content/common/sandbox_linux/bpf_ppapi_policy_linux.cc

   1 // Copyright 2013 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "content/common/sandbox_linux/bpf_ppapi_policy_linux.h"
   6
   7 #include <errno.h>
   8
   9 #include "base/basictypes.h"
  10 #include "build/build_config.h"
  11 #include "content/common/sandbox_linux/sandbox_linux.h"
  12 #include "sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.h"
  13 #include "sandbox/linux/seccomp-bpf-helpers/syscall_sets.h"
  14 #include "sandbox/linux/seccomp-bpf/sandbox_bpf_policy.h"
  15 #include "sandbox/linux/services/linux_syscalls.h"
  16
  17 using sandbox::SyscallSets;
  18
  19 namespace content {
  20
  21 PpapiProcessPolicy::PpapiProcessPolicy() {}
  22 PpapiProcessPolicy::~PpapiProcessPolicy() {}
  23
  24 ErrorCode PpapiProcessPolicy::EvaluateSyscall(SandboxBPF* sandbox,
  25                                               int sysno) const {
  26   switch (sysno) {
  27     case __NR_clone:
  28       return sandbox::RestrictCloneToThreadsAndEPERMFork(sandbox);
  29     case __NR_pread64:
  30     case __NR_pwrite64:
  31     case __NR_sched_get_priority_max:
  32     case __NR_sched_get_priority_min:
  33     case __NR_sched_getaffinity:
  34     case __NR_sched_getparam:
  35     case __NR_sched_getscheduler:
  36     case __NR_sched_setscheduler:
  37     case __NR_times:
  38       return ErrorCode(ErrorCode::ERR_ALLOWED);
  39     case __NR_ioctl:
  40       return ErrorCode(ENOTTY);  // Flash Access.
  41     default:
  42       // Default on the baseline policy.
  43       return SandboxBPFBasePolicy::EvaluateSyscall(sandbox, sysno);
  44   }
  45 }
  46
  47 }  // namespace content