1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. 2 // Use of this source code is governed by a BSD-style license that can be 3 // found in the LICENSE file. 4 5 #ifndef SANDBOX_LINUX_SECCOMP_BPF_HELPERS_BASELINE_POLICY_H_ 6 #define SANDBOX_LINUX_SECCOMP_BPF_HELPERS_BASELINE_POLICY_H_ 7 8 #include "sandbox/linux/seccomp-bpf/errorcode.h" 9 #include "sandbox/linux/seccomp-bpf/sandbox_bpf_policy.h" 10 #include "sandbox/sandbox_export.h" 11 12 namespace sandbox { 13 14 class SandboxBPF; 15 class SandboxBPFPolicy; 16 17 // This is a helper to build seccomp-bpf policies, i.e. policies for a sandbox 18 // that reduces the Linux kernel's attack surface. Given its nature, it doesn't 19 // have a clear semantics and is mostly "implementation-defined". 20 // 21 // This class implements the SandboxBPFPolicy interface with a "baseline" 22 // policy for us within Chromium. 23 // The "baseline" policy is somewhat arbitrary. All Chromium policies are an 24 // alteration of it, and it represents a reasonable common ground to run most 25 // code in a sandboxed environment. 26 // A baseline policy is only valid for the process for which this object was 27 // instantiated (so do not fork() and use it in a child). 28 class SANDBOX_EXPORT BaselinePolicy : public SandboxBPFPolicy { 29 public: 30 BaselinePolicy(); 31 // |fs_denied_errno| is the errno returned when a filesystem access system 32 // call is denied. 33 explicit BaselinePolicy(int fs_denied_errno); 34 virtual ~BaselinePolicy(); 35 36 virtual ErrorCode EvaluateSyscall(SandboxBPF* sandbox_compiler, 37 int system_call_number) const OVERRIDE; 38 39 private: 40 int fs_denied_errno_; 41 pid_t current_pid_; 42 DISALLOW_COPY_AND_ASSIGN(BaselinePolicy); 43 }; 44 45 } // namespace sandbox. 46 47 #endif // SANDBOX_LINUX_SECCOMP_BPF_HELPERS_BASELINE_POLICY_H_ 48