content/common/sandbox_linux/sandbox_bpf_base_policy_linux.h

   1 // Copyright 2013 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #ifndef CONTENT_COMMON_SANDBOX_LINUX_SANDBOX_BPF_BASE_POLICY_LINUX_H_
   6 #define CONTENT_COMMON_SANDBOX_LINUX_SANDBOX_BPF_BASE_POLICY_LINUX_H_
   7
   8 #include "base/basictypes.h"
   9 #include "base/memory/scoped_ptr.h"
  10 #include "sandbox/linux/bpf_dsl/bpf_dsl_forward.h"
  11 #include "sandbox/linux/bpf_dsl/policy.h"
  12 #include "sandbox/linux/seccomp-bpf-helpers/baseline_policy.h"
  13
  14 namespace content {
  15
  16 // The "baseline" BPF policy for content/. Any content/ seccomp-bpf policy
  17 // should inherit from it.
  18 // It implements the main Policy interface. Due to its nature
  19 // as a "kernel attack surface reduction" layer, it's implementation-defined.
  20 class SandboxBPFBasePolicy : public sandbox::bpf_dsl::Policy {
  21  public:
  22   SandboxBPFBasePolicy();
  23   ~SandboxBPFBasePolicy() override;
  24
  25   sandbox::bpf_dsl::ResultExpr EvaluateSyscall(
  26       int system_call_number) const override;
  27   sandbox::bpf_dsl::ResultExpr InvalidSyscall() const override;
  28
  29   // A policy can implement this hook to run code right before the policy
  30   // is passed to the BPF compiler and the sandbox is engaged.
  31   // If PreSandboxHook() returns true, the sandbox is guaranteed to be
  32   // engaged afterwards.
  33   // This will be used when enabling the sandbox though
  34   // SandboxSeccompBPF::StartSandbox().
  35   virtual bool PreSandboxHook();
  36
  37   // Get the errno(3) to return for filesystem errors.
  38   static int GetFSDeniedErrno();
  39
  40   pid_t GetPolicyPid() const { return baseline_policy_->policy_pid(); }
  41
  42  private:
  43   // Compose the BaselinePolicy from sandbox/.
  44   scoped_ptr<sandbox::BaselinePolicy> baseline_policy_;
  45   DISALLOW_COPY_AND_ASSIGN(SandboxBPFBasePolicy);
  46 };
  47
  48 }  // namespace content
  49
  50 #endif  // CONTENT_COMMON_SANDBOX_LINUX_SANDBOX_BPF_BASE_POLICY_LINUX_H_