sandboxed-api/oss-internship-2020/libtiff/sandboxed.h

71 lines
2.1 KiB
C
Raw Normal View History

2020-09-24 04:21:33 +08:00
// Copyright 2020 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// https://www.apache.org/licenses/LICENSE-2.0
2020-09-24 04:21:33 +08:00
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
#ifndef LIBTIFF_SANDBOXED_H_
#define LIBTIFF_SANDBOXED_H_
2020-09-24 04:21:33 +08:00
#include <linux/futex.h>
#include <syscall.h>
2020-09-24 05:18:17 +08:00
2020-09-24 04:21:33 +08:00
#include <utility>
#include "sandboxed_api/util/flag.h"
#include "tiff_sapi.sapi.h" // NOLINT(build/include)
2020-09-24 04:21:33 +08:00
ABSL_DECLARE_FLAG(string, sandbox2_danger_danger_permit_all);
ABSL_DECLARE_FLAG(string, sandbox2_danger_danger_permit_all_and_log);
2020-09-24 04:21:33 +08:00
class TiffSapiSandbox : public TiffSandbox {
public:
explicit TiffSapiSandbox(std::string dir = "", std::string file = "")
: dir_(std::move(dir)), file_(std::move(file)) {}
2020-09-24 04:21:33 +08:00
private:
std::unique_ptr<sandbox2::Policy> ModifyPolicy(
sandbox2::PolicyBuilder*) override {
auto builder = sandbox2::PolicyBuilder()
.AllowRead()
.AllowStaticStartup()
.AllowWrite()
.AllowOpen()
.AllowExit()
.AllowStat()
.AllowSystemMalloc()
.AllowSyscalls({
__NR_futex,
__NR_close,
__NR_lseek,
__NR_gettid,
__NR_sysinfo,
__NR_mmap,
__NR_munmap,
});
2020-09-24 04:21:33 +08:00
if (!dir_.empty()) {
builder.AddDirectory(dir_, /*is_ro=*/false);
2020-09-24 04:21:33 +08:00
}
if (!file_.empty()) {
builder.AddFile(file_, /*is_ro=*/false);
2020-09-24 04:21:33 +08:00
}
return builder.BuildOrDie();
2020-09-24 04:21:33 +08:00
}
std::string dir_;
std::string file_;
2020-09-24 04:21:33 +08:00
};
#endif // LIBTIFF_SANDBOXED_H_