| OLD | NEW |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "sandbox/linux/seccomp-bpf/sandbox_bpf.h" | 5 #include "sandbox/linux/seccomp-bpf/sandbox_bpf.h" |
| 6 #include "sandbox/linux/seccomp-bpf/verifier.h" | 6 #include "sandbox/linux/seccomp-bpf/verifier.h" |
| 7 | 7 |
| 8 | 8 |
| 9 namespace playground2 { | 9 namespace playground2 { |
| 10 | 10 |
| (...skipping 18 matching lines...) Expand all Loading... |
| 29 #if defined(__x86_64__) && defined(__ILP32__) | 29 #if defined(__x86_64__) && defined(__ILP32__) |
| 30 int sysnum = nr | 0x40000000; | 30 int sysnum = nr | 0x40000000; |
| 31 #else | 31 #else |
| 32 int sysnum = nr & ~0x40000000; | 32 int sysnum = nr & ~0x40000000; |
| 33 #endif | 33 #endif |
| 34 #else | 34 #else |
| 35 int sysnum = nr; | 35 int sysnum = nr; |
| 36 #endif | 36 #endif |
| 37 | 37 |
| 38 struct arch_seccomp_data data = { sysnum, SECCOMP_ARCH }; | 38 struct arch_seccomp_data data = { sysnum, SECCOMP_ARCH }; |
| 39 Sandbox::ErrorCode code = evaluateSyscall(sysnum); | 39 ErrorCode code = evaluateSyscall(sysnum); |
| 40 uint32_t computedRet = evaluateBPF(program, data, err); | 40 uint32_t computedRet = evaluateBPF(program, data, err); |
| 41 if (*err) { | 41 if (*err) { |
| 42 return false; | 42 return false; |
| 43 } else if (computedRet != code) { | 43 } else if (computedRet != code.err()) { |
| 44 *err = "Exit code from BPF program doesn't match"; | 44 *err = "Exit code from BPF program doesn't match"; |
| 45 return false; | 45 return false; |
| 46 } | 46 } |
| 47 } | 47 } |
| 48 return true; | 48 return true; |
| 49 } | 49 } |
| 50 | 50 |
| 51 uint32_t Verifier::evaluateBPF(const std::vector<struct sock_filter>& program, | 51 uint32_t Verifier::evaluateBPF(const std::vector<struct sock_filter>& program, |
| 52 const struct arch_seccomp_data& data, | 52 const struct arch_seccomp_data& data, |
| 53 const char **err) { | 53 const char **err) { |
| (...skipping 100 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 154 uint32_t Verifier::ret(State *, const struct sock_filter& insn, | 154 uint32_t Verifier::ret(State *, const struct sock_filter& insn, |
| 155 const char **err) { | 155 const char **err) { |
| 156 if (BPF_SRC(insn.code) != BPF_K) { | 156 if (BPF_SRC(insn.code) != BPF_K) { |
| 157 *err = "Invalid BPF_RET instruction"; | 157 *err = "Invalid BPF_RET instruction"; |
| 158 return 0; | 158 return 0; |
| 159 } | 159 } |
| 160 return insn.k; | 160 return insn.k; |
| 161 } | 161 } |
| 162 | 162 |
| 163 } // namespace | 163 } // namespace |
| OLD | NEW |