policy_engine_processor.cc 3.2 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103
  1. // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #include "sandbox/win/src/policy_engine_processor.h"
  5. #include <stddef.h>
  6. #include <stdint.h>
  7. namespace sandbox {
  8. void PolicyProcessor::SetInternalState(size_t index, EvalResult result) {
  9. state_.current_index_ = index;
  10. state_.current_result_ = result;
  11. }
  12. EvalResult PolicyProcessor::GetAction() const {
  13. return state_.current_result_;
  14. }
  15. // Decides if an opcode can be skipped (not evaluated) or not. The function
  16. // takes as inputs the opcode and the current evaluation context and returns
  17. // true if the opcode should be skipped or not and also can set keep_skipping
  18. // to false to signal that the current instruction should be skipped but not
  19. // the next after the current one.
  20. bool SkipOpcode(const PolicyOpcode& opcode,
  21. MatchContext* context,
  22. bool* keep_skipping) {
  23. if (opcode.IsAction()) {
  24. uint32_t options = context->options;
  25. context->Clear();
  26. *keep_skipping = false;
  27. return (kPolUseOREval != options);
  28. }
  29. *keep_skipping = true;
  30. return true;
  31. }
  32. PolicyResult PolicyProcessor::Evaluate(uint32_t options,
  33. ParameterSet* parameters,
  34. size_t param_count) {
  35. if (!policy_)
  36. return NO_POLICY_MATCH;
  37. if (0 == policy_->opcode_count)
  38. return NO_POLICY_MATCH;
  39. if (!(kShortEval & options))
  40. return POLICY_ERROR;
  41. MatchContext context;
  42. bool evaluation = false;
  43. bool skip_group = false;
  44. SetInternalState(0, EVAL_FALSE);
  45. size_t count = policy_->opcode_count;
  46. // Loop over all the opcodes Evaluating in sequence. Since we only support
  47. // short circuit evaluation, we stop as soon as we find an 'action' opcode
  48. // and the current evaluation is true.
  49. //
  50. // Skipping opcodes can happen when we are in AND mode (!kPolUseOREval) and
  51. // have got EVAL_FALSE or when we are in OR mode (kPolUseOREval) and got
  52. // EVAL_TRUE. Skipping will stop at the next action opcode or at the opcode
  53. // after the action depending on kPolUseOREval.
  54. for (size_t ix = 0; ix != count; ++ix) {
  55. PolicyOpcode& opcode = policy_->opcodes[ix];
  56. // Skipping block.
  57. if (skip_group) {
  58. if (SkipOpcode(opcode, &context, &skip_group))
  59. continue;
  60. }
  61. // Evaluation block.
  62. EvalResult result = opcode.Evaluate(parameters, param_count, &context);
  63. switch (result) {
  64. case EVAL_FALSE:
  65. evaluation = false;
  66. if (kPolUseOREval != context.options)
  67. skip_group = true;
  68. break;
  69. case EVAL_ERROR:
  70. if (kStopOnErrors & options)
  71. return POLICY_ERROR;
  72. break;
  73. case EVAL_TRUE:
  74. evaluation = true;
  75. if (kPolUseOREval == context.options)
  76. skip_group = true;
  77. break;
  78. default:
  79. // We have evaluated an action.
  80. SetInternalState(ix, result);
  81. return POLICY_MATCH;
  82. }
  83. }
  84. if (evaluation) {
  85. // Reaching the end of the policy with a positive evaluation is probably
  86. // an error: we did not find a final action opcode?
  87. return POLICY_ERROR;
  88. }
  89. return NO_POLICY_MATCH;
  90. }
  91. } // namespace sandbox