| OLD | NEW |
| 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "sandbox/linux/seccomp-bpf-helpers/baseline_policy.h" | 5 #include "sandbox/linux/seccomp-bpf-helpers/baseline_policy.h" |
| 6 | 6 |
| 7 #include <errno.h> | 7 #include <errno.h> |
| 8 #include <sys/mman.h> | 8 #include <sys/mman.h> |
| 9 #include <sys/socket.h> | 9 #include <sys/socket.h> |
| 10 #include <sys/syscall.h> | 10 #include <sys/syscall.h> |
| (...skipping 91 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 102 defined(MEMORY_SANITIZER) | 102 defined(MEMORY_SANITIZER) |
| 103 // TCGETS is required by the sanitizers on failure. | 103 // TCGETS is required by the sanitizers on failure. |
| 104 if (sysno == __NR_ioctl) { | 104 if (sysno == __NR_ioctl) { |
| 105 return RestrictIoctl(); | 105 return RestrictIoctl(); |
| 106 } | 106 } |
| 107 | 107 |
| 108 if (sysno == __NR_sched_getaffinity) { | 108 if (sysno == __NR_sched_getaffinity) { |
| 109 return Allow(); | 109 return Allow(); |
| 110 } | 110 } |
| 111 | 111 |
| 112 // Used when RSS limiting is enabled in sanitizers. |
| 113 if (sysno == __NR_getrusage) { |
| 114 return RestrictGetrusage(); |
| 115 } |
| 116 |
| 112 if (sysno == __NR_sigaltstack) { | 117 if (sysno == __NR_sigaltstack) { |
| 113 // Required for better stack overflow detection in ASan. Disallowed in | 118 // Required for better stack overflow detection in ASan. Disallowed in |
| 114 // non-ASan builds. | 119 // non-ASan builds. |
| 115 return Allow(); | 120 return Allow(); |
| 116 } | 121 } |
| 117 #endif // defined(ADDRESS_SANITIZER) || defined(THREAD_SANITIZER) || | 122 #endif // defined(ADDRESS_SANITIZER) || defined(THREAD_SANITIZER) || |
| 118 // defined(MEMORY_SANITIZER) | 123 // defined(MEMORY_SANITIZER) |
| 119 | 124 |
| 120 if (IsBaselinePolicyAllowed(sysno)) { | 125 if (IsBaselinePolicyAllowed(sysno)) { |
| 121 return Allow(); | 126 return Allow(); |
| (...skipping 134 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 256 DCHECK_EQ(sys_getpid(), policy_pid_); | 261 DCHECK_EQ(sys_getpid(), policy_pid_); |
| 257 } | 262 } |
| 258 return EvaluateSyscallImpl(fs_denied_errno_, policy_pid_, sysno); | 263 return EvaluateSyscallImpl(fs_denied_errno_, policy_pid_, sysno); |
| 259 } | 264 } |
| 260 | 265 |
| 261 ResultExpr BaselinePolicy::InvalidSyscall() const { | 266 ResultExpr BaselinePolicy::InvalidSyscall() const { |
| 262 return CrashSIGSYS(); | 267 return CrashSIGSYS(); |
| 263 } | 268 } |
| 264 | 269 |
| 265 } // namespace sandbox. | 270 } // namespace sandbox. |
| OLD | NEW |