| OLD | NEW |
| 1 // Copyright 2014 The Chromium Authors. All rights reserved. | 1 // Copyright 2014 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.h" | 5 #include "sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.h" |
| 6 | 6 |
| 7 #include <errno.h> | 7 #include <errno.h> |
| 8 #include <sched.h> | 8 #include <sched.h> |
| 9 #include <sys/resource.h> | 9 #include <sys/resource.h> |
| 10 #include <sys/syscall.h> | 10 #include <sys/syscall.h> |
| (...skipping 74 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 85 | 85 |
| 86 #if defined(OS_CHROMEOS) | 86 #if defined(OS_CHROMEOS) |
| 87 | 87 |
| 88 // A custom BPF tester delegate to run IsRunningOnChromeOS() before | 88 // A custom BPF tester delegate to run IsRunningOnChromeOS() before |
| 89 // the sandbox is enabled because we cannot run it with non-SFI BPF | 89 // the sandbox is enabled because we cannot run it with non-SFI BPF |
| 90 // sandbox enabled. | 90 // sandbox enabled. |
| 91 class ClockSystemTesterDelegate : public sandbox::BPFTesterDelegate { | 91 class ClockSystemTesterDelegate : public sandbox::BPFTesterDelegate { |
| 92 public: | 92 public: |
| 93 ClockSystemTesterDelegate() | 93 ClockSystemTesterDelegate() |
| 94 : is_running_on_chromeos_(base::SysInfo::IsRunningOnChromeOS()) {} | 94 : is_running_on_chromeos_(base::SysInfo::IsRunningOnChromeOS()) {} |
| 95 virtual ~ClockSystemTesterDelegate() {} | 95 ~ClockSystemTesterDelegate() override {} |
| 96 | 96 |
| 97 virtual scoped_ptr<sandbox::bpf_dsl::Policy> GetSandboxBPFPolicy() override { | 97 scoped_ptr<sandbox::bpf_dsl::Policy> GetSandboxBPFPolicy() override { |
| 98 return scoped_ptr<sandbox::bpf_dsl::Policy>(new RestrictClockIdPolicy()); | 98 return scoped_ptr<sandbox::bpf_dsl::Policy>(new RestrictClockIdPolicy()); |
| 99 } | 99 } |
| 100 virtual void RunTestFunction() override { | 100 void RunTestFunction() override { |
| 101 if (is_running_on_chromeos_) { | 101 if (is_running_on_chromeos_) { |
| 102 CheckClock(base::TimeTicks::kClockSystemTrace); | 102 CheckClock(base::TimeTicks::kClockSystemTrace); |
| 103 } else { | 103 } else { |
| 104 struct timespec ts; | 104 struct timespec ts; |
| 105 // kClockSystemTrace is 11, which is CLOCK_THREAD_CPUTIME_ID of | 105 // kClockSystemTrace is 11, which is CLOCK_THREAD_CPUTIME_ID of |
| 106 // the init process (pid=1). If kernel supports this feature, | 106 // the init process (pid=1). If kernel supports this feature, |
| 107 // this may succeed even if this is not running on Chrome OS. We | 107 // this may succeed even if this is not running on Chrome OS. We |
| 108 // just check this clock_gettime call does not crash. | 108 // just check this clock_gettime call does not crash. |
| 109 clock_gettime(base::TimeTicks::kClockSystemTrace, &ts); | 109 clock_gettime(base::TimeTicks::kClockSystemTrace, &ts); |
| 110 } | 110 } |
| (...skipping 125 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 236 DEATH_SEGV_MESSAGE(sandbox::GetErrorMessageContentForTests()), | 236 DEATH_SEGV_MESSAGE(sandbox::GetErrorMessageContentForTests()), |
| 237 RestrictPrlimit64Policy) { | 237 RestrictPrlimit64Policy) { |
| 238 const pid_t kInitPID = 1; | 238 const pid_t kInitPID = 1; |
| 239 BPF_ASSERT_NE(kInitPID, getpid()); | 239 BPF_ASSERT_NE(kInitPID, getpid()); |
| 240 sys_prlimit64(kInitPID, RLIMIT_AS, NULL, NULL); | 240 sys_prlimit64(kInitPID, RLIMIT_AS, NULL, NULL); |
| 241 } | 241 } |
| 242 | 242 |
| 243 } // namespace | 243 } // namespace |
| 244 | 244 |
| 245 } // namespace sandbox | 245 } // namespace sandbox |
| OLD | NEW |