1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. 2 // Use of this source code is governed by a BSD-style license that can be 3 // found in the LICENSE file. 4 5 #ifndef SANDBOX_LINUX_SECCOMP_BPF_HELPERS_BASELINE_POLICY_H_ 6 #define SANDBOX_LINUX_SECCOMP_BPF_HELPERS_BASELINE_POLICY_H_ 7 8 #include "base/macros.h" 9 #include "sandbox/linux/bpf_dsl/bpf_dsl_forward.h" 10 #include "sandbox/linux/bpf_dsl/policy.h" 11 #include "sandbox/sandbox_export.h" 12 13 namespace sandbox { 14 15 // This is a helper to build seccomp-bpf policies, i.e. policies for a sandbox 16 // that reduces the Linux kernel's attack surface. Given its nature, it doesn't 17 // have a clear semantics and is mostly "implementation-defined". 18 // 19 // This class implements the Policy interface with a "baseline" 20 // policy for use within Chromium. 21 // The "baseline" policy is somewhat arbitrary. All Chromium policies are an 22 // alteration of it, and it represents a reasonable common ground to run most 23 // code in a sandboxed environment. 24 // A baseline policy is only valid for the process for which this object was 25 // instantiated (so do not fork() and use it in a child). 26 class SANDBOX_EXPORT BaselinePolicy : public bpf_dsl::Policy { 27 public: 28 BaselinePolicy(); 29 // |fs_denied_errno| is the errno returned when a filesystem access system 30 // call is denied. 31 explicit BaselinePolicy(int fs_denied_errno); 32 ~BaselinePolicy() override; 33 34 bpf_dsl::ResultExpr EvaluateSyscall(int system_call_number) const override; 35 bpf_dsl::ResultExpr InvalidSyscall() const override; 36 pid_t policy_pid() const { return policy_pid_; } 37 38 private: 39 int fs_denied_errno_; 40 41 // The PID that the policy applies to (should be equal to the current pid). 42 pid_t policy_pid_; 43 44 DISALLOW_COPY_AND_ASSIGN(BaselinePolicy); 45 }; 46 47 } // namespace sandbox. 48 49 #endif // SANDBOX_LINUX_SECCOMP_BPF_HELPERS_BASELINE_POLICY_H_ 50
