Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(185)

Side by Side Diff: components/nacl/loader/nacl_sandbox_linux.cc

Issue 101773003: Linux sandbox: cleanup sandbox-bpf naming. (Closed) Base URL: svn://svn.chromium.org/chrome/trunk/src
Patch Set: Address namespace sandbox nits. Created 7 years ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch | Annotate | Revision Log
OLDNEW
1 // Copyright 2013 The Chromium Authors. All rights reserved. 1 // Copyright 2013 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be 2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file. 3 // found in the LICENSE file.
4 4
5 #include "components/nacl/loader/nacl_sandbox_linux.h" 5 #include "components/nacl/loader/nacl_sandbox_linux.h"
6 6
7 #include <errno.h> 7 #include <errno.h>
8 #include <signal.h> 8 #include <signal.h>
9 #include <sys/ptrace.h> 9 #include <sys/ptrace.h>
10 10
11 #include "base/basictypes.h" 11 #include "base/basictypes.h"
12 #include "base/callback.h" 12 #include "base/callback.h"
13 #include "base/compiler_specific.h" 13 #include "base/compiler_specific.h"
14 #include "base/logging.h" 14 #include "base/logging.h"
15 #include "build/build_config.h" 15 #include "build/build_config.h"
16 #include "content/public/common/sandbox_init.h" 16 #include "content/public/common/sandbox_init.h"
17 #include "sandbox/linux/seccomp-bpf/sandbox_bpf.h" 17 #include "sandbox/linux/seccomp-bpf/sandbox_bpf.h"
18 #include "sandbox/linux/seccomp-bpf/sandbox_bpf_policy.h" 18 #include "sandbox/linux/seccomp-bpf/sandbox_bpf_policy.h"
19 #include "sandbox/linux/services/linux_syscalls.h" 19 #include "sandbox/linux/services/linux_syscalls.h"
20 20
21 using playground2::ErrorCode; 21 using sandbox::ErrorCode;
22 using playground2::Sandbox; 22 using sandbox::SandboxBPF;
23 using playground2::SandboxBpfPolicy; 23 using sandbox::SandboxBPFPolicy;
24 24
25 namespace { 25 namespace {
26 26
27 // On ARM and x86_64, System V shared memory calls have each their own system 27 // On ARM and x86_64, System V shared memory calls have each their own system
28 // call, while on i386 they are multiplexed. 28 // call, while on i386 they are multiplexed.
29 #if defined(__x86_64__) || defined(__arm__) 29 #if defined(__x86_64__) || defined(__arm__)
30 bool IsSystemVSharedMemory(int sysno) { 30 bool IsSystemVSharedMemory(int sysno) {
31 switch (sysno) { 31 switch (sysno) {
32 case __NR_shmat: 32 case __NR_shmat:
33 case __NR_shmctl: 33 case __NR_shmctl:
(...skipping 11 matching lines...) Expand all
45 bool IsSystemVIpc(int sysno) { 45 bool IsSystemVIpc(int sysno) {
46 switch (sysno) { 46 switch (sysno) {
47 case __NR_ipc: 47 case __NR_ipc:
48 return true; 48 return true;
49 default: 49 default:
50 return false; 50 return false;
51 } 51 }
52 } 52 }
53 #endif 53 #endif
54 54
55 class NaClBpfSandboxPolicy : public SandboxBpfPolicy { 55 class NaClBPFSandboxPolicy : public SandboxBPFPolicy {
56 public: 56 public:
57 NaClBpfSandboxPolicy() 57 NaClBPFSandboxPolicy()
58 : baseline_policy_(content::GetBpfSandboxBaselinePolicy()) {} 58 : baseline_policy_(content::GetBPFSandboxBaselinePolicy()) {}
59 virtual ~NaClBpfSandboxPolicy() {} 59 virtual ~NaClBPFSandboxPolicy() {}
60 60
61 virtual ErrorCode EvaluateSyscall(Sandbox* sandbox_compiler, 61 virtual ErrorCode EvaluateSyscall(SandboxBPF* sandbox_compiler,
62 int system_call_number) const OVERRIDE; 62 int system_call_number) const OVERRIDE;
63 63
64 private: 64 private:
65 scoped_ptr<SandboxBpfPolicy> baseline_policy_; 65 scoped_ptr<SandboxBPFPolicy> baseline_policy_;
66 DISALLOW_COPY_AND_ASSIGN(NaClBpfSandboxPolicy); 66 DISALLOW_COPY_AND_ASSIGN(NaClBPFSandboxPolicy);
67 }; 67 };
68 68
69 ErrorCode NaClBpfSandboxPolicy::EvaluateSyscall( 69 ErrorCode NaClBPFSandboxPolicy::EvaluateSyscall(
70 playground2::Sandbox* sb, int sysno) const { 70 sandbox::SandboxBPF* sb, int sysno) const {
71 DCHECK(baseline_policy_); 71 DCHECK(baseline_policy_);
72 switch (sysno) { 72 switch (sysno) {
73 // TODO(jln): NaCl's GDB debug stub uses the following socket system calls, 73 // TODO(jln): NaCl's GDB debug stub uses the following socket system calls,
74 // see if it can be restricted a bit. 74 // see if it can be restricted a bit.
75 #if defined(__x86_64__) || defined(__arm__) 75 #if defined(__x86_64__) || defined(__arm__)
76 // transport_common.cc needs this. 76 // transport_common.cc needs this.
77 case __NR_accept: 77 case __NR_accept:
78 case __NR_setsockopt: 78 case __NR_setsockopt:
79 #elif defined(__i386__) 79 #elif defined(__i386__)
80 case __NR_socketcall: 80 case __NR_socketcall:
(...skipping 63 matching lines...) Expand 10 before | Expand all | Expand 10 after
144 errno = 0; 144 errno = 0;
145 // Make a ptrace request with an invalid PID. 145 // Make a ptrace request with an invalid PID.
146 long ptrace_ret = ptrace(PTRACE_PEEKUSER, -1 /* pid */, NULL, NULL); 146 long ptrace_ret = ptrace(PTRACE_PEEKUSER, -1 /* pid */, NULL, NULL);
147 CHECK_EQ(-1, ptrace_ret); 147 CHECK_EQ(-1, ptrace_ret);
148 // Without the sandbox on, this ptrace call would ESRCH instead. 148 // Without the sandbox on, this ptrace call would ESRCH instead.
149 CHECK_EQ(EPERM, errno); 149 CHECK_EQ(EPERM, errno);
150 } 150 }
151 151
152 } // namespace 152 } // namespace
153 153
154 bool InitializeBpfSandbox() { 154 bool InitializeBPFSandbox() {
155 bool sandbox_is_initialized = content::InitializeSandbox( 155 bool sandbox_is_initialized = content::InitializeSandbox(
156 scoped_ptr<SandboxBpfPolicy>(new NaClBpfSandboxPolicy())); 156 scoped_ptr<SandboxBPFPolicy>(new NaClBPFSandboxPolicy()));
157 if (sandbox_is_initialized) { 157 if (sandbox_is_initialized) {
158 RunSandboxSanityChecks(); 158 RunSandboxSanityChecks();
159 return true; 159 return true;
160 } 160 }
161 return false; 161 return false;
162 } 162 }
OLDNEW
« no previous file with comments | « components/nacl/loader/nacl_sandbox_linux.h ('k') | content/common/sandbox_bpf_base_policy_linux.h » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698