1// Copyright (c) 2013 The Chromium Authors. All rights reserved.
2// Use of this source code is governed by a BSD-style license that can be
3// found in the LICENSE file.
4
5#ifndef SANDBOX_LINUX_SECCOMP_BPF_HELPERS_BASELINE_POLICY_H_
6#define SANDBOX_LINUX_SECCOMP_BPF_HELPERS_BASELINE_POLICY_H_
7
8#include <sys/types.h>
9
10#include "base/macros.h"
11#include "sandbox/linux/bpf_dsl/bpf_dsl_forward.h"
12#include "sandbox/linux/bpf_dsl/policy.h"
13#include "sandbox/sandbox_export.h"
14
15namespace sandbox {
16
17// This is a helper to build seccomp-bpf policies, i.e. policies for a sandbox
18// that reduces the Linux kernel's attack surface. Given its nature, it doesn't
19// have a clear semantics and is mostly "implementation-defined".
20//
21// This class implements the Policy interface with a "baseline"
22// policy for use within Chromium.
23// The "baseline" policy is somewhat arbitrary. All Chromium policies are an
24// alteration of it, and it represents a reasonable common ground to run most
25// code in a sandboxed environment.
26// A baseline policy is only valid for the process for which this object was
27// instantiated (so do not fork() and use it in a child).
28class SANDBOX_EXPORT BaselinePolicy : public bpf_dsl::Policy {
29 public:
30  BaselinePolicy();
31  // |fs_denied_errno| is the errno returned when a filesystem access system
32  // call is denied.
33  explicit BaselinePolicy(int fs_denied_errno);
34  ~BaselinePolicy() override;
35
36  bpf_dsl::ResultExpr EvaluateSyscall(int system_call_number) const override;
37  bpf_dsl::ResultExpr InvalidSyscall() const override;
38  pid_t policy_pid() const { return policy_pid_; }
39
40 private:
41  int fs_denied_errno_;
42
43  // The PID that the policy applies to (should be equal to the current pid).
44  pid_t policy_pid_;
45
46  DISALLOW_COPY_AND_ASSIGN(BaselinePolicy);
47};
48
49}  // namespace sandbox.
50
51#endif  // SANDBOX_LINUX_SECCOMP_BPF_HELPERS_BASELINE_POLICY_H_
52