| OLD | NEW |
| 1 // Copyright 2013 The Chromium Authors. All rights reserved. | 1 // Copyright 2013 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #ifndef CONTENT_COMMON_SANDBOX_LINUX_SANDBOX_BPF_BASE_POLICY_LINUX_H_ | 5 #ifndef CONTENT_COMMON_SANDBOX_LINUX_SANDBOX_BPF_BASE_POLICY_LINUX_H_ |
| 6 #define CONTENT_COMMON_SANDBOX_LINUX_SANDBOX_BPF_BASE_POLICY_LINUX_H_ | 6 #define CONTENT_COMMON_SANDBOX_LINUX_SANDBOX_BPF_BASE_POLICY_LINUX_H_ |
| 7 | 7 |
| 8 #include "base/basictypes.h" | 8 #include "base/basictypes.h" |
| 9 #include "base/memory/scoped_ptr.h" | 9 #include "base/memory/scoped_ptr.h" |
| 10 #include "sandbox/linux/bpf_dsl/bpf_dsl_forward.h" | 10 #include "sandbox/linux/bpf_dsl/bpf_dsl_forward.h" |
| 11 #include "sandbox/linux/bpf_dsl/policy.h" | 11 #include "sandbox/linux/bpf_dsl/policy.h" |
| 12 #include "sandbox/linux/seccomp-bpf-helpers/baseline_policy.h" | 12 #include "sandbox/linux/seccomp-bpf-helpers/baseline_policy.h" |
| 13 | 13 |
| 14 namespace content { | 14 namespace content { |
| 15 | 15 |
| 16 // The "baseline" BPF policy for content/. Any content/ seccomp-bpf policy | 16 // The "baseline" BPF policy for content/. Any content/ seccomp-bpf policy |
| 17 // should inherit from it. | 17 // should inherit from it. |
| 18 // It implements the main Policy interface. Due to its nature | 18 // It implements the main Policy interface. Due to its nature |
| 19 // as a "kernel attack surface reduction" layer, it's implementation-defined. | 19 // as a "kernel attack surface reduction" layer, it's implementation-defined. |
| 20 class SandboxBPFBasePolicy : public sandbox::bpf_dsl::Policy { | 20 class SandboxBPFBasePolicy : public sandbox::bpf_dsl::Policy { |
| 21 public: | 21 public: |
| 22 SandboxBPFBasePolicy(); | 22 SandboxBPFBasePolicy(); |
| 23 virtual ~SandboxBPFBasePolicy(); | 23 ~SandboxBPFBasePolicy() override; |
| 24 | 24 |
| 25 virtual sandbox::bpf_dsl::ResultExpr EvaluateSyscall( | 25 sandbox::bpf_dsl::ResultExpr EvaluateSyscall( |
| 26 int system_call_number) const override; | 26 int system_call_number) const override; |
| 27 virtual sandbox::bpf_dsl::ResultExpr InvalidSyscall() const override; | 27 sandbox::bpf_dsl::ResultExpr InvalidSyscall() const override; |
| 28 | 28 |
| 29 // A policy can implement this hook to run code right before the policy | 29 // A policy can implement this hook to run code right before the policy |
| 30 // is passed to the BPF compiler and the sandbox is engaged. | 30 // is passed to the BPF compiler and the sandbox is engaged. |
| 31 // If PreSandboxHook() returns true, the sandbox is guaranteed to be | 31 // If PreSandboxHook() returns true, the sandbox is guaranteed to be |
| 32 // engaged afterwards. | 32 // engaged afterwards. |
| 33 // This will be used when enabling the sandbox though | 33 // This will be used when enabling the sandbox though |
| 34 // SandboxSeccompBPF::StartSandbox(). | 34 // SandboxSeccompBPF::StartSandbox(). |
| 35 virtual bool PreSandboxHook(); | 35 virtual bool PreSandboxHook(); |
| 36 | 36 |
| 37 // Get the errno(3) to return for filesystem errors. | 37 // Get the errno(3) to return for filesystem errors. |
| 38 static int GetFSDeniedErrno(); | 38 static int GetFSDeniedErrno(); |
| 39 | 39 |
| 40 pid_t GetPolicyPid() const { return baseline_policy_->policy_pid(); } | 40 pid_t GetPolicyPid() const { return baseline_policy_->policy_pid(); } |
| 41 | 41 |
| 42 private: | 42 private: |
| 43 // Compose the BaselinePolicy from sandbox/. | 43 // Compose the BaselinePolicy from sandbox/. |
| 44 scoped_ptr<sandbox::BaselinePolicy> baseline_policy_; | 44 scoped_ptr<sandbox::BaselinePolicy> baseline_policy_; |
| 45 DISALLOW_COPY_AND_ASSIGN(SandboxBPFBasePolicy); | 45 DISALLOW_COPY_AND_ASSIGN(SandboxBPFBasePolicy); |
| 46 }; | 46 }; |
| 47 | 47 |
| 48 } // namespace content | 48 } // namespace content |
| 49 | 49 |
| 50 #endif // CONTENT_COMMON_SANDBOX_LINUX_SANDBOX_BPF_BASE_POLICY_LINUX_H_ | 50 #endif // CONTENT_COMMON_SANDBOX_LINUX_SANDBOX_BPF_BASE_POLICY_LINUX_H_ |
| OLD | NEW |