1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
|
// Copyright 2022 The Chromium Authors
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
#include "sandbox/policy/linux/bpf_screen_ai_policy_linux.h"
#include <sys/mman.h>
#include <sys/prctl.h>
#include "sandbox/linux/bpf_dsl/bpf_dsl.h"
#include "sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.h"
#include "sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.h"
#include "sandbox/linux/seccomp-bpf-helpers/syscall_sets.h"
#include "sandbox/linux/system_headers/linux_futex.h"
#include "sandbox/linux/system_headers/linux_prctl.h"
#include "sandbox/linux/system_headers/linux_syscalls.h"
#include "sandbox/policy/linux/sandbox_linux.h"
using sandbox::bpf_dsl::Allow;
using sandbox::bpf_dsl::Arg;
using sandbox::bpf_dsl::Error;
using sandbox::bpf_dsl::If;
using sandbox::bpf_dsl::ResultExpr;
namespace sandbox::policy {
ScreenAIProcessPolicy::ScreenAIProcessPolicy() = default;
ScreenAIProcessPolicy::~ScreenAIProcessPolicy() = default;
ResultExpr ScreenAIProcessPolicy::EvaluateSyscall(
int system_call_number) const {
auto* sandbox_linux = SandboxLinux::GetInstance();
if (sandbox_linux->ShouldBrokerHandleSyscall(system_call_number))
return sandbox_linux->HandleViaBroker(system_call_number);
switch (system_call_number) {
#if defined(__x86_64__)
case __NR_alarm:
return Allow();
#endif
case __NR_futex:
#if defined(__NR_futex_time64)
case __NR_futex_time64:
#endif
{
const Arg<int> op(1);
return Switch(op & FUTEX_CMD_MASK)
.Cases(
{FUTEX_CMP_REQUEUE, FUTEX_LOCK_PI, FUTEX_UNLOCK_PI, FUTEX_WAIT,
FUTEX_WAIT_BITSET, FUTEX_WAKE},
Allow())
// Sending ENOSYS tells the Futex backend to use another approach if
// this fails.
.Default(Error(ENOSYS));
}
case __NR_getcpu:
return Allow();
case __NR_get_mempolicy: {
const Arg<unsigned long> which(4);
return If(which == 0, Allow()).Else(Error(EPERM));
}
case __NR_mremap: {
const Arg<int> flags(3);
return If((flags & ~(MREMAP_MAYMOVE | MREMAP_FIXED)) == 0, Allow())
.Else(CrashSIGSYS());
}
#if defined(__arm__) || defined(__aarch64__)
case __NR_prctl: {
const Arg<int> option(0);
return Switch(option)
.Cases({PR_SVE_GET_VL,
#if defined(__aarch64__)
PR_SME_GET_VL
#endif
},
Allow())
.Default(BPFBasePolicy::EvaluateSyscall(system_call_number));
}
#endif
case __NR_prlimit64:
return RestrictPrlimitToGetrlimit(GetPolicyPid());
case __NR_sysinfo:
return Allow();
default:
if (SyscallSets::IsGoogle3Threading(system_call_number)) {
return RestrictGoogle3Threading(system_call_number);
}
return BPFBasePolicy::EvaluateSyscall(system_call_number);
}
}
} // namespace sandbox::policy
|
