OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "sandbox/linux/seccomp-bpf/syscall.h" | 5 #include "sandbox/linux/seccomp-bpf/syscall.h" |
6 | 6 |
7 #include <asm/unistd.h> | 7 #include <asm/unistd.h> |
8 #include <fcntl.h> | 8 #include <fcntl.h> |
9 #include <sys/mman.h> | 9 #include <sys/mman.h> |
10 #include <sys/syscall.h> | 10 #include <sys/syscall.h> |
(...skipping 81 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
92 // SIGSYS trap handler that will be called on __NR_uname. | 92 // SIGSYS trap handler that will be called on __NR_uname. |
93 intptr_t CopySyscallArgsToAux(const struct arch_seccomp_data& args, void* aux) { | 93 intptr_t CopySyscallArgsToAux(const struct arch_seccomp_data& args, void* aux) { |
94 // |aux| is our BPF_AUX pointer. | 94 // |aux| is our BPF_AUX pointer. |
95 std::vector<uint64_t>* const seen_syscall_args = | 95 std::vector<uint64_t>* const seen_syscall_args = |
96 static_cast<std::vector<uint64_t>*>(aux); | 96 static_cast<std::vector<uint64_t>*>(aux); |
97 BPF_ASSERT(arraysize(args.args) == 6); | 97 BPF_ASSERT(arraysize(args.args) == 6); |
98 seen_syscall_args->assign(args.args, args.args + arraysize(args.args)); | 98 seen_syscall_args->assign(args.args, args.args + arraysize(args.args)); |
99 return -ENOMEM; | 99 return -ENOMEM; |
100 } | 100 } |
101 | 101 |
102 ErrorCode CopyAllArgsOnUnamePolicy(SandboxBPF* sandbox, | 102 class CopyAllArgsOnUnamePolicy : public SandboxBPFPolicy { |
103 int sysno, | 103 public: |
104 std::vector<uint64_t>* aux) { | 104 explicit CopyAllArgsOnUnamePolicy(std::vector<uint64_t>* aux) : aux_(aux) {} |
105 if (!SandboxBPF::IsValidSyscallNumber(sysno)) { | 105 virtual ~CopyAllArgsOnUnamePolicy() {} |
106 return ErrorCode(ENOSYS); | 106 |
| 107 virtual ErrorCode EvaluateSyscall(SandboxBPF* sandbox, |
| 108 int sysno) const OVERRIDE { |
| 109 DCHECK(SandboxBPF::IsValidSyscallNumber(sysno)); |
| 110 if (sysno == __NR_uname) { |
| 111 return sandbox->Trap(CopySyscallArgsToAux, aux_); |
| 112 } else { |
| 113 return ErrorCode(ErrorCode::ERR_ALLOWED); |
| 114 } |
107 } | 115 } |
108 if (sysno == __NR_uname) { | 116 |
109 return sandbox->Trap(CopySyscallArgsToAux, aux); | 117 private: |
110 } else { | 118 std::vector<uint64_t>* aux_; |
111 return ErrorCode(ErrorCode::ERR_ALLOWED); | 119 |
112 } | 120 DISALLOW_COPY_AND_ASSIGN(CopyAllArgsOnUnamePolicy); |
113 } | 121 }; |
114 | 122 |
115 // We are testing Syscall::Call() by making use of a BPF filter that | 123 // We are testing Syscall::Call() by making use of a BPF filter that |
116 // allows us | 124 // allows us |
117 // to inspect the system call arguments that the kernel saw. | 125 // to inspect the system call arguments that the kernel saw. |
118 BPF_TEST(Syscall, | 126 BPF_TEST(Syscall, |
119 SyntheticSixArgs, | 127 SyntheticSixArgs, |
120 CopyAllArgsOnUnamePolicy, | 128 CopyAllArgsOnUnamePolicy, |
121 std::vector<uint64_t> /* (*BPF_AUX) */) { | 129 std::vector<uint64_t> /* (*BPF_AUX) */) { |
122 const int kExpectedValue = 42; | 130 const int kExpectedValue = 42; |
123 // In this test we only pass integers to the kernel. We might want to make | 131 // In this test we only pass integers to the kernel. We might want to make |
(...skipping 95 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
219 | 227 |
220 // Clean up | 228 // Clean up |
221 EXPECT_EQ(0, Syscall::Call(__NR_munmap, addr2, 8192L)); | 229 EXPECT_EQ(0, Syscall::Call(__NR_munmap, addr2, 8192L)); |
222 EXPECT_EQ(0, Syscall::Call(__NR_munmap, addr3, 4096L)); | 230 EXPECT_EQ(0, Syscall::Call(__NR_munmap, addr3, 4096L)); |
223 EXPECT_EQ(0, IGNORE_EINTR(Syscall::Call(__NR_close, fd))); | 231 EXPECT_EQ(0, IGNORE_EINTR(Syscall::Call(__NR_close, fd))); |
224 } | 232 } |
225 | 233 |
226 } // namespace | 234 } // namespace |
227 | 235 |
228 } // namespace sandbox | 236 } // namespace sandbox |
OLD | NEW |