Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(165)

Side by Side Diff: sandbox/linux/seccomp-bpf-helpers/baseline_policy.cc

Issue 754433003: Update from https://crrev.com/305340 (Closed) Base URL: git@github.com:domokit/mojo.git@master
Patch Set: Created 6 years ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
OLDNEW
1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be 2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file. 3 // found in the LICENSE file.
4 4
5 #include "sandbox/linux/seccomp-bpf-helpers/baseline_policy.h" 5 #include "sandbox/linux/seccomp-bpf-helpers/baseline_policy.h"
6 6
7 #include <errno.h> 7 #include <errno.h>
8 #include <sys/mman.h> 8 #include <sys/mman.h>
9 #include <sys/socket.h> 9 #include <sys/socket.h>
10 #include <sys/syscall.h> 10 #include <sys/syscall.h>
11 #include <sys/types.h> 11 #include <sys/types.h>
12 #include <unistd.h> 12 #include <unistd.h>
13 13
14 #include "base/logging.h" 14 #include "base/logging.h"
15 #include "build/build_config.h" 15 #include "build/build_config.h"
16 #include "sandbox/linux/bpf_dsl/bpf_dsl.h" 16 #include "sandbox/linux/bpf_dsl/bpf_dsl.h"
17 #include "sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.h" 17 #include "sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.h"
18 #include "sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.h" 18 #include "sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.h"
19 #include "sandbox/linux/seccomp-bpf-helpers/syscall_sets.h" 19 #include "sandbox/linux/seccomp-bpf-helpers/syscall_sets.h"
20 #include "sandbox/linux/seccomp-bpf/sandbox_bpf.h" 20 #include "sandbox/linux/seccomp-bpf/sandbox_bpf.h"
21 #include "sandbox/linux/services/linux_syscalls.h" 21 #include "sandbox/linux/services/linux_syscalls.h"
22 #include "sandbox/linux/services/syscall_wrappers.h"
22 23
23 // Changing this implementation will have an effect on *all* policies. 24 // Changing this implementation will have an effect on *all* policies.
24 // Currently this means: Renderer/Worker, GPU, Flash and NaCl. 25 // Currently this means: Renderer/Worker, GPU, Flash and NaCl.
25 26
26 using sandbox::bpf_dsl::Allow; 27 using sandbox::bpf_dsl::Allow;
27 using sandbox::bpf_dsl::Arg; 28 using sandbox::bpf_dsl::Arg;
28 using sandbox::bpf_dsl::Error; 29 using sandbox::bpf_dsl::Error;
29 using sandbox::bpf_dsl::If; 30 using sandbox::bpf_dsl::If;
30 using sandbox::bpf_dsl::ResultExpr; 31 using sandbox::bpf_dsl::ResultExpr;
31 32
(...skipping 198 matching lines...) Expand 10 before | Expand all | Expand 10 after
230 return CrashSIGSYS(); 231 return CrashSIGSYS();
231 } 232 }
232 233
233 } // namespace. 234 } // namespace.
234 235
235 // Unfortunately C++03 doesn't allow delegated constructors. 236 // Unfortunately C++03 doesn't allow delegated constructors.
236 // Call other constructor when C++11 lands. 237 // Call other constructor when C++11 lands.
237 BaselinePolicy::BaselinePolicy() : BaselinePolicy(EPERM) {} 238 BaselinePolicy::BaselinePolicy() : BaselinePolicy(EPERM) {}
238 239
239 BaselinePolicy::BaselinePolicy(int fs_denied_errno) 240 BaselinePolicy::BaselinePolicy(int fs_denied_errno)
240 : fs_denied_errno_(fs_denied_errno), policy_pid_(syscall(__NR_getpid)) {} 241 : fs_denied_errno_(fs_denied_errno), policy_pid_(sys_getpid()) {
242 }
241 243
242 BaselinePolicy::~BaselinePolicy() { 244 BaselinePolicy::~BaselinePolicy() {
243 // Make sure that this policy is created, used and destroyed by a single 245 // Make sure that this policy is created, used and destroyed by a single
244 // process. 246 // process.
245 DCHECK_EQ(syscall(__NR_getpid), policy_pid_); 247 DCHECK_EQ(sys_getpid(), policy_pid_);
246 } 248 }
247 249
248 ResultExpr BaselinePolicy::EvaluateSyscall(int sysno) const { 250 ResultExpr BaselinePolicy::EvaluateSyscall(int sysno) const {
249 // Sanity check that we're only called with valid syscall numbers. 251 // Sanity check that we're only called with valid syscall numbers.
250 DCHECK(SandboxBPF::IsValidSyscallNumber(sysno)); 252 DCHECK(SandboxBPF::IsValidSyscallNumber(sysno));
251 // Make sure that this policy is used in the creating process. 253 // Make sure that this policy is used in the creating process.
252 if (1 == sysno) { 254 if (1 == sysno) {
253 DCHECK_EQ(syscall(__NR_getpid), policy_pid_); 255 DCHECK_EQ(sys_getpid(), policy_pid_);
254 } 256 }
255 return EvaluateSyscallImpl(fs_denied_errno_, policy_pid_, sysno); 257 return EvaluateSyscallImpl(fs_denied_errno_, policy_pid_, sysno);
256 } 258 }
257 259
258 ResultExpr BaselinePolicy::InvalidSyscall() const { 260 ResultExpr BaselinePolicy::InvalidSyscall() const {
259 return CrashSIGSYS(); 261 return CrashSIGSYS();
260 } 262 }
261 263
262 } // namespace sandbox. 264 } // namespace sandbox.
OLDNEW
« no previous file with comments | « sandbox/linux/sandbox_linux_test_sources.gypi ('k') | sandbox/linux/seccomp-bpf-helpers/baseline_policy_unittest.cc » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698