1 // Copyright 2013 The Chromium Authors. All rights reserved. 2 // Use of this source code is governed by a BSD-style license that can be 3 // found in the LICENSE file. 4 5 #ifndef SERVICES_SERVICE_MANAGER_SANDBOX_LINUX_BPF_BASE_POLICY_LINUX_H_ 6 #define SERVICES_SERVICE_MANAGER_SANDBOX_LINUX_BPF_BASE_POLICY_LINUX_H_ 7 8 #include <memory> 9 10 #include "base/macros.h" 11 #include "sandbox/linux/bpf_dsl/bpf_dsl_forward.h" 12 #include "sandbox/linux/bpf_dsl/policy.h" 13 #include "sandbox/linux/seccomp-bpf-helpers/baseline_policy.h" 14 #include "services/service_manager/sandbox/export.h" 15 16 namespace service_manager { 17 18 // The "baseline" BPF policy. Any other seccomp-bpf policy should inherit 19 // from it. 20 // It implements the main Policy interface. Due to its nature 21 // as a "kernel attack surface reduction" layer, it's implementation-defined. 22 class SERVICE_MANAGER_SANDBOX_EXPORT BPFBasePolicy 23 : public sandbox::bpf_dsl::Policy { 24 public: 25 BPFBasePolicy(); 26 ~BPFBasePolicy() override; 27 28 // sandbox::bpf_dsl::Policy: 29 sandbox::bpf_dsl::ResultExpr EvaluateSyscall( 30 int system_call_number) const override; 31 sandbox::bpf_dsl::ResultExpr InvalidSyscall() const override; 32 33 // Get the errno(3) to return for filesystem errors. 34 static int GetFSDeniedErrno(); 35 GetPolicyPid()36 pid_t GetPolicyPid() const { return baseline_policy_->policy_pid(); } 37 38 private: 39 // Compose the BaselinePolicy from sandbox/. 40 std::unique_ptr<sandbox::BaselinePolicy> baseline_policy_; 41 DISALLOW_COPY_AND_ASSIGN(BPFBasePolicy); 42 }; 43 44 } // namespace service_manager 45 46 #endif // SERVICES_SERVICE_MANAGER_SANDBOX_LINUX_BPF_BASE_POLICY_LINUX_H_ 47