sandbox/linux/seccomp-bpf-helpers/baseline_policy.h

   1 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #ifndef SANDBOX_LINUX_SECCOMP_BPF_HELPERS_BASELINE_POLICY_H_
   6 #define SANDBOX_LINUX_SECCOMP_BPF_HELPERS_BASELINE_POLICY_H_
   7
   8 #include "sandbox/linux/bpf_dsl/bpf_dsl_forward.h"
   9 #include "sandbox/linux/bpf_dsl/policy.h"
  10 #include "sandbox/sandbox_export.h"
  11
  12 namespace sandbox {
  13
  14 // This is a helper to build seccomp-bpf policies, i.e. policies for a sandbox
  15 // that reduces the Linux kernel's attack surface. Given its nature, it doesn't
  16 // have a clear semantics and is mostly "implementation-defined".
  17 //
  18 // This class implements the Policy interface with a "baseline"
  19 // policy for use within Chromium.
  20 // The "baseline" policy is somewhat arbitrary. All Chromium policies are an
  21 // alteration of it, and it represents a reasonable common ground to run most
  22 // code in a sandboxed environment.
  23 // A baseline policy is only valid for the process for which this object was
  24 // instantiated (so do not fork() and use it in a child).
  25 class SANDBOX_EXPORT BaselinePolicy : public bpf_dsl::Policy {
  26  public:
  27   BaselinePolicy();
  28   // |fs_denied_errno| is the errno returned when a filesystem access system
  29   // call is denied.
  30   explicit BaselinePolicy(int fs_denied_errno);
  31   ~BaselinePolicy() override;
  32
  33   bpf_dsl::ResultExpr EvaluateSyscall(int system_call_number) const override;
  34   bpf_dsl::ResultExpr InvalidSyscall() const override;
  35   pid_t policy_pid() const { return policy_pid_; }
  36
  37  private:
  38   int fs_denied_errno_;
  39
  40   // The PID that the policy applies to (should be equal to the current pid).
  41   pid_t policy_pid_;
  42
  43   DISALLOW_COPY_AND_ASSIGN(BaselinePolicy);
  44 };
  45
  46 }  // namespace sandbox.
  47
  48 #endif  // SANDBOX_LINUX_SECCOMP_BPF_HELPERS_BASELINE_POLICY_H_