OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include <errno.h> | 5 #include <errno.h> |
6 #include <fcntl.h> | 6 #include <fcntl.h> |
7 #include <linux/unistd.h> | 7 #include <linux/unistd.h> |
8 #include <netinet/in.h> | 8 #include <netinet/in.h> |
9 #include <netinet/tcp.h> | 9 #include <netinet/tcp.h> |
10 #include <netinet/udp.h> | 10 #include <netinet/udp.h> |
(...skipping 12 matching lines...) Expand all Loading... |
23 #include <sys/socket.h> | 23 #include <sys/socket.h> |
24 #include <sys/time.h> | 24 #include <sys/time.h> |
25 #include <sys/types.h> | 25 #include <sys/types.h> |
26 #include <time.h> | 26 #include <time.h> |
27 #include <unistd.h> | 27 #include <unistd.h> |
28 | 28 |
29 #include "base/posix/eintr_wrapper.h" | 29 #include "base/posix/eintr_wrapper.h" |
30 #include "sandbox/linux/seccomp-bpf/sandbox_bpf.h" | 30 #include "sandbox/linux/seccomp-bpf/sandbox_bpf.h" |
31 #include "sandbox/linux/services/linux_syscalls.h" | 31 #include "sandbox/linux/services/linux_syscalls.h" |
32 | 32 |
33 using playground2::arch_seccomp_data; | 33 using sandbox::ErrorCode; |
34 using playground2::ErrorCode; | 34 using sandbox::SandboxBPF; |
35 using playground2::Sandbox; | 35 using sandbox::arch_seccomp_data; |
36 | 36 |
37 #define ERR EPERM | 37 #define ERR EPERM |
38 | 38 |
39 // We don't expect our sandbox to do anything useful yet. So, we will fail | 39 // We don't expect our sandbox to do anything useful yet. So, we will fail |
40 // almost immediately. For now, force the code to continue running. The | 40 // almost immediately. For now, force the code to continue running. The |
41 // following line should be removed as soon as the sandbox is starting to | 41 // following line should be removed as soon as the sandbox is starting to |
42 // actually enforce restrictions in a meaningful way: | 42 // actually enforce restrictions in a meaningful way: |
43 #define _exit(x) do { } while (0) | 43 #define _exit(x) do { } while (0) |
44 | 44 |
45 namespace { | 45 namespace { |
(...skipping 184 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
230 | 230 |
231 ptr = strrchr(ptr, '\000'); | 231 ptr = strrchr(ptr, '\000'); |
232 strncat(ptr, msg1, sizeof(buf) - (ptr - buf)); | 232 strncat(ptr, msg1, sizeof(buf) - (ptr - buf)); |
233 | 233 |
234 ptr = strrchr(ptr, '\000'); | 234 ptr = strrchr(ptr, '\000'); |
235 if (HANDLE_EINTR(write(2, buf, ptr - buf))) { } | 235 if (HANDLE_EINTR(write(2, buf, ptr - buf))) { } |
236 | 236 |
237 return -ERR; | 237 return -ERR; |
238 } | 238 } |
239 | 239 |
240 ErrorCode Evaluator(Sandbox *sandbox, int sysno, void *) { | 240 ErrorCode Evaluator(SandboxBPF* sandbox, int sysno, void *) { |
241 switch (sysno) { | 241 switch (sysno) { |
242 #if defined(__NR_accept) | 242 #if defined(__NR_accept) |
243 case __NR_accept: case __NR_accept4: | 243 case __NR_accept: case __NR_accept4: |
244 #endif | 244 #endif |
245 case __NR_alarm: | 245 case __NR_alarm: |
246 case __NR_brk: | 246 case __NR_brk: |
247 case __NR_clock_gettime: | 247 case __NR_clock_gettime: |
248 case __NR_close: | 248 case __NR_close: |
249 case __NR_dup: case __NR_dup2: | 249 case __NR_dup: case __NR_dup2: |
250 case __NR_epoll_create: case __NR_epoll_ctl: case __NR_epoll_wait: | 250 case __NR_epoll_create: case __NR_epoll_ctl: case __NR_epoll_wait: |
(...skipping 155 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
406 } | 406 } |
407 return NULL; | 407 return NULL; |
408 } | 408 } |
409 | 409 |
410 } // namespace | 410 } // namespace |
411 | 411 |
412 int main(int argc, char *argv[]) { | 412 int main(int argc, char *argv[]) { |
413 if (argc) { } | 413 if (argc) { } |
414 if (argv) { } | 414 if (argv) { } |
415 int proc_fd = open("/proc", O_RDONLY|O_DIRECTORY); | 415 int proc_fd = open("/proc", O_RDONLY|O_DIRECTORY); |
416 if (Sandbox::SupportsSeccompSandbox(proc_fd) != | 416 if (SandboxBPF::SupportsSeccompSandbox(proc_fd) != |
417 Sandbox::STATUS_AVAILABLE) { | 417 SandboxBPF::STATUS_AVAILABLE) { |
418 perror("sandbox"); | 418 perror("sandbox"); |
419 _exit(1); | 419 _exit(1); |
420 } | 420 } |
421 Sandbox sandbox; | 421 SandboxBPF sandbox; |
422 sandbox.set_proc_fd(proc_fd); | 422 sandbox.set_proc_fd(proc_fd); |
423 sandbox.SetSandboxPolicyDeprecated(Evaluator, NULL); | 423 sandbox.SetSandboxPolicyDeprecated(Evaluator, NULL); |
424 sandbox.StartSandbox(); | 424 sandbox.StartSandbox(); |
425 | 425 |
426 // Check that we can create threads | 426 // Check that we can create threads |
427 pthread_t thr; | 427 pthread_t thr; |
428 if (!pthread_create(&thr, NULL, ThreadFnc, | 428 if (!pthread_create(&thr, NULL, ThreadFnc, |
429 reinterpret_cast<void *>(0x1234))) { | 429 reinterpret_cast<void *>(0x1234))) { |
430 void *ret; | 430 void *ret; |
431 pthread_join(thr, &ret); | 431 pthread_join(thr, &ret); |
(...skipping 85 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
517 perror("pthread_create"); | 517 perror("pthread_create"); |
518 _exit(1); | 518 _exit(1); |
519 } | 519 } |
520 } | 520 } |
521 for (int i = 0; i < kSendmsgStressNumThreads; ++i) { | 521 for (int i = 0; i < kSendmsgStressNumThreads; ++i) { |
522 pthread_join(sendmsgStressThreads[i], NULL); | 522 pthread_join(sendmsgStressThreads[i], NULL); |
523 } | 523 } |
524 | 524 |
525 return 0; | 525 return 0; |
526 } | 526 } |
OLD | NEW |