OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "sandbox/linux/seccomp-bpf/verifier.h" | 5 #include "sandbox/linux/seccomp-bpf/verifier.h" |
6 | 6 |
7 #include <string.h> | 7 #include <string.h> |
8 | 8 |
9 #include <limits> | 9 #include <limits> |
10 | 10 |
(...skipping 300 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
311 } | 311 } |
312 } | 312 } |
313 | 313 |
314 } // namespace | 314 } // namespace |
315 | 315 |
316 bool Verifier::VerifyBPF(bpf_dsl::PolicyCompiler* compiler, | 316 bool Verifier::VerifyBPF(bpf_dsl::PolicyCompiler* compiler, |
317 const std::vector<struct sock_filter>& program, | 317 const std::vector<struct sock_filter>& program, |
318 const bpf_dsl::SandboxBPFDSLPolicy& policy, | 318 const bpf_dsl::SandboxBPFDSLPolicy& policy, |
319 const char** err) { | 319 const char** err) { |
320 *err = NULL; | 320 *err = NULL; |
321 for (SyscallIterator iter(false); !iter.Done();) { | 321 for (uint32_t sysnum : SyscallSet::All()) { |
322 uint32_t sysnum = iter.Next(); | |
323 // We ideally want to iterate over the full system call range and values | 322 // We ideally want to iterate over the full system call range and values |
324 // just above and just below this range. This gives us the full result set | 323 // just above and just below this range. This gives us the full result set |
325 // of the "evaluators". | 324 // of the "evaluators". |
326 // On Intel systems, this can fail in a surprising way, as a cleared bit 30 | 325 // On Intel systems, this can fail in a surprising way, as a cleared bit 30 |
327 // indicates either i386 or x86-64; and a set bit 30 indicates x32. And | 326 // indicates either i386 or x86-64; and a set bit 30 indicates x32. And |
328 // unless we pay attention to setting this bit correctly, an early check in | 327 // unless we pay attention to setting this bit correctly, an early check in |
329 // our BPF program will make us fail with a misleading error code. | 328 // our BPF program will make us fail with a misleading error code. |
330 struct arch_seccomp_data data = {static_cast<int>(sysnum), | 329 struct arch_seccomp_data data = {static_cast<int>(sysnum), |
331 static_cast<uint32_t>(SECCOMP_ARCH)}; | 330 static_cast<uint32_t>(SECCOMP_ARCH)}; |
332 #if defined(__i386__) || defined(__x86_64__) | 331 #if defined(__i386__) || defined(__x86_64__) |
333 #if defined(__x86_64__) && defined(__ILP32__) | 332 #if defined(__x86_64__) && defined(__ILP32__) |
334 if (!(sysnum & 0x40000000u)) { | 333 if (!(sysnum & 0x40000000u)) { |
335 continue; | 334 continue; |
336 } | 335 } |
337 #else | 336 #else |
338 if (sysnum & 0x40000000u) { | 337 if (sysnum & 0x40000000u) { |
339 continue; | 338 continue; |
340 } | 339 } |
341 #endif | 340 #endif |
342 #endif | 341 #endif |
343 ErrorCode code = iter.IsValid(sysnum) | 342 ErrorCode code = SyscallSet::IsValid(sysnum) |
344 ? policy.EvaluateSyscall(sysnum)->Compile(compiler) | 343 ? policy.EvaluateSyscall(sysnum)->Compile(compiler) |
345 : policy.InvalidSyscall()->Compile(compiler); | 344 : policy.InvalidSyscall()->Compile(compiler); |
346 if (!VerifyErrorCode(compiler, program, &data, code, code, err)) { | 345 if (!VerifyErrorCode(compiler, program, &data, code, code, err)) { |
347 return false; | 346 return false; |
348 } | 347 } |
349 } | 348 } |
350 return true; | 349 return true; |
351 } | 350 } |
352 | 351 |
353 uint32_t Verifier::EvaluateBPF(const std::vector<struct sock_filter>& program, | 352 uint32_t Verifier::EvaluateBPF(const std::vector<struct sock_filter>& program, |
(...skipping 38 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
392 break; | 391 break; |
393 default: | 392 default: |
394 *err = "Unexpected instruction in BPF program"; | 393 *err = "Unexpected instruction in BPF program"; |
395 break; | 394 break; |
396 } | 395 } |
397 } | 396 } |
398 return 0; | 397 return 0; |
399 } | 398 } |
400 | 399 |
401 } // namespace sandbox | 400 } // namespace sandbox |
OLD | NEW |