Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(271)

Side by Side Diff: sandbox/linux/seccomp-bpf/verifier.cc

Issue 659723002: SyscallIterator: support C++11 range-based for loops (Closed) Base URL: https://chromium.googlesource.com/chromium/src.git@master
Patch Set: Sync and fix style Created 6 years, 2 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
OLDNEW
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be 2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file. 3 // found in the LICENSE file.
4 4
5 #include "sandbox/linux/seccomp-bpf/verifier.h" 5 #include "sandbox/linux/seccomp-bpf/verifier.h"
6 6
7 #include <string.h> 7 #include <string.h>
8 8
9 #include <limits> 9 #include <limits>
10 10
(...skipping 300 matching lines...) Expand 10 before | Expand all | Expand 10 after
311 } 311 }
312 } 312 }
313 313
314 } // namespace 314 } // namespace
315 315
316 bool Verifier::VerifyBPF(bpf_dsl::PolicyCompiler* compiler, 316 bool Verifier::VerifyBPF(bpf_dsl::PolicyCompiler* compiler,
317 const std::vector<struct sock_filter>& program, 317 const std::vector<struct sock_filter>& program,
318 const bpf_dsl::SandboxBPFDSLPolicy& policy, 318 const bpf_dsl::SandboxBPFDSLPolicy& policy,
319 const char** err) { 319 const char** err) {
320 *err = NULL; 320 *err = NULL;
321 for (SyscallIterator iter(false); !iter.Done();) { 321 for (uint32_t sysnum : SyscallSet::ALL) {
322 uint32_t sysnum = iter.Next();
323 // We ideally want to iterate over the full system call range and values 322 // We ideally want to iterate over the full system call range and values
324 // just above and just below this range. This gives us the full result set 323 // just above and just below this range. This gives us the full result set
325 // of the "evaluators". 324 // of the "evaluators".
326 // On Intel systems, this can fail in a surprising way, as a cleared bit 30 325 // On Intel systems, this can fail in a surprising way, as a cleared bit 30
327 // indicates either i386 or x86-64; and a set bit 30 indicates x32. And 326 // indicates either i386 or x86-64; and a set bit 30 indicates x32. And
328 // unless we pay attention to setting this bit correctly, an early check in 327 // unless we pay attention to setting this bit correctly, an early check in
329 // our BPF program will make us fail with a misleading error code. 328 // our BPF program will make us fail with a misleading error code.
330 struct arch_seccomp_data data = {static_cast<int>(sysnum), 329 struct arch_seccomp_data data = {static_cast<int>(sysnum),
331 static_cast<uint32_t>(SECCOMP_ARCH)}; 330 static_cast<uint32_t>(SECCOMP_ARCH)};
332 #if defined(__i386__) || defined(__x86_64__) 331 #if defined(__i386__) || defined(__x86_64__)
333 #if defined(__x86_64__) && defined(__ILP32__) 332 #if defined(__x86_64__) && defined(__ILP32__)
334 if (!(sysnum & 0x40000000u)) { 333 if (!(sysnum & 0x40000000u)) {
335 continue; 334 continue;
336 } 335 }
337 #else 336 #else
338 if (sysnum & 0x40000000u) { 337 if (sysnum & 0x40000000u) {
339 continue; 338 continue;
340 } 339 }
341 #endif 340 #endif
342 #endif 341 #endif
343 ErrorCode code = iter.IsValid(sysnum) 342 ErrorCode code = SyscallIterator::IsValid(sysnum)
344 ? policy.EvaluateSyscall(sysnum)->Compile(compiler) 343 ? policy.EvaluateSyscall(sysnum)->Compile(compiler)
345 : policy.InvalidSyscall()->Compile(compiler); 344 : policy.InvalidSyscall()->Compile(compiler);
346 if (!VerifyErrorCode(compiler, program, &data, code, code, err)) { 345 if (!VerifyErrorCode(compiler, program, &data, code, code, err)) {
347 return false; 346 return false;
348 } 347 }
349 } 348 }
350 return true; 349 return true;
351 } 350 }
352 351
353 uint32_t Verifier::EvaluateBPF(const std::vector<struct sock_filter>& program, 352 uint32_t Verifier::EvaluateBPF(const std::vector<struct sock_filter>& program,
(...skipping 38 matching lines...) Expand 10 before | Expand all | Expand 10 after
392 break; 391 break;
393 default: 392 default:
394 *err = "Unexpected instruction in BPF program"; 393 *err = "Unexpected instruction in BPF program";
395 break; 394 break;
396 } 395 }
397 } 396 }
398 return 0; 397 return 0;
399 } 398 }
400 399
401 } // namespace sandbox 400 } // namespace sandbox
OLDNEW

Powered by Google App Engine
This is Rietveld 408576698