bpf_base_policy_linux.cc 1.7 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657
  1. // Copyright 2013 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #include "sandbox/policy/linux/bpf_base_policy_linux.h"
  5. #include <errno.h>
  6. #include "base/check.h"
  7. #include "sandbox/linux/bpf_dsl/bpf_dsl.h"
  8. #include "sandbox/linux/seccomp-bpf-helpers/baseline_policy.h"
  9. #include "sandbox/linux/system_headers/linux_syscalls.h"
  10. using sandbox::bpf_dsl::Allow;
  11. using sandbox::bpf_dsl::ResultExpr;
  12. namespace sandbox {
  13. namespace policy {
  14. namespace {
  15. // The errno used for denied file system access system calls, such as open(2).
  16. static const int kFSDeniedErrno = EPERM;
  17. } // namespace.
  18. BPFBasePolicy::BPFBasePolicy()
  19. : baseline_policy_(new BaselinePolicy(kFSDeniedErrno)) {}
  20. BPFBasePolicy::~BPFBasePolicy() {}
  21. ResultExpr BPFBasePolicy::EvaluateSyscall(int system_call_number) const {
  22. DCHECK(baseline_policy_);
  23. // set_robust_list(2) is part of the futex(2) infrastructure.
  24. // Chrome on Linux/Chrome OS will call set_robust_list(2) frequently.
  25. // The baseline policy will EPERM set_robust_list(2), but on systems with
  26. // SECCOMP logs enabled in auditd this will cause a ton of logspam.
  27. // If we're not blocking the entire futex(2) infrastructure, we should allow
  28. // set_robust_list(2) and quiet the logspam.
  29. if (system_call_number == __NR_set_robust_list) {
  30. return Allow();
  31. }
  32. return baseline_policy_->EvaluateSyscall(system_call_number);
  33. }
  34. ResultExpr BPFBasePolicy::InvalidSyscall() const {
  35. DCHECK(baseline_policy_);
  36. return baseline_policy_->InvalidSyscall();
  37. }
  38. int BPFBasePolicy::GetFSDeniedErrno() {
  39. return kFSDeniedErrno;
  40. }
  41. } // namespace policy
  42. } // namespace sandbox.