_(cond), then_result_(then_result), else_result_(else_result) {} | 130 : cond_(cond), then_result_(then_result), else_result_(else_result) {} |
| 131 | 131 |
| 132 virtual ErrorCode Compile(PolicyCompiler* pc) const override { | 132 ErrorCode Compile(PolicyCompiler* pc) const override { |
| 133 return cond_->Compile( | 133 return cond_->Compile( |
| 134 pc, then_result_->Compile(pc), else_result_->Compile(pc)); | 134 pc, then_result_->Compile(pc), else_result_->Compile(pc)); |
| 135 } | 135 } |
| 136 | 136 |
| 137 virtual bool HasUnsafeTraps() const override { | 137 bool HasUnsafeTraps() const override { |
| 138 return then_result_->HasUnsafeTraps() || else_result_->HasUnsafeTraps(); | 138 return then_result_->HasUnsafeTraps() || else_result_->HasUnsafeTraps(); |
| 139 } | 139 } |
| 140 | 140 |
| 141 private: | 141 private: |
| 142 virtual ~IfThenResultExprImpl() {} | 142 ~IfThenResultExprImpl() override {} |
| 143 | 143 |
| 144 BoolExpr cond_; | 144 BoolExpr cond_; |
| 145 ResultExpr then_result_; | 145 ResultExpr then_result_; |
| 146 ResultExpr else_result_; | 146 ResultExpr else_result_; |
| 147 | 147 |
| 148 DISALLOW_COPY_AND_ASSIGN(IfThenResultExprImpl); | 148 DISALLOW_COPY_AND_ASSIGN(IfThenResultExprImpl); |
| 149 }; | 149 }; |
| 150 | 150 |
| 151 class ConstBoolExprImpl : public internal::BoolExprImpl { | 151 class ConstBoolExprImpl : public internal::BoolExprImpl { |
| 152 public: | 152 public: |
| 153 ConstBoolExprImpl(bool value) : value_(value) {} | 153 ConstBoolExprImpl(bool value) : value_(value) {} |
| 154 | 154 |
| 155 virtual ErrorCode Compile(PolicyCompiler* pc, | 155 ErrorCode Compile(PolicyCompiler* pc, |
| 156 ErrorCode true_ec, | 156 ErrorCode true_ec, |
| 157 ErrorCode false_ec) const override { | 157 ErrorCode false_ec) const override { |
| 158 return value_ ? true_ec : false_ec; | 158 return value_ ? true_ec : false_ec; |
| 159 } | 159 } |
| 160 | 160 |
| 161 private: | 161 private: |
| 162 virtual ~ConstBoolExprImpl() {} | 162 ~ConstBoolExprImpl() override {} |
| 163 | 163 |
| 164 bool value_; | 164 bool value_; |
| 165 | 165 |
| 166 DISALLOW_COPY_AND_ASSIGN(ConstBoolExprImpl); | 166 DISALLOW_COPY_AND_ASSIGN(ConstBoolExprImpl); |
| 167 }; | 167 }; |
| 168 | 168 |
| 169 class PrimitiveBoolExprImpl : public internal::BoolExprImpl { | 169 class PrimitiveBoolExprImpl : public internal::BoolExprImpl { |
| 170 public: | 170 public: |
| 171 PrimitiveBoolExprImpl(int argno, | 171 PrimitiveBoolExprImpl(int argno, |
| 172 ErrorCode::ArgType is_32bit, | 172 ErrorCode::ArgType is_32bit, |
| 173 uint64_t mask, | 173 uint64_t mask, |
| 174 uint64_t value) | 174 uint64_t value) |
| 175 : argno_(argno), is_32bit_(is_32bit), mask_(mask), value_(value) {} | 175 : argno_(argno), is_32bit_(is_32bit), mask_(mask), value_(value) {} |
| 176 | 176 |
| 177 virtual ErrorCode Compile(PolicyCompiler* pc, | 177 ErrorCode Compile(PolicyCompiler* pc, |
| 178 ErrorCode true_ec, | 178 ErrorCode true_ec, |
| 179 ErrorCode false_ec) const override { | 179 ErrorCode false_ec) const override { |
| 180 return pc->CondMaskedEqual( | 180 return pc->CondMaskedEqual( |
| 181 argno_, is_32bit_, mask_, value_, true_ec, false_ec); | 181 argno_, is_32bit_, mask_, value_, true_ec, false_ec); |
| 182 } | 182 } |
| 183 | 183 |
| 184 private: | 184 private: |
| 185 virtual ~PrimitiveBoolExprImpl() {} | 185 ~PrimitiveBoolExprImpl() override {} |
| 186 | 186 |
| 187 int argno_; | 187 int argno_; |
| 188 ErrorCode::ArgType is_32bit_; | 188 ErrorCode::ArgType is_32bit_; |
| 189 uint64_t mask_; | 189 uint64_t mask_; |
| 190 uint64_t value_; | 190 uint64_t value_; |
| 191 | 191 |
| 192 DISALLOW_COPY_AND_ASSIGN(PrimitiveBoolExprImpl); | 192 DISALLOW_COPY_AND_ASSIGN(PrimitiveBoolExprImpl); |
| 193 }; | 193 }; |
| 194 | 194 |
| 195 class NegateBoolExprImpl : public internal::BoolExprImpl { | 195 class NegateBoolExprImpl : public internal::BoolExprImpl { |
| 196 public: | 196 public: |
| 197 explicit NegateBoolExprImpl(const BoolExpr& cond) : cond_(cond) {} | 197 explicit NegateBoolExprImpl(const BoolExpr& cond) : cond_(cond) {} |
| 198 | 198 |
| 199 virtual ErrorCode Compile(PolicyCompiler* pc, | 199 ErrorCode Compile(PolicyCompiler* pc, |
| 200 ErrorCode true_ec, | 200 ErrorCode true_ec, |
| 201 ErrorCode false_ec) const override { | 201 ErrorCode false_ec) const override { |
| 202 return cond_->Compile(pc, false_ec, true_ec); | 202 return cond_->Compile(pc, false_ec, true_ec); |
| 203 } | 203 } |
| 204 | 204 |
| 205 private: | 205 private: |
| 206 virtual ~NegateBoolExprImpl() {} | 206 ~NegateBoolExprImpl() override {} |
| 207 | 207 |
| 208 BoolExpr cond_; | 208 BoolExpr cond_; |
| 209 | 209 |
| 210 DISALLOW_COPY_AND_ASSIGN(NegateBoolExprImpl); | 210 DISALLOW_COPY_AND_ASSIGN(NegateBoolExprImpl); |
| 211 }; | 211 }; |
| 212 | 212 |
| 213 class AndBoolExprImpl : public internal::BoolExprImpl { | 213 class AndBoolExprImpl : public internal::BoolExprImpl { |
| 214 public: | 214 public: |
| 215 AndBoolExprImpl(const BoolExpr& lhs, const BoolExpr& rhs) | 215 AndBoolExprImpl(const BoolExpr& lhs, const BoolExpr& rhs) |
| 216 : lhs_(lhs), rhs_(rhs) {} | 216 : lhs_(lhs), rhs_(rhs) {} |
| 217 | 217 |
| 218 virtual ErrorCode Compile(PolicyCompiler* pc, | 218 ErrorCode Compile(PolicyCompiler* pc, |
| 219 ErrorCode true_ec, | 219 ErrorCode true_ec, |
| 220 ErrorCode false_ec) const override { | 220 ErrorCode false_ec) const override { |
| 221 return lhs_->Compile(pc, rhs_->Compile(pc, true_ec, false_ec), false_ec); | 221 return lhs_->Compile(pc, rhs_->Compile(pc, true_ec, false_ec), false_ec); |
| 222 } | 222 } |
| 223 | 223 |
| 224 private: | 224 private: |
| 225 virtual ~AndBoolExprImpl() {} | 225 ~AndBoolExprImpl() override {} |
| 226 | 226 |
| 227 BoolExpr lhs_; | 227 BoolExpr lhs_; |
| 228 BoolExpr rhs_; | 228 BoolExpr rhs_; |
| 229 | 229 |
| 230 DISALLOW_COPY_AND_ASSIGN(AndBoolExprImpl); | 230 DISALLOW_COPY_AND_ASSIGN(AndBoolExprImpl); |
| 231 }; | 231 }; |
| 232 | 232 |
| 233 class OrBoolExprImpl : public internal::BoolExprImpl { | 233 class OrBoolExprImpl : public internal::BoolExprImpl { |
| 234 public: | 234 public: |
| 235 OrBoolExprImpl(const BoolExpr& lhs, const BoolExpr& rhs) | 235 OrBoolExprImpl(const BoolExpr& lhs, const BoolExpr& rhs) |
| 236 : lhs_(lhs), rhs_(rhs) {} | 236 : lhs_(lhs), rhs_(rhs) {} |
| 237 | 237 |
| 238 virtual ErrorCode Compile(PolicyCompiler* pc, | 238 ErrorCode Compile(PolicyCompiler* pc, |
| 239 ErrorCode true_ec, | 239 ErrorCode true_ec, |
| 240 ErrorCode false_ec) const override { | 240 ErrorCode false_ec) const override { |
| 241 return lhs_->Compile(pc, true_ec, rhs_->Compile(pc, true_ec, false_ec)); | 241 return lhs_->Compile(pc, true_ec, rhs_->Compile(pc, true_ec, false_ec)); |
| 242 } | 242 } |
| 243 | 243 |
| 244 private: | 244 private: |
| 245 virtual ~OrBoolExprImpl() {} | 245 ~OrBoolExprImpl() override {} |
| 246 | 246 |
| 247 BoolExpr lhs_; | 247 BoolExpr lhs_; |
| 248 BoolExpr rhs_; | 248 BoolExpr rhs_; |
| 249 | 249 |
| 250 DISALLOW_COPY_AND_ASSIGN(OrBoolExprImpl); | 250 DISALLOW_COPY_AND_ASSIGN(OrBoolExprImpl); |
| 251 }; | 251 }; |
| 252 | 252 |
| 253 } // namespace | 253 } // namespace |
| 254 | 254 |
| 255 namespace internal { | 255 namespace internal { |
| (...skipping 112 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 368 new const IfThenResultExprImpl(clause.first, clause.second, expr)); | 368 new const IfThenResultExprImpl(clause.first, clause.second, expr)); |
| 369 } | 369 } |
| 370 return expr; | 370 return expr; |
| 371 } | 371 } |
| 372 | 372 |
| 373 } // namespace bpf_dsl | 373 } // namespace bpf_dsl |
| 374 } // namespace sandbox | 374 } // namespace sandbox |
| 375 | 375 |
| 376 template class scoped_refptr<const sandbox::bpf_dsl::internal::BoolExprImpl>; | 376 template class scoped_refptr<const sandbox::bpf_dsl::internal::BoolExprImpl>; |
| 377 template class scoped_refptr<const sandbox::bpf_dsl::internal::ResultExprImpl>; | 377 template class scoped_refptr<const sandbox::bpf_dsl::internal::ResultExprImpl>; |
| OLD | NEW |