OLD | NEW |
1 // Copyright 2013 The Chromium Authors. All rights reserved. | 1 // Copyright 2013 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "components/nacl/loader/nacl_sandbox_linux.h" | 5 #include "components/nacl/loader/nacl_sandbox_linux.h" |
6 | 6 |
7 #include <errno.h> | 7 #include <errno.h> |
8 #include <signal.h> | 8 #include <signal.h> |
9 #include <sys/ptrace.h> | 9 #include <sys/ptrace.h> |
10 | 10 |
11 #include "base/basictypes.h" | 11 #include "base/basictypes.h" |
12 #include "base/callback.h" | 12 #include "base/callback.h" |
13 #include "base/compiler_specific.h" | 13 #include "base/compiler_specific.h" |
14 #include "base/logging.h" | 14 #include "base/logging.h" |
15 #include "build/build_config.h" | 15 #include "build/build_config.h" |
16 #include "content/public/common/sandbox_init.h" | 16 #include "content/public/common/sandbox_init.h" |
17 #include "sandbox/linux/seccomp-bpf/sandbox_bpf.h" | 17 #include "sandbox/linux/seccomp-bpf/sandbox_bpf.h" |
18 #include "sandbox/linux/seccomp-bpf/sandbox_bpf_policy.h" | 18 #include "sandbox/linux/seccomp-bpf/sandbox_bpf_policy.h" |
19 #include "sandbox/linux/services/linux_syscalls.h" | 19 #include "sandbox/linux/services/linux_syscalls.h" |
20 | 20 |
21 using playground2::ErrorCode; | 21 using sandbox::ErrorCode; |
22 using playground2::Sandbox; | 22 using sandbox::SandboxBPF; |
23 using playground2::SandboxBpfPolicy; | 23 using sandbox::SandboxBPFPolicy; |
24 | 24 |
25 namespace { | 25 namespace { |
26 | 26 |
27 // On ARM and x86_64, System V shared memory calls have each their own system | 27 // On ARM and x86_64, System V shared memory calls have each their own system |
28 // call, while on i386 they are multiplexed. | 28 // call, while on i386 they are multiplexed. |
29 #if defined(__x86_64__) || defined(__arm__) | 29 #if defined(__x86_64__) || defined(__arm__) |
30 bool IsSystemVSharedMemory(int sysno) { | 30 bool IsSystemVSharedMemory(int sysno) { |
31 switch (sysno) { | 31 switch (sysno) { |
32 case __NR_shmat: | 32 case __NR_shmat: |
33 case __NR_shmctl: | 33 case __NR_shmctl: |
(...skipping 11 matching lines...) Expand all Loading... |
45 bool IsSystemVIpc(int sysno) { | 45 bool IsSystemVIpc(int sysno) { |
46 switch (sysno) { | 46 switch (sysno) { |
47 case __NR_ipc: | 47 case __NR_ipc: |
48 return true; | 48 return true; |
49 default: | 49 default: |
50 return false; | 50 return false; |
51 } | 51 } |
52 } | 52 } |
53 #endif | 53 #endif |
54 | 54 |
55 class NaClBpfSandboxPolicy : public SandboxBpfPolicy { | 55 class NaClBPFSandboxPolicy : public SandboxBPFPolicy { |
56 public: | 56 public: |
57 NaClBpfSandboxPolicy() | 57 NaClBPFSandboxPolicy() |
58 : baseline_policy_(content::GetBpfSandboxBaselinePolicy()) {} | 58 : baseline_policy_(content::GetBPFSandboxBaselinePolicy()) {} |
59 virtual ~NaClBpfSandboxPolicy() {} | 59 virtual ~NaClBPFSandboxPolicy() {} |
60 | 60 |
61 virtual ErrorCode EvaluateSyscall(Sandbox* sandbox_compiler, | 61 virtual ErrorCode EvaluateSyscall(SandboxBPF* sandbox_compiler, |
62 int system_call_number) const OVERRIDE; | 62 int system_call_number) const OVERRIDE; |
63 | 63 |
64 private: | 64 private: |
65 scoped_ptr<SandboxBpfPolicy> baseline_policy_; | 65 scoped_ptr<SandboxBPFPolicy> baseline_policy_; |
66 DISALLOW_COPY_AND_ASSIGN(NaClBpfSandboxPolicy); | 66 DISALLOW_COPY_AND_ASSIGN(NaClBPFSandboxPolicy); |
67 }; | 67 }; |
68 | 68 |
69 ErrorCode NaClBpfSandboxPolicy::EvaluateSyscall( | 69 ErrorCode NaClBPFSandboxPolicy::EvaluateSyscall( |
70 playground2::Sandbox* sb, int sysno) const { | 70 sandbox::SandboxBPF* sb, int sysno) const { |
71 DCHECK(baseline_policy_); | 71 DCHECK(baseline_policy_); |
72 switch (sysno) { | 72 switch (sysno) { |
73 // TODO(jln): NaCl's GDB debug stub uses the following socket system calls, | 73 // TODO(jln): NaCl's GDB debug stub uses the following socket system calls, |
74 // see if it can be restricted a bit. | 74 // see if it can be restricted a bit. |
75 #if defined(__x86_64__) || defined(__arm__) | 75 #if defined(__x86_64__) || defined(__arm__) |
76 // transport_common.cc needs this. | 76 // transport_common.cc needs this. |
77 case __NR_accept: | 77 case __NR_accept: |
78 case __NR_setsockopt: | 78 case __NR_setsockopt: |
79 #elif defined(__i386__) | 79 #elif defined(__i386__) |
80 case __NR_socketcall: | 80 case __NR_socketcall: |
(...skipping 63 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
144 errno = 0; | 144 errno = 0; |
145 // Make a ptrace request with an invalid PID. | 145 // Make a ptrace request with an invalid PID. |
146 long ptrace_ret = ptrace(PTRACE_PEEKUSER, -1 /* pid */, NULL, NULL); | 146 long ptrace_ret = ptrace(PTRACE_PEEKUSER, -1 /* pid */, NULL, NULL); |
147 CHECK_EQ(-1, ptrace_ret); | 147 CHECK_EQ(-1, ptrace_ret); |
148 // Without the sandbox on, this ptrace call would ESRCH instead. | 148 // Without the sandbox on, this ptrace call would ESRCH instead. |
149 CHECK_EQ(EPERM, errno); | 149 CHECK_EQ(EPERM, errno); |
150 } | 150 } |
151 | 151 |
152 } // namespace | 152 } // namespace |
153 | 153 |
154 bool InitializeBpfSandbox() { | 154 bool InitializeBPFSandbox() { |
155 bool sandbox_is_initialized = content::InitializeSandbox( | 155 bool sandbox_is_initialized = content::InitializeSandbox( |
156 scoped_ptr<SandboxBpfPolicy>(new NaClBpfSandboxPolicy())); | 156 scoped_ptr<SandboxBPFPolicy>(new NaClBPFSandboxPolicy())); |
157 if (sandbox_is_initialized) { | 157 if (sandbox_is_initialized) { |
158 RunSandboxSanityChecks(); | 158 RunSandboxSanityChecks(); |
159 return true; | 159 return true; |
160 } | 160 } |
161 return false; | 161 return false; |
162 } | 162 } |
OLD | NEW |