OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "sandbox/linux/seccomp-bpf/sandbox_bpf.h" | 5 #include "sandbox/linux/seccomp-bpf/sandbox_bpf.h" |
6 | 6 |
7 // Some headers on Android are missing cdefs: crbug.com/172337. | 7 // Some headers on Android are missing cdefs: crbug.com/172337. |
8 // (We can't use OS_ANDROID here since build_config.h is not included). | 8 // (We can't use OS_ANDROID here since build_config.h is not included). |
9 #if defined(ANDROID) | 9 #if defined(ANDROID) |
10 #include <sys/cdefs.h> | 10 #include <sys/cdefs.h> |
(...skipping 11 matching lines...) Expand all Loading... |
22 #include <sys/wait.h> | 22 #include <sys/wait.h> |
23 #include <time.h> | 23 #include <time.h> |
24 #include <unistd.h> | 24 #include <unistd.h> |
25 | 25 |
26 #include "base/compiler_specific.h" | 26 #include "base/compiler_specific.h" |
27 #include "base/logging.h" | 27 #include "base/logging.h" |
28 #include "base/macros.h" | 28 #include "base/macros.h" |
29 #include "base/memory/scoped_ptr.h" | 29 #include "base/memory/scoped_ptr.h" |
30 #include "base/posix/eintr_wrapper.h" | 30 #include "base/posix/eintr_wrapper.h" |
31 #include "sandbox/linux/bpf_dsl/bpf_dsl.h" | 31 #include "sandbox/linux/bpf_dsl/bpf_dsl.h" |
| 32 #include "sandbox/linux/bpf_dsl/dump_bpf.h" |
32 #include "sandbox/linux/bpf_dsl/policy.h" | 33 #include "sandbox/linux/bpf_dsl/policy.h" |
33 #include "sandbox/linux/bpf_dsl/policy_compiler.h" | 34 #include "sandbox/linux/bpf_dsl/policy_compiler.h" |
34 #include "sandbox/linux/seccomp-bpf/codegen.h" | 35 #include "sandbox/linux/seccomp-bpf/codegen.h" |
35 #include "sandbox/linux/seccomp-bpf/die.h" | 36 #include "sandbox/linux/seccomp-bpf/die.h" |
36 #include "sandbox/linux/seccomp-bpf/errorcode.h" | 37 #include "sandbox/linux/seccomp-bpf/errorcode.h" |
37 #include "sandbox/linux/seccomp-bpf/linux_seccomp.h" | 38 #include "sandbox/linux/seccomp-bpf/linux_seccomp.h" |
38 #include "sandbox/linux/seccomp-bpf/syscall.h" | 39 #include "sandbox/linux/seccomp-bpf/syscall.h" |
39 #include "sandbox/linux/seccomp-bpf/syscall_iterator.h" | 40 #include "sandbox/linux/seccomp-bpf/syscall_iterator.h" |
40 #include "sandbox/linux/seccomp-bpf/trap.h" | 41 #include "sandbox/linux/seccomp-bpf/trap.h" |
41 #include "sandbox/linux/seccomp-bpf/verifier.h" | 42 #include "sandbox/linux/seccomp-bpf/verifier.h" |
(...skipping 446 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
488 // Make sure compilation resulted in BPF program that executes | 489 // Make sure compilation resulted in BPF program that executes |
489 // correctly. Otherwise, there is an internal error in our BPF compiler. | 490 // correctly. Otherwise, there is an internal error in our BPF compiler. |
490 // There is really nothing the caller can do until the bug is fixed. | 491 // There is really nothing the caller can do until the bug is fixed. |
491 if (force_verification) { | 492 if (force_verification) { |
492 // Verification is expensive. We only perform this step, if we are | 493 // Verification is expensive. We only perform this step, if we are |
493 // compiled in debug mode, or if the caller explicitly requested | 494 // compiled in debug mode, or if the caller explicitly requested |
494 // verification. | 495 // verification. |
495 | 496 |
496 const char* err = NULL; | 497 const char* err = NULL; |
497 if (!Verifier::VerifyBPF(&compiler, *program, *policy_, &err)) { | 498 if (!Verifier::VerifyBPF(&compiler, *program, *policy_, &err)) { |
498 CodeGen::PrintProgram(*program); | 499 bpf_dsl::DumpBPF::PrintProgram(*program); |
499 SANDBOX_DIE(err); | 500 SANDBOX_DIE(err); |
500 } | 501 } |
501 } | 502 } |
502 | 503 |
503 return program.Pass(); | 504 return program.Pass(); |
504 } | 505 } |
505 | 506 |
506 bool SandboxBPF::IsRequiredForUnsafeTrap(int sysno) { | 507 bool SandboxBPF::IsRequiredForUnsafeTrap(int sysno) { |
507 return bpf_dsl::PolicyCompiler::IsRequiredForUnsafeTrap(sysno); | 508 return bpf_dsl::PolicyCompiler::IsRequiredForUnsafeTrap(sysno); |
508 } | 509 } |
509 | 510 |
510 intptr_t SandboxBPF::ForwardSyscall(const struct arch_seccomp_data& args) { | 511 intptr_t SandboxBPF::ForwardSyscall(const struct arch_seccomp_data& args) { |
511 return Syscall::Call(args.nr, | 512 return Syscall::Call(args.nr, |
512 static_cast<intptr_t>(args.args[0]), | 513 static_cast<intptr_t>(args.args[0]), |
513 static_cast<intptr_t>(args.args[1]), | 514 static_cast<intptr_t>(args.args[1]), |
514 static_cast<intptr_t>(args.args[2]), | 515 static_cast<intptr_t>(args.args[2]), |
515 static_cast<intptr_t>(args.args[3]), | 516 static_cast<intptr_t>(args.args[3]), |
516 static_cast<intptr_t>(args.args[4]), | 517 static_cast<intptr_t>(args.args[4]), |
517 static_cast<intptr_t>(args.args[5])); | 518 static_cast<intptr_t>(args.args[5])); |
518 } | 519 } |
519 | 520 |
520 SandboxBPF::SandboxStatus SandboxBPF::status_ = STATUS_UNKNOWN; | 521 SandboxBPF::SandboxStatus SandboxBPF::status_ = STATUS_UNKNOWN; |
521 | 522 |
522 } // namespace sandbox | 523 } // namespace sandbox |
OLD | NEW |