49 lines
1.8 KiB
C++
49 lines
1.8 KiB
C++
// Copyright (c) 2013 The Chromium Authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
#ifndef SANDBOX_LINUX_SECCOMP_BPF_HELPERS_BASELINE_POLICY_H_
|
|
#define SANDBOX_LINUX_SECCOMP_BPF_HELPERS_BASELINE_POLICY_H_
|
|
|
|
#include "base/macros.h"
|
|
#include "sandbox/linux/bpf_dsl/bpf_dsl_forward.h"
|
|
#include "sandbox/linux/bpf_dsl/policy.h"
|
|
#include "sandbox/sandbox_export.h"
|
|
|
|
namespace sandbox {
|
|
|
|
// This is a helper to build seccomp-bpf policies, i.e. policies for a sandbox
|
|
// that reduces the Linux kernel's attack surface. Given its nature, it doesn't
|
|
// have a clear semantics and is mostly "implementation-defined".
|
|
//
|
|
// This class implements the Policy interface with a "baseline"
|
|
// policy for use within Chromium.
|
|
// The "baseline" policy is somewhat arbitrary. All Chromium policies are an
|
|
// alteration of it, and it represents a reasonable common ground to run most
|
|
// code in a sandboxed environment.
|
|
// A baseline policy is only valid for the process for which this object was
|
|
// instantiated (so do not fork() and use it in a child).
|
|
class SANDBOX_EXPORT BaselinePolicy : public bpf_dsl::Policy {
|
|
public:
|
|
BaselinePolicy();
|
|
// |fs_denied_errno| is the errno returned when a filesystem access system
|
|
// call is denied.
|
|
explicit BaselinePolicy(int fs_denied_errno);
|
|
~BaselinePolicy() override;
|
|
|
|
bpf_dsl::ResultExpr EvaluateSyscall(int system_call_number) const override;
|
|
bpf_dsl::ResultExpr InvalidSyscall() const override;
|
|
pid_t policy_pid() const { return policy_pid_; }
|
|
|
|
private:
|
|
int fs_denied_errno_;
|
|
|
|
// The PID that the policy applies to (should be equal to the current pid).
|
|
pid_t policy_pid_;
|
|
|
|
DISALLOW_COPY_AND_ASSIGN(BaselinePolicy);
|
|
};
|
|
|
|
} // namespace sandbox.
|
|
|
|
#endif // SANDBOX_LINUX_SECCOMP_BPF_HELPERS_BASELINE_POLICY_H_
|