sandboxed-api/oss-internship-2020/curl/sandbox.h

72 lines
1.9 KiB
C
Raw Normal View History

Copybara import of the project: Including changes for GitHub -> internal migration -- b5d7e43ddeff9c087d0f67949bea6ac795c5474a by Federico Stazi <34340238+FedericoStazi@users.noreply.github.com>: Initial curl commit -- 24786c44d89b4a6817204aaacd84fc1aa2747434 by Federico Stazi <fstazi@google.com>: Added gitignore and curl submodule -- 6d5cfd575abd05c387f93be060c8fc88fd39e482 by Federico Stazi <fstazi@google.com>: Added new line at the end of files -- c7423c5f8a8d460655d0fafa198758c39d5270d1 by Federico Stazi <fstazi@google.com>: Remove SHARED from add_sapi_library -- 05c0a4b004feba1c0ae1ba6bf519966f48589ba6 by Federico Stazi <fstazi@google.com>: Fix includes -- 5be51fabbef7e7eab032dbfb94239654e44008c3 by Federico Stazi <fstazi@google.com>: Improve comments -- 34338411b845d438a5b7615d990d6539771152eb by Federico Stazi <fstazi@google.com>: Improve style -- 8c68ac221ff158aab3b285d8b2d6158a895ddbf2 by Federico Stazi <fstazi@google.com>: Address review comments -- ac1112ae4de6f5f520054b5608d202a57c296ac4 by Federico Stazi <fstazi@google.com>: Minor fix -- f47e1cc6aceb0365cb2e5352d61980628af7f954 by Federico Stazi <fstazi@google.com>: Implement all curl methods -- 929123127532589ef19f12114b8e450cc2c976a1 by Federico Stazi <fstazi@google.com>: Address reviews and improve code style -- 1b0a8edfd4cdffdc76f3e979a5e1b42cbe289e73 by Federico Stazi <fstazi@google.com>: Minor fix -- cea046d3e29b86e04bd6ce7821ee1409cea2db37 by Federico Stazi <fstazi@google.com>: Implement stricter policy -- cf23888b88b71add3e60524f3db3604f0ab6c386 by Federico Stazi <fstazi@google.com>: Improve and extend examples -- 6167cafbdec1355588c073baa8cdf17fad1fcb9e by Federico Stazi <fstazi@google.com>: Implement tests -- 9fed2ec09798e656cd5c518bc13f45eea1abef2e by Federico Stazi <fstazi@google.com>: Improved error handling -- e446ec81a13d3c567bdebe00285211d9df9dbed1 by Federico Stazi <fstazi@google.com>: Address review comments -- cf41ec4701a6a47ecee3af6765623ca020cebfcd by Federico Stazi <34340238+FedericoStazi@users.noreply.github.com>: Fix project name -- 9a4293a3cfd87b9b13b46a36d5eeee9d575ea519 by Federico Stazi <fstazi@google.com>: Fix project name -- bbebeee1a69fed2c70afc6afa2aa79aad990a778 by Federico Stazi <fstazi@google.com>: Fix test mock server -- eb783de3f5fc35877db5f08fd53c9a33207a416e by Federico Stazi <fstazi@google.com>: Address review comments -- cf6cb89bca2b0275652509afdb4d4e20e9e851ba by Federico Stazi <fstazi@google.com>: Minor mock server fix -- b52d9e6e4fa1f9c07a3027b4b4d564457e7a648f by Federico Stazi <fstazi@google.com>: Address review comments PiperOrigin-RevId: 333292204 Change-Id: I9ff27348028d9f22486492dc92c0859ff8f44d68
2020-09-23 22:59:42 +08:00
// Copyright 2020 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
#ifndef SANDBOX_H_
#define SANDBOX_H_
#include <linux/futex.h>
#include <sys/mman.h> // For mmap arguments
#include <syscall.h>
#include <cstdlib>
#include "curl_sapi.sapi.h" // NOLINT(build/include)
#include "sandboxed_api/sandbox2/util/bpf_helper.h"
namespace curl {
class CurlSapiSandbox : public curl::CurlSandbox {
Copybara import of the project: Including changes for GitHub -> internal migration -- b5d7e43ddeff9c087d0f67949bea6ac795c5474a by Federico Stazi <34340238+FedericoStazi@users.noreply.github.com>: Initial curl commit -- 24786c44d89b4a6817204aaacd84fc1aa2747434 by Federico Stazi <fstazi@google.com>: Added gitignore and curl submodule -- 6d5cfd575abd05c387f93be060c8fc88fd39e482 by Federico Stazi <fstazi@google.com>: Added new line at the end of files -- c7423c5f8a8d460655d0fafa198758c39d5270d1 by Federico Stazi <fstazi@google.com>: Remove SHARED from add_sapi_library -- 05c0a4b004feba1c0ae1ba6bf519966f48589ba6 by Federico Stazi <fstazi@google.com>: Fix includes -- 5be51fabbef7e7eab032dbfb94239654e44008c3 by Federico Stazi <fstazi@google.com>: Improve comments -- 34338411b845d438a5b7615d990d6539771152eb by Federico Stazi <fstazi@google.com>: Improve style -- 8c68ac221ff158aab3b285d8b2d6158a895ddbf2 by Federico Stazi <fstazi@google.com>: Address review comments -- ac1112ae4de6f5f520054b5608d202a57c296ac4 by Federico Stazi <fstazi@google.com>: Minor fix -- f47e1cc6aceb0365cb2e5352d61980628af7f954 by Federico Stazi <fstazi@google.com>: Implement all curl methods -- 929123127532589ef19f12114b8e450cc2c976a1 by Federico Stazi <fstazi@google.com>: Address reviews and improve code style -- 1b0a8edfd4cdffdc76f3e979a5e1b42cbe289e73 by Federico Stazi <fstazi@google.com>: Minor fix -- cea046d3e29b86e04bd6ce7821ee1409cea2db37 by Federico Stazi <fstazi@google.com>: Implement stricter policy -- cf23888b88b71add3e60524f3db3604f0ab6c386 by Federico Stazi <fstazi@google.com>: Improve and extend examples -- 6167cafbdec1355588c073baa8cdf17fad1fcb9e by Federico Stazi <fstazi@google.com>: Implement tests -- 9fed2ec09798e656cd5c518bc13f45eea1abef2e by Federico Stazi <fstazi@google.com>: Improved error handling -- e446ec81a13d3c567bdebe00285211d9df9dbed1 by Federico Stazi <fstazi@google.com>: Address review comments -- cf41ec4701a6a47ecee3af6765623ca020cebfcd by Federico Stazi <34340238+FedericoStazi@users.noreply.github.com>: Fix project name -- 9a4293a3cfd87b9b13b46a36d5eeee9d575ea519 by Federico Stazi <fstazi@google.com>: Fix project name -- bbebeee1a69fed2c70afc6afa2aa79aad990a778 by Federico Stazi <fstazi@google.com>: Fix test mock server -- eb783de3f5fc35877db5f08fd53c9a33207a416e by Federico Stazi <fstazi@google.com>: Address review comments -- cf6cb89bca2b0275652509afdb4d4e20e9e851ba by Federico Stazi <fstazi@google.com>: Minor mock server fix -- b52d9e6e4fa1f9c07a3027b4b4d564457e7a648f by Federico Stazi <fstazi@google.com>: Address review comments PiperOrigin-RevId: 333292204 Change-Id: I9ff27348028d9f22486492dc92c0859ff8f44d68
2020-09-23 22:59:42 +08:00
protected:
std::unique_ptr<sandbox2::Policy> ModifyPolicy(
sandbox2::PolicyBuilder* policy_builder) override {
// Return a new policy
return (*policy_builder)
.AllowDynamicStartup()
.AllowExit()
.AllowFork()
.AllowFutexOp(FUTEX_WAKE_PRIVATE)
.AllowMmap()
.AllowOpen()
.AllowRead()
.AllowSafeFcntl()
.AllowWrite()
.AllowAccess()
Copybara import of the project: Including changes for GitHub -> internal migration -- b5d7e43ddeff9c087d0f67949bea6ac795c5474a by Federico Stazi <34340238+FedericoStazi@users.noreply.github.com>: Initial curl commit -- 24786c44d89b4a6817204aaacd84fc1aa2747434 by Federico Stazi <fstazi@google.com>: Added gitignore and curl submodule -- 6d5cfd575abd05c387f93be060c8fc88fd39e482 by Federico Stazi <fstazi@google.com>: Added new line at the end of files -- c7423c5f8a8d460655d0fafa198758c39d5270d1 by Federico Stazi <fstazi@google.com>: Remove SHARED from add_sapi_library -- 05c0a4b004feba1c0ae1ba6bf519966f48589ba6 by Federico Stazi <fstazi@google.com>: Fix includes -- 5be51fabbef7e7eab032dbfb94239654e44008c3 by Federico Stazi <fstazi@google.com>: Improve comments -- 34338411b845d438a5b7615d990d6539771152eb by Federico Stazi <fstazi@google.com>: Improve style -- 8c68ac221ff158aab3b285d8b2d6158a895ddbf2 by Federico Stazi <fstazi@google.com>: Address review comments -- ac1112ae4de6f5f520054b5608d202a57c296ac4 by Federico Stazi <fstazi@google.com>: Minor fix -- f47e1cc6aceb0365cb2e5352d61980628af7f954 by Federico Stazi <fstazi@google.com>: Implement all curl methods -- 929123127532589ef19f12114b8e450cc2c976a1 by Federico Stazi <fstazi@google.com>: Address reviews and improve code style -- 1b0a8edfd4cdffdc76f3e979a5e1b42cbe289e73 by Federico Stazi <fstazi@google.com>: Minor fix -- cea046d3e29b86e04bd6ce7821ee1409cea2db37 by Federico Stazi <fstazi@google.com>: Implement stricter policy -- cf23888b88b71add3e60524f3db3604f0ab6c386 by Federico Stazi <fstazi@google.com>: Improve and extend examples -- 6167cafbdec1355588c073baa8cdf17fad1fcb9e by Federico Stazi <fstazi@google.com>: Implement tests -- 9fed2ec09798e656cd5c518bc13f45eea1abef2e by Federico Stazi <fstazi@google.com>: Improved error handling -- e446ec81a13d3c567bdebe00285211d9df9dbed1 by Federico Stazi <fstazi@google.com>: Address review comments -- cf41ec4701a6a47ecee3af6765623ca020cebfcd by Federico Stazi <34340238+FedericoStazi@users.noreply.github.com>: Fix project name -- 9a4293a3cfd87b9b13b46a36d5eeee9d575ea519 by Federico Stazi <fstazi@google.com>: Fix project name -- bbebeee1a69fed2c70afc6afa2aa79aad990a778 by Federico Stazi <fstazi@google.com>: Fix test mock server -- eb783de3f5fc35877db5f08fd53c9a33207a416e by Federico Stazi <fstazi@google.com>: Address review comments -- cf6cb89bca2b0275652509afdb4d4e20e9e851ba by Federico Stazi <fstazi@google.com>: Minor mock server fix -- b52d9e6e4fa1f9c07a3027b4b4d564457e7a648f by Federico Stazi <fstazi@google.com>: Address review comments PiperOrigin-RevId: 333292204 Change-Id: I9ff27348028d9f22486492dc92c0859ff8f44d68
2020-09-23 22:59:42 +08:00
.AllowSyscalls({
__NR_accept,
__NR_bind,
__NR_connect,
__NR_getpeername,
__NR_getsockname,
__NR_getsockopt,
__NR_ioctl,
__NR_listen,
__NR_madvise,
__NR_poll,
__NR_recvfrom,
__NR_recvmsg,
__NR_sendmmsg,
__NR_sendto,
__NR_setsockopt,
__NR_socket,
})
.AllowUnrestrictedNetworking()
.AddDirectory("/lib")
.BuildOrDie();
}
};
} // namespace curl
Copybara import of the project: Including changes for GitHub -> internal migration -- b5d7e43ddeff9c087d0f67949bea6ac795c5474a by Federico Stazi <34340238+FedericoStazi@users.noreply.github.com>: Initial curl commit -- 24786c44d89b4a6817204aaacd84fc1aa2747434 by Federico Stazi <fstazi@google.com>: Added gitignore and curl submodule -- 6d5cfd575abd05c387f93be060c8fc88fd39e482 by Federico Stazi <fstazi@google.com>: Added new line at the end of files -- c7423c5f8a8d460655d0fafa198758c39d5270d1 by Federico Stazi <fstazi@google.com>: Remove SHARED from add_sapi_library -- 05c0a4b004feba1c0ae1ba6bf519966f48589ba6 by Federico Stazi <fstazi@google.com>: Fix includes -- 5be51fabbef7e7eab032dbfb94239654e44008c3 by Federico Stazi <fstazi@google.com>: Improve comments -- 34338411b845d438a5b7615d990d6539771152eb by Federico Stazi <fstazi@google.com>: Improve style -- 8c68ac221ff158aab3b285d8b2d6158a895ddbf2 by Federico Stazi <fstazi@google.com>: Address review comments -- ac1112ae4de6f5f520054b5608d202a57c296ac4 by Federico Stazi <fstazi@google.com>: Minor fix -- f47e1cc6aceb0365cb2e5352d61980628af7f954 by Federico Stazi <fstazi@google.com>: Implement all curl methods -- 929123127532589ef19f12114b8e450cc2c976a1 by Federico Stazi <fstazi@google.com>: Address reviews and improve code style -- 1b0a8edfd4cdffdc76f3e979a5e1b42cbe289e73 by Federico Stazi <fstazi@google.com>: Minor fix -- cea046d3e29b86e04bd6ce7821ee1409cea2db37 by Federico Stazi <fstazi@google.com>: Implement stricter policy -- cf23888b88b71add3e60524f3db3604f0ab6c386 by Federico Stazi <fstazi@google.com>: Improve and extend examples -- 6167cafbdec1355588c073baa8cdf17fad1fcb9e by Federico Stazi <fstazi@google.com>: Implement tests -- 9fed2ec09798e656cd5c518bc13f45eea1abef2e by Federico Stazi <fstazi@google.com>: Improved error handling -- e446ec81a13d3c567bdebe00285211d9df9dbed1 by Federico Stazi <fstazi@google.com>: Address review comments -- cf41ec4701a6a47ecee3af6765623ca020cebfcd by Federico Stazi <34340238+FedericoStazi@users.noreply.github.com>: Fix project name -- 9a4293a3cfd87b9b13b46a36d5eeee9d575ea519 by Federico Stazi <fstazi@google.com>: Fix project name -- bbebeee1a69fed2c70afc6afa2aa79aad990a778 by Federico Stazi <fstazi@google.com>: Fix test mock server -- eb783de3f5fc35877db5f08fd53c9a33207a416e by Federico Stazi <fstazi@google.com>: Address review comments -- cf6cb89bca2b0275652509afdb4d4e20e9e851ba by Federico Stazi <fstazi@google.com>: Minor mock server fix -- b52d9e6e4fa1f9c07a3027b4b4d564457e7a648f by Federico Stazi <fstazi@google.com>: Address review comments PiperOrigin-RevId: 333292204 Change-Id: I9ff27348028d9f22486492dc92c0859ff8f44d68
2020-09-23 22:59:42 +08:00
#endif // SANDBOX_H_