StarMirror/sandboxed-api
1
0
Fork 0
mirror of https://github.com/google/sandboxed-api.git synced 2024-03-22 13:11:30 +08:00
Code Issues Projects Releases Wiki Activity

Add an AllowAccess() convenience function to PolicyBuilder

Browse Source 
Drive-by: Apply convenience functions in policies.
PiperOrigin-RevId: 340404977
Change-Id: I906106b61c1837d23ddaff15d8792ec79d3d3189
This commit is contained in:
Christian Blichmann 2020-11-03 02:20:49 -08:00 committed by Copybara-Service
parent 8952d2ce04
commit 2acec65a58
3 changed files with 17 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
oss-internship-2020/curl/sandbox.h
View File

@ -41,9 +41,9 @@ class CurlSapiSandbox : public curl::CurlSandbox {
.AllowRead() .AllowRead()
.AllowSafeFcntl() .AllowSafeFcntl()
.AllowWrite() .AllowWrite()
.AllowAccess()
.AllowSyscalls({ .AllowSyscalls({
__NR_accept, __NR_accept,
__NR_access,
__NR_bind, __NR_bind,
__NR_connect, __NR_connect,
__NR_getpeername, __NR_getpeername,

10
sandboxed_api/sandbox2/policybuilder.cc
View File

@ -269,6 +269,16 @@ PolicyBuilder& PolicyBuilder::AllowStat() {
return *this; return *this;
} }
PolicyBuilder& PolicyBuilder::AllowAccess() {
#ifdef __NR_access
AllowSyscall(__NR_access);
#endif
#ifdef __NR_faccessat
AllowSyscall(__NR_faccessat);
#endif
return *this;
}
PolicyBuilder& PolicyBuilder::AllowRead() { PolicyBuilder& PolicyBuilder::AllowRead() {
return AllowSyscalls({ return AllowSyscalls({
__NR_read, __NR_read,

6
sandboxed_api/sandbox2/policybuilder.h
View File

@ -181,6 +181,12 @@ class PolicyBuilder final {
// - ustat // - ustat
PolicyBuilder& AllowStat(); PolicyBuilder& AllowStat();
// Appends code to allow checking file permissions.
// Allows these syscalls:
// - access
// - faccessat
PolicyBuilder& AllowAccess();
// Appends code to the policy to allow reading from file descriptors. // Appends code to the policy to allow reading from file descriptors.
// Allows these sycalls: // Allows these sycalls:
// - read // - read