baseline_policy.h 1.9 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152
  1. // Copyright (c) 2013 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #ifndef SANDBOX_LINUX_SECCOMP_BPF_HELPERS_BASELINE_POLICY_H_
  5. #define SANDBOX_LINUX_SECCOMP_BPF_HELPERS_BASELINE_POLICY_H_
  6. #include <sys/types.h>
  7. #include "sandbox/linux/bpf_dsl/bpf_dsl_forward.h"
  8. #include "sandbox/linux/bpf_dsl/policy.h"
  9. #include "sandbox/sandbox_export.h"
  10. namespace sandbox {
  11. // This is a helper to build seccomp-bpf policies, i.e. policies for a sandbox
  12. // that reduces the Linux kernel's attack surface. Given its nature, it doesn't
  13. // have a clear semantics and is mostly "implementation-defined".
  14. //
  15. // This class implements the Policy interface with a "baseline"
  16. // policy for use within Chromium.
  17. // The "baseline" policy is somewhat arbitrary. All Chromium policies are an
  18. // alteration of it, and it represents a reasonable common ground to run most
  19. // code in a sandboxed environment.
  20. // A baseline policy is only valid for the process for which this object was
  21. // instantiated (so do not fork() and use it in a child).
  22. class SANDBOX_EXPORT BaselinePolicy : public bpf_dsl::Policy {
  23. public:
  24. BaselinePolicy();
  25. // |fs_denied_errno| is the errno returned when a filesystem access system
  26. // call is denied.
  27. explicit BaselinePolicy(int fs_denied_errno);
  28. BaselinePolicy(const BaselinePolicy&) = delete;
  29. BaselinePolicy& operator=(const BaselinePolicy&) = delete;
  30. ~BaselinePolicy() override;
  31. bpf_dsl::ResultExpr EvaluateSyscall(int system_call_number) const override;
  32. bpf_dsl::ResultExpr InvalidSyscall() const override;
  33. pid_t policy_pid() const { return policy_pid_; }
  34. private:
  35. int fs_denied_errno_;
  36. // The PID that the policy applies to (should be equal to the current pid).
  37. pid_t policy_pid_;
  38. };
  39. } // namespace sandbox.
  40. #endif // SANDBOX_LINUX_SECCOMP_BPF_HELPERS_BASELINE_POLICY_H_