StarMirror/sandboxed-api
1
0
Fork 0
mirror of https://github.com/google/sandboxed-api.git synced 2024-03-22 13:11:30 +08:00
Code Issues Projects Releases Wiki Activity

Make use of the new AllowPrctlSetName convenience function.

Browse Source 
PiperOrigin-RevId: 436727461
Change-Id: Iab1945c422b8db98a220cdeacdec7c9868ea9e84
This commit is contained in:
Oliver Kunz 2022-03-23 06:59:08 -07:00 committed by Copybara-Service
parent babe23261f
commit 44cd37c94e
2 changed files with 7 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
sandboxed_api/sandbox2/examples/static/static_bin.cc
View File

@ -18,6 +18,7 @@
// It inverts all bytes coming from stdin and writes them to the stdout. // It inverts all bytes coming from stdin and writes them to the stdout.
#include <signal.h> #include <signal.h>
#include <sys/prctl.h>
#include <unistd.h> #include <unistd.h>
#include <cctype> #include <cctype>
@ -28,6 +29,8 @@ int main(int argc, char** argv) {
char buf[1024]; char buf[1024];
size_t total_bytes = 0U; size_t total_bytes = 0U;
prctl(PR_SET_NAME, "static_bin");
fprintf(stderr, "=============================\n"); fprintf(stderr, "=============================\n");
fprintf(stderr, "Starting file capitalization\n"); fprintf(stderr, "Starting file capitalization\n");
fprintf(stderr, "=============================\n"); fprintf(stderr, "=============================\n");

4
sandboxed_api/sandbox2/examples/static/static_sandbox.cc
View File

@ -69,6 +69,10 @@ std::unique_ptr<sandbox2::Policy> GetPolicy() {
// write() calls with fd not in (1, 2) will continue evaluating the // write() calls with fd not in (1, 2) will continue evaluating the
// policy. This means that other rules might still allow them. // policy. This means that other rules might still allow them.
// Allow the Sandboxee to set the name for better recognition in the
// process listing.
.AllowPrctlSetName()
// Allow the dynamic loader to mark pages to never allow read-write-exec. // Allow the dynamic loader to mark pages to never allow read-write-exec.
.AddPolicyOnSyscall(__NR_mprotect, .AddPolicyOnSyscall(__NR_mprotect,
{ {