| OLD | NEW |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "content/common/sandbox_linux/sandbox_seccomp_bpf_linux.h" | 5 #include "content/common/sandbox_linux/sandbox_seccomp_bpf_linux.h" |
| 6 | 6 |
| 7 #include <errno.h> | 7 #include <errno.h> |
| 8 #include <fcntl.h> | 8 #include <fcntl.h> |
| 9 #include <sys/socket.h> | 9 #include <sys/socket.h> |
| 10 #include <sys/stat.h> | 10 #include <sys/stat.h> |
| (...skipping 62 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 73 #if defined(__arm__) | 73 #if defined(__arm__) |
| 74 return true; | 74 return true; |
| 75 #else | 75 #else |
| 76 return false; | 76 return false; |
| 77 #endif | 77 #endif |
| 78 } | 78 } |
| 79 | 79 |
| 80 class BlacklistDebugAndNumaPolicy : public SandboxBPFBasePolicy { | 80 class BlacklistDebugAndNumaPolicy : public SandboxBPFBasePolicy { |
| 81 public: | 81 public: |
| 82 BlacklistDebugAndNumaPolicy() {} | 82 BlacklistDebugAndNumaPolicy() {} |
| 83 virtual ~BlacklistDebugAndNumaPolicy() {} | 83 ~BlacklistDebugAndNumaPolicy() override {} |
| 84 | 84 |
| 85 virtual ResultExpr EvaluateSyscall(int system_call_number) const override; | 85 ResultExpr EvaluateSyscall(int system_call_number) const override; |
| 86 | 86 |
| 87 private: | 87 private: |
| 88 DISALLOW_COPY_AND_ASSIGN(BlacklistDebugAndNumaPolicy); | 88 DISALLOW_COPY_AND_ASSIGN(BlacklistDebugAndNumaPolicy); |
| 89 }; | 89 }; |
| 90 | 90 |
| 91 ResultExpr BlacklistDebugAndNumaPolicy::EvaluateSyscall(int sysno) const { | 91 ResultExpr BlacklistDebugAndNumaPolicy::EvaluateSyscall(int sysno) const { |
| 92 if (SyscallSets::IsDebug(sysno) || SyscallSets::IsNuma(sysno)) | 92 if (SyscallSets::IsDebug(sysno) || SyscallSets::IsNuma(sysno)) |
| 93 return sandbox::CrashSIGSYS(); | 93 return sandbox::CrashSIGSYS(); |
| 94 | 94 |
| 95 return Allow(); | 95 return Allow(); |
| 96 } | 96 } |
| 97 | 97 |
| 98 class AllowAllPolicy : public SandboxBPFBasePolicy { | 98 class AllowAllPolicy : public SandboxBPFBasePolicy { |
| 99 public: | 99 public: |
| 100 AllowAllPolicy() {} | 100 AllowAllPolicy() {} |
| 101 virtual ~AllowAllPolicy() {} | 101 ~AllowAllPolicy() override {} |
| 102 | 102 |
| 103 virtual ResultExpr EvaluateSyscall(int system_call_number) const override; | 103 ResultExpr EvaluateSyscall(int system_call_number) const override; |
| 104 | 104 |
| 105 private: | 105 private: |
| 106 DISALLOW_COPY_AND_ASSIGN(AllowAllPolicy); | 106 DISALLOW_COPY_AND_ASSIGN(AllowAllPolicy); |
| 107 }; | 107 }; |
| 108 | 108 |
| 109 // Allow all syscalls. | 109 // Allow all syscalls. |
| 110 // This will still deny x32 or IA32 calls in 64 bits mode or | 110 // This will still deny x32 or IA32 calls in 64 bits mode or |
| 111 // 64 bits system calls in compatibility mode. | 111 // 64 bits system calls in compatibility mode. |
| 112 ResultExpr AllowAllPolicy::EvaluateSyscall(int sysno) const { | 112 ResultExpr AllowAllPolicy::EvaluateSyscall(int sysno) const { |
| 113 return Allow(); | 113 return Allow(); |
| (...skipping 179 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 293 | 293 |
| 294 scoped_ptr<sandbox::bpf_dsl::Policy> SandboxSeccompBPF::GetBaselinePolicy() { | 294 scoped_ptr<sandbox::bpf_dsl::Policy> SandboxSeccompBPF::GetBaselinePolicy() { |
| 295 #if defined(USE_SECCOMP_BPF) | 295 #if defined(USE_SECCOMP_BPF) |
| 296 return scoped_ptr<sandbox::bpf_dsl::Policy>(new BaselinePolicy); | 296 return scoped_ptr<sandbox::bpf_dsl::Policy>(new BaselinePolicy); |
| 297 #else | 297 #else |
| 298 return scoped_ptr<sandbox::bpf_dsl::Policy>(); | 298 return scoped_ptr<sandbox::bpf_dsl::Policy>(); |
| 299 #endif // defined(USE_SECCOMP_BPF) | 299 #endif // defined(USE_SECCOMP_BPF) |
| 300 } | 300 } |
| 301 | 301 |
| 302 } // namespace content | 302 } // namespace content |
| OLD | NEW |