1 // Copyright 2013 The Chromium Authors. All rights reserved. 2 // Use of this source code is governed by a BSD-style license that can be 3 // found in the LICENSE file. 4 5 #include "content/common/sandbox_linux/bpf_ppapi_policy_linux.h" 6 7 #include <errno.h> 8 9 #include "base/basictypes.h" 10 #include "build/build_config.h" 11 #include "content/common/sandbox_linux/sandbox_linux.h" 12 #include "sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.h" 13 #include "sandbox/linux/seccomp-bpf-helpers/syscall_sets.h" 14 #include "sandbox/linux/seccomp-bpf/sandbox_bpf_policy.h" 15 #include "sandbox/linux/services/linux_syscalls.h" 16 17 using sandbox::SyscallSets; 18 19 namespace content { 20 PpapiProcessPolicy()21PpapiProcessPolicy::PpapiProcessPolicy() {} ~PpapiProcessPolicy()22PpapiProcessPolicy::~PpapiProcessPolicy() {} 23 EvaluateSyscall(SandboxBPF * sandbox,int sysno) const24ErrorCode PpapiProcessPolicy::EvaluateSyscall(SandboxBPF* sandbox, 25 int sysno) const { 26 switch (sysno) { 27 // TODO(jln): restrict prctl. 28 case __NR_prctl: 29 case __NR_pread64: 30 case __NR_pwrite64: 31 case __NR_sched_get_priority_max: 32 case __NR_sched_get_priority_min: 33 case __NR_sched_getaffinity: 34 case __NR_sched_getparam: 35 case __NR_sched_getscheduler: 36 case __NR_sched_setscheduler: 37 case __NR_times: 38 return ErrorCode(ErrorCode::ERR_ALLOWED); 39 case __NR_ioctl: 40 return ErrorCode(ENOTTY); // Flash Access. 41 default: 42 // Default on the baseline policy. 43 return SandboxBPFBasePolicy::EvaluateSyscall(sandbox, sysno); 44 } 45 } 46 47 } // namespace content 48