| OLD | NEW |
| 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "sandbox/linux/seccomp-bpf-helpers/baseline_policy.h" | 5 #include "sandbox/linux/seccomp-bpf-helpers/baseline_policy.h" |
| 6 | 6 |
| 7 #include <errno.h> | 7 #include <errno.h> |
| 8 #include <sys/mman.h> | 8 #include <sys/mman.h> |
| 9 #include <sys/socket.h> | 9 #include <sys/socket.h> |
| 10 #include <sys/syscall.h> | 10 #include <sys/syscall.h> |
| 11 #include <sys/types.h> | 11 #include <sys/types.h> |
| 12 #include <unistd.h> | 12 #include <unistd.h> |
| 13 | 13 |
| 14 #include "base/logging.h" | 14 #include "base/logging.h" |
| 15 #include "build/build_config.h" | 15 #include "build/build_config.h" |
| 16 #include "sandbox/linux/bpf_dsl/bpf_dsl.h" | 16 #include "sandbox/linux/bpf_dsl/bpf_dsl.h" |
| 17 #include "sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.h" | 17 #include "sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.h" |
| 18 #include "sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.h" | 18 #include "sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.h" |
| 19 #include "sandbox/linux/seccomp-bpf-helpers/syscall_sets.h" | 19 #include "sandbox/linux/seccomp-bpf-helpers/syscall_sets.h" |
| 20 #include "sandbox/linux/seccomp-bpf/sandbox_bpf.h" | 20 #include "sandbox/linux/seccomp-bpf/sandbox_bpf.h" |
| 21 #include "sandbox/linux/services/linux_syscalls.h" | 21 #include "sandbox/linux/services/linux_syscalls.h" |
| 22 #include "sandbox/linux/services/syscall_wrappers.h" |
| 22 | 23 |
| 23 // Changing this implementation will have an effect on *all* policies. | 24 // Changing this implementation will have an effect on *all* policies. |
| 24 // Currently this means: Renderer/Worker, GPU, Flash and NaCl. | 25 // Currently this means: Renderer/Worker, GPU, Flash and NaCl. |
| 25 | 26 |
| 26 using sandbox::bpf_dsl::Allow; | 27 using sandbox::bpf_dsl::Allow; |
| 27 using sandbox::bpf_dsl::Arg; | 28 using sandbox::bpf_dsl::Arg; |
| 28 using sandbox::bpf_dsl::Error; | 29 using sandbox::bpf_dsl::Error; |
| 29 using sandbox::bpf_dsl::If; | 30 using sandbox::bpf_dsl::If; |
| 30 using sandbox::bpf_dsl::ResultExpr; | 31 using sandbox::bpf_dsl::ResultExpr; |
| 31 | 32 |
| (...skipping 198 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 230 return CrashSIGSYS(); | 231 return CrashSIGSYS(); |
| 231 } | 232 } |
| 232 | 233 |
| 233 } // namespace. | 234 } // namespace. |
| 234 | 235 |
| 235 // Unfortunately C++03 doesn't allow delegated constructors. | 236 // Unfortunately C++03 doesn't allow delegated constructors. |
| 236 // Call other constructor when C++11 lands. | 237 // Call other constructor when C++11 lands. |
| 237 BaselinePolicy::BaselinePolicy() : BaselinePolicy(EPERM) {} | 238 BaselinePolicy::BaselinePolicy() : BaselinePolicy(EPERM) {} |
| 238 | 239 |
| 239 BaselinePolicy::BaselinePolicy(int fs_denied_errno) | 240 BaselinePolicy::BaselinePolicy(int fs_denied_errno) |
| 240 : fs_denied_errno_(fs_denied_errno), policy_pid_(syscall(__NR_getpid)) {} | 241 : fs_denied_errno_(fs_denied_errno), policy_pid_(sys_getpid()) { |
| 242 } |
| 241 | 243 |
| 242 BaselinePolicy::~BaselinePolicy() { | 244 BaselinePolicy::~BaselinePolicy() { |
| 243 // Make sure that this policy is created, used and destroyed by a single | 245 // Make sure that this policy is created, used and destroyed by a single |
| 244 // process. | 246 // process. |
| 245 DCHECK_EQ(syscall(__NR_getpid), policy_pid_); | 247 DCHECK_EQ(sys_getpid(), policy_pid_); |
| 246 } | 248 } |
| 247 | 249 |
| 248 ResultExpr BaselinePolicy::EvaluateSyscall(int sysno) const { | 250 ResultExpr BaselinePolicy::EvaluateSyscall(int sysno) const { |
| 249 // Sanity check that we're only called with valid syscall numbers. | 251 // Sanity check that we're only called with valid syscall numbers. |
| 250 DCHECK(SandboxBPF::IsValidSyscallNumber(sysno)); | 252 DCHECK(SandboxBPF::IsValidSyscallNumber(sysno)); |
| 251 // Make sure that this policy is used in the creating process. | 253 // Make sure that this policy is used in the creating process. |
| 252 if (1 == sysno) { | 254 if (1 == sysno) { |
| 253 DCHECK_EQ(syscall(__NR_getpid), policy_pid_); | 255 DCHECK_EQ(sys_getpid(), policy_pid_); |
| 254 } | 256 } |
| 255 return EvaluateSyscallImpl(fs_denied_errno_, policy_pid_, sysno); | 257 return EvaluateSyscallImpl(fs_denied_errno_, policy_pid_, sysno); |
| 256 } | 258 } |
| 257 | 259 |
| 258 ResultExpr BaselinePolicy::InvalidSyscall() const { | 260 ResultExpr BaselinePolicy::InvalidSyscall() const { |
| 259 return CrashSIGSYS(); | 261 return CrashSIGSYS(); |
| 260 } | 262 } |
| 261 | 263 |
| 262 } // namespace sandbox. | 264 } // namespace sandbox. |
| OLD | NEW |