| OLD | NEW |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #ifndef SANDBOX_LINUX_SECCOMP_BPF_TRAP_H__ | 5 #ifndef SANDBOX_LINUX_SECCOMP_BPF_TRAP_H__ |
| 6 #define SANDBOX_LINUX_SECCOMP_BPF_TRAP_H__ | 6 #define SANDBOX_LINUX_SECCOMP_BPF_TRAP_H__ |
| 7 | 7 |
| 8 #include <signal.h> | 8 #include <signal.h> |
| 9 #include <stdint.h> | 9 #include <stdint.h> |
| 10 | 10 |
| 11 #include <map> | 11 #include <map> |
| 12 | 12 |
| 13 #include "base/macros.h" | 13 #include "base/macros.h" |
| 14 #include "sandbox/linux/bpf_dsl/trap_registry.h" | 14 #include "sandbox/linux/bpf_dsl/trap_registry.h" |
| 15 #include "sandbox/sandbox_export.h" | 15 #include "sandbox/sandbox_export.h" |
| 16 | 16 |
| 17 namespace sandbox { | 17 namespace sandbox { |
| 18 | 18 |
| 19 // The Trap class allows a BPF filter program to branch out to user space by | 19 // The Trap class allows a BPF filter program to branch out to user space by |
| 20 // raising a SIGSYS signal. | 20 // raising a SIGSYS signal. |
| 21 // N.B.: This class does not perform any synchronization operations. If | 21 // N.B.: This class does not perform any synchronization operations. If |
| 22 // modifications are made to any of the traps, it is the caller's | 22 // modifications are made to any of the traps, it is the caller's |
| 23 // responsibility to ensure that this happens in a thread-safe fashion. | 23 // responsibility to ensure that this happens in a thread-safe fashion. |
| 24 // Preferably, that means that no other threads should be running at that | 24 // Preferably, that means that no other threads should be running at that |
| 25 // time. For the purposes of our sandbox, this assertion should always be | 25 // time. For the purposes of our sandbox, this assertion should always be |
| 26 // true. Threads are incompatible with the seccomp sandbox anyway. | 26 // true. Threads are incompatible with the seccomp sandbox anyway. |
| 27 class SANDBOX_EXPORT Trap : public bpf_dsl::TrapRegistry { | 27 class SANDBOX_EXPORT Trap : public bpf_dsl::TrapRegistry { |
| 28 public: | 28 public: |
| 29 virtual uint16_t Add(TrapFnc fnc, const void* aux, bool safe) override; | 29 uint16_t Add(TrapFnc fnc, const void* aux, bool safe) override; |
| 30 | 30 |
| 31 virtual bool EnableUnsafeTraps() override; | 31 bool EnableUnsafeTraps() override; |
| 32 | 32 |
| 33 // Registry returns the trap registry used by Trap's SIGSYS handler, | 33 // Registry returns the trap registry used by Trap's SIGSYS handler, |
| 34 // creating it if necessary. | 34 // creating it if necessary. |
| 35 static bpf_dsl::TrapRegistry* Registry(); | 35 static bpf_dsl::TrapRegistry* Registry(); |
| 36 | 36 |
| 37 // Registers a new trap handler and sets up the appropriate SIGSYS handler | 37 // Registers a new trap handler and sets up the appropriate SIGSYS handler |
| 38 // as needed. | 38 // as needed. |
| 39 // N.B.: This makes a permanent state change. Traps cannot be unregistered, | 39 // N.B.: This makes a permanent state change. Traps cannot be unregistered, |
| 40 // as that would break existing BPF filters that are still active. | 40 // as that would break existing BPF filters that are still active. |
| 41 // TODO(mdempsky): Deprecated; remove. | 41 // TODO(mdempsky): Deprecated; remove. |
| (...skipping 50 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 92 bool has_unsafe_traps_; // Whether unsafe traps have been enabled | 92 bool has_unsafe_traps_; // Whether unsafe traps have been enabled |
| 93 | 93 |
| 94 // Copying and assigning is unimplemented. It doesn't make sense for a | 94 // Copying and assigning is unimplemented. It doesn't make sense for a |
| 95 // singleton. | 95 // singleton. |
| 96 DISALLOW_COPY_AND_ASSIGN(Trap); | 96 DISALLOW_COPY_AND_ASSIGN(Trap); |
| 97 }; | 97 }; |
| 98 | 98 |
| 99 } // namespace sandbox | 99 } // namespace sandbox |
| 100 | 100 |
| 101 #endif // SANDBOX_LINUX_SECCOMP_BPF_TRAP_H__ | 101 #endif // SANDBOX_LINUX_SECCOMP_BPF_TRAP_H__ |
| OLD | NEW |