| OLD | NEW |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "sandbox/linux/seccomp-bpf/sandbox_bpf.h" | 5 #include "sandbox/linux/seccomp-bpf/sandbox_bpf.h" |
| 6 | 6 |
| 7 // Some headers on Android are missing cdefs: crbug.com/172337. | 7 // Some headers on Android are missing cdefs: crbug.com/172337. |
| 8 // (We can't use OS_ANDROID here since build_config.h is not included). | 8 // (We can't use OS_ANDROID here since build_config.h is not included). |
| 9 #if defined(ANDROID) | 9 #if defined(ANDROID) |
| 10 #include <sys/cdefs.h> | 10 #include <sys/cdefs.h> |
| (...skipping 11 matching lines...) Expand all Loading... |
| 22 #include <sys/wait.h> | 22 #include <sys/wait.h> |
| 23 #include <time.h> | 23 #include <time.h> |
| 24 #include <unistd.h> | 24 #include <unistd.h> |
| 25 | 25 |
| 26 #include "base/compiler_specific.h" | 26 #include "base/compiler_specific.h" |
| 27 #include "base/logging.h" | 27 #include "base/logging.h" |
| 28 #include "base/macros.h" | 28 #include "base/macros.h" |
| 29 #include "base/memory/scoped_ptr.h" | 29 #include "base/memory/scoped_ptr.h" |
| 30 #include "base/posix/eintr_wrapper.h" | 30 #include "base/posix/eintr_wrapper.h" |
| 31 #include "sandbox/linux/bpf_dsl/bpf_dsl.h" | 31 #include "sandbox/linux/bpf_dsl/bpf_dsl.h" |
| 32 #include "sandbox/linux/bpf_dsl/dump_bpf.h" |
| 32 #include "sandbox/linux/bpf_dsl/policy.h" | 33 #include "sandbox/linux/bpf_dsl/policy.h" |
| 33 #include "sandbox/linux/bpf_dsl/policy_compiler.h" | 34 #include "sandbox/linux/bpf_dsl/policy_compiler.h" |
| 34 #include "sandbox/linux/seccomp-bpf/codegen.h" | 35 #include "sandbox/linux/seccomp-bpf/codegen.h" |
| 35 #include "sandbox/linux/seccomp-bpf/die.h" | 36 #include "sandbox/linux/seccomp-bpf/die.h" |
| 36 #include "sandbox/linux/seccomp-bpf/errorcode.h" | 37 #include "sandbox/linux/seccomp-bpf/errorcode.h" |
| 37 #include "sandbox/linux/seccomp-bpf/linux_seccomp.h" | 38 #include "sandbox/linux/seccomp-bpf/linux_seccomp.h" |
| 38 #include "sandbox/linux/seccomp-bpf/syscall.h" | 39 #include "sandbox/linux/seccomp-bpf/syscall.h" |
| 39 #include "sandbox/linux/seccomp-bpf/syscall_iterator.h" | 40 #include "sandbox/linux/seccomp-bpf/syscall_iterator.h" |
| 40 #include "sandbox/linux/seccomp-bpf/trap.h" | 41 #include "sandbox/linux/seccomp-bpf/trap.h" |
| 41 #include "sandbox/linux/seccomp-bpf/verifier.h" | 42 #include "sandbox/linux/seccomp-bpf/verifier.h" |
| (...skipping 446 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 488 // Make sure compilation resulted in BPF program that executes | 489 // Make sure compilation resulted in BPF program that executes |
| 489 // correctly. Otherwise, there is an internal error in our BPF compiler. | 490 // correctly. Otherwise, there is an internal error in our BPF compiler. |
| 490 // There is really nothing the caller can do until the bug is fixed. | 491 // There is really nothing the caller can do until the bug is fixed. |
| 491 if (force_verification) { | 492 if (force_verification) { |
| 492 // Verification is expensive. We only perform this step, if we are | 493 // Verification is expensive. We only perform this step, if we are |
| 493 // compiled in debug mode, or if the caller explicitly requested | 494 // compiled in debug mode, or if the caller explicitly requested |
| 494 // verification. | 495 // verification. |
| 495 | 496 |
| 496 const char* err = NULL; | 497 const char* err = NULL; |
| 497 if (!Verifier::VerifyBPF(&compiler, *program, *policy_, &err)) { | 498 if (!Verifier::VerifyBPF(&compiler, *program, *policy_, &err)) { |
| 498 CodeGen::PrintProgram(*program); | 499 bpf_dsl::DumpBPF::PrintProgram(*program); |
| 499 SANDBOX_DIE(err); | 500 SANDBOX_DIE(err); |
| 500 } | 501 } |
| 501 } | 502 } |
| 502 | 503 |
| 503 return program.Pass(); | 504 return program.Pass(); |
| 504 } | 505 } |
| 505 | 506 |
| 506 bool SandboxBPF::IsRequiredForUnsafeTrap(int sysno) { | 507 bool SandboxBPF::IsRequiredForUnsafeTrap(int sysno) { |
| 507 return bpf_dsl::PolicyCompiler::IsRequiredForUnsafeTrap(sysno); | 508 return bpf_dsl::PolicyCompiler::IsRequiredForUnsafeTrap(sysno); |
| 508 } | 509 } |
| 509 | 510 |
| 510 intptr_t SandboxBPF::ForwardSyscall(const struct arch_seccomp_data& args) { | 511 intptr_t SandboxBPF::ForwardSyscall(const struct arch_seccomp_data& args) { |
| 511 return Syscall::Call(args.nr, | 512 return Syscall::Call(args.nr, |
| 512 static_cast<intptr_t>(args.args[0]), | 513 static_cast<intptr_t>(args.args[0]), |
| 513 static_cast<intptr_t>(args.args[1]), | 514 static_cast<intptr_t>(args.args[1]), |
| 514 static_cast<intptr_t>(args.args[2]), | 515 static_cast<intptr_t>(args.args[2]), |
| 515 static_cast<intptr_t>(args.args[3]), | 516 static_cast<intptr_t>(args.args[3]), |
| 516 static_cast<intptr_t>(args.args[4]), | 517 static_cast<intptr_t>(args.args[4]), |
| 517 static_cast<intptr_t>(args.args[5])); | 518 static_cast<intptr_t>(args.args[5])); |
| 518 } | 519 } |
| 519 | 520 |
| 520 SandboxBPF::SandboxStatus SandboxBPF::status_ = STATUS_UNKNOWN; | 521 SandboxBPF::SandboxStatus SandboxBPF::status_ = STATUS_UNKNOWN; |
| 521 | 522 |
| 522 } // namespace sandbox | 523 } // namespace sandbox |
| OLD | NEW |