content/common/sandbox_linux/bpf_utility_policy_linux.cc

   1 // Copyright 2014 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "content/common/sandbox_linux/bpf_utility_policy_linux.h"
   6
   7 #include <errno.h>
   8
   9 #include "base/basictypes.h"
  10 #include "build/build_config.h"
  11 #include "content/common/sandbox_linux/sandbox_linux.h"
  12 #include "sandbox/linux/bpf_dsl/bpf_dsl.h"
  13 #include "sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.h"
  14 #include "sandbox/linux/seccomp-bpf-helpers/syscall_sets.h"
  15 #include "sandbox/linux/system_headers/linux_syscalls.h"
  16
  17 using sandbox::SyscallSets;
  18 using sandbox::bpf_dsl::Allow;
  19 using sandbox::bpf_dsl::Error;
  20 using sandbox::bpf_dsl::ResultExpr;
  21
  22 namespace content {
  23
  24 UtilityProcessPolicy::UtilityProcessPolicy() {
  25 }
  26 UtilityProcessPolicy::~UtilityProcessPolicy() {
  27 }
  28
  29 ResultExpr UtilityProcessPolicy::EvaluateSyscall(int sysno) const {
  30   // TODO(mdempsky): For now, this is just a copy of the renderer
  31   // policy, which happens to work well for utility processes too.  It
  32   // should be possible to limit further though.  In particular, the
  33   // entries below annotated with bug references are most likely
  34   // unnecessary.
  35
  36   switch (sysno) {
  37     case __NR_ioctl:
  38       return sandbox::RestrictIoctl();
  39     // Allow the system calls below.
  40     case __NR_fdatasync:
  41     case __NR_fsync:
  42 #if defined(__i386__) || defined(__x86_64__)
  43     case __NR_getrlimit:
  44 #endif
  45 #if defined(__i386__) || defined(__arm__)
  46     case __NR_ugetrlimit:
  47 #endif
  48     case __NR_pread64:
  49     case __NR_pwrite64:
  50     case __NR_sysinfo:
  51     case __NR_times:
  52     case __NR_uname:
  53       return Allow();
  54     default:
  55       // Default on the content baseline policy.
  56       return SandboxBPFBasePolicy::EvaluateSyscall(sysno);
  57   }
  58 }
  59
  60 }  // namespace content