1// Copyright (c) 2013 The Chromium Authors. All rights reserved. 2// Use of this source code is governed by a BSD-style license that can be 3// found in the LICENSE file. 4 5#ifndef SANDBOX_LINUX_SECCOMP_BPF_HELPERS_BASELINE_POLICY_H_ 6#define SANDBOX_LINUX_SECCOMP_BPF_HELPERS_BASELINE_POLICY_H_ 7 8#include <sys/types.h> 9 10#include "base/macros.h" 11#include "sandbox/linux/bpf_dsl/bpf_dsl_forward.h" 12#include "sandbox/linux/bpf_dsl/policy.h" 13#include "sandbox/sandbox_export.h" 14 15namespace sandbox { 16 17// This is a helper to build seccomp-bpf policies, i.e. policies for a sandbox 18// that reduces the Linux kernel's attack surface. Given its nature, it doesn't 19// have a clear semantics and is mostly "implementation-defined". 20// 21// This class implements the Policy interface with a "baseline" 22// policy for use within Chromium. 23// The "baseline" policy is somewhat arbitrary. All Chromium policies are an 24// alteration of it, and it represents a reasonable common ground to run most 25// code in a sandboxed environment. 26// A baseline policy is only valid for the process for which this object was 27// instantiated (so do not fork() and use it in a child). 28class SANDBOX_EXPORT BaselinePolicy : public bpf_dsl::Policy { 29 public: 30 BaselinePolicy(); 31 // |fs_denied_errno| is the errno returned when a filesystem access system 32 // call is denied. 33 explicit BaselinePolicy(int fs_denied_errno); 34 ~BaselinePolicy() override; 35 36 bpf_dsl::ResultExpr EvaluateSyscall(int system_call_number) const override; 37 bpf_dsl::ResultExpr InvalidSyscall() const override; 38 pid_t policy_pid() const { return policy_pid_; } 39 40 private: 41 int fs_denied_errno_; 42 43 // The PID that the policy applies to (should be equal to the current pid). 44 pid_t policy_pid_; 45 46 DISALLOW_COPY_AND_ASSIGN(BaselinePolicy); 47}; 48 49} // namespace sandbox. 50 51#endif // SANDBOX_LINUX_SECCOMP_BPF_HELPERS_BASELINE_POLICY_H_ 52