network_sandbox_hook_linux.cc 1.5 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445
  1. // Copyright 2017 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #include "services/network/network_sandbox_hook_linux.h"
  5. #include "sandbox/linux/syscall_broker/broker_command.h"
  6. #include "base/rand_util.h"
  7. #include "base/system/sys_info.h"
  8. using sandbox::syscall_broker::BrokerFilePermission;
  9. using sandbox::syscall_broker::MakeBrokerCommandSet;
  10. namespace network {
  11. sandbox::syscall_broker::BrokerCommandSet GetNetworkBrokerCommandSet() {
  12. return MakeBrokerCommandSet({
  13. sandbox::syscall_broker::COMMAND_ACCESS,
  14. sandbox::syscall_broker::COMMAND_MKDIR,
  15. sandbox::syscall_broker::COMMAND_OPEN,
  16. sandbox::syscall_broker::COMMAND_READLINK,
  17. sandbox::syscall_broker::COMMAND_RENAME,
  18. sandbox::syscall_broker::COMMAND_RMDIR,
  19. sandbox::syscall_broker::COMMAND_STAT,
  20. sandbox::syscall_broker::COMMAND_UNLINK,
  21. });
  22. }
  23. std::vector<BrokerFilePermission> GetNetworkFilePermissions() {
  24. // TODO(tsepez): remove universal permission under filesystem root.
  25. return {BrokerFilePermission::ReadWriteCreateRecursive("/")};
  26. }
  27. bool NetworkPreSandboxHook(sandbox::policy::SandboxLinux::Options options) {
  28. auto* instance = sandbox::policy::SandboxLinux::GetInstance();
  29. instance->StartBrokerProcess(
  30. GetNetworkBrokerCommandSet(), GetNetworkFilePermissions(),
  31. sandbox::policy::SandboxLinux::PreSandboxHook(), options);
  32. instance->EngageNamespaceSandboxIfPossible();
  33. return true;
  34. }
  35. } // namespace network