OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "sandbox/linux/seccomp-bpf/sandbox_bpf.h" | 5 #include "sandbox/linux/seccomp-bpf/sandbox_bpf.h" |
6 | 6 |
7 // Some headers on Android are missing cdefs: crbug.com/172337. | 7 // Some headers on Android are missing cdefs: crbug.com/172337. |
8 // (We can't use OS_ANDROID here since build_config.h is not included). | 8 // (We can't use OS_ANDROID here since build_config.h is not included). |
9 #if defined(ANDROID) | 9 #if defined(ANDROID) |
10 #include <sys/cdefs.h> | 10 #include <sys/cdefs.h> |
(...skipping 61 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
72 if (rv == -1 && errno == EFAULT) { | 72 if (rv == -1 && errno == EFAULT) { |
73 return true; | 73 return true; |
74 } else { | 74 } else { |
75 // TODO(jln): turn these into DCHECK after 417888 is considered fixed. | 75 // TODO(jln): turn these into DCHECK after 417888 is considered fixed. |
76 CHECK_EQ(-1, rv); | 76 CHECK_EQ(-1, rv); |
77 CHECK(ENOSYS == errno || EINVAL == errno); | 77 CHECK(ENOSYS == errno || EINVAL == errno); |
78 return false; | 78 return false; |
79 } | 79 } |
80 } | 80 } |
81 | 81 |
82 uint64_t EscapePC() { | |
83 intptr_t rv = Syscall::Call(-1); | |
84 if (rv == -1 && errno == ENOSYS) { | |
85 return 0; | |
86 } | |
87 return static_cast<uint64_t>(static_cast<uintptr_t>(rv)); | |
88 } | |
89 | |
90 } // namespace | 82 } // namespace |
91 | 83 |
92 SandboxBPF::SandboxBPF(bpf_dsl::Policy* policy) | 84 SandboxBPF::SandboxBPF(bpf_dsl::Policy* policy) |
93 : proc_task_fd_(), sandbox_has_started_(false), policy_(policy) { | 85 : proc_task_fd_(), sandbox_has_started_(false), policy_(policy) { |
94 } | 86 } |
95 | 87 |
96 SandboxBPF::~SandboxBPF() { | 88 SandboxBPF::~SandboxBPF() { |
97 } | 89 } |
98 | 90 |
99 // static | 91 // static |
(...skipping 86 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
186 static_cast<intptr_t>(args.args[5])); | 178 static_cast<intptr_t>(args.args[5])); |
187 } | 179 } |
188 | 180 |
189 scoped_ptr<CodeGen::Program> SandboxBPF::AssembleFilter( | 181 scoped_ptr<CodeGen::Program> SandboxBPF::AssembleFilter( |
190 bool force_verification) { | 182 bool force_verification) { |
191 #if !defined(NDEBUG) | 183 #if !defined(NDEBUG) |
192 force_verification = true; | 184 force_verification = true; |
193 #endif | 185 #endif |
194 DCHECK(policy_); | 186 DCHECK(policy_); |
195 bpf_dsl::PolicyCompiler compiler(policy_.get(), Trap::Registry()); | 187 bpf_dsl::PolicyCompiler compiler(policy_.get(), Trap::Registry()); |
196 if (Trap::SandboxDebuggingAllowedByUser()) { | |
197 compiler.DangerousSetEscapePC(EscapePC()); | |
198 } | |
199 scoped_ptr<CodeGen::Program> program = compiler.Compile(); | 188 scoped_ptr<CodeGen::Program> program = compiler.Compile(); |
200 | 189 |
201 // Make sure compilation resulted in a BPF program that executes | 190 // Make sure compilation resulted in a BPF program that executes |
202 // correctly. Otherwise, there is an internal error in our BPF compiler. | 191 // correctly. Otherwise, there is an internal error in our BPF compiler. |
203 // There is really nothing the caller can do until the bug is fixed. | 192 // There is really nothing the caller can do until the bug is fixed. |
204 if (force_verification) { | 193 if (force_verification) { |
205 // Verification is expensive. We only perform this step, if we are | 194 // Verification is expensive. We only perform this step, if we are |
206 // compiled in debug mode, or if the caller explicitly requested | 195 // compiled in debug mode, or if the caller explicitly requested |
207 // verification. | 196 // verification. |
208 | 197 |
(...skipping 49 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
258 } else { | 247 } else { |
259 if (prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog)) { | 248 if (prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog)) { |
260 SANDBOX_DIE("Kernel refuses to turn on BPF filters"); | 249 SANDBOX_DIE("Kernel refuses to turn on BPF filters"); |
261 } | 250 } |
262 } | 251 } |
263 | 252 |
264 sandbox_has_started_ = true; | 253 sandbox_has_started_ = true; |
265 } | 254 } |
266 | 255 |
267 } // namespace sandbox | 256 } // namespace sandbox |
OLD | NEW |