mirror of
https://github.com/google/sandboxed-api.git
synced 2024-03-22 13:11:30 +08:00
Implement stricter policy
This commit is contained in:
parent
1b0a8edfd4
commit
cea046d3e2
3
.gitmodules
vendored
3
.gitmodules
vendored
|
@ -7,3 +7,6 @@
|
|||
[submodule "oss-internship-2020/curl/curl_wrapper/curl"]
|
||||
path = oss-internship-2020/curl/curl_wrapper/curl
|
||||
url = https://github.com/curl/curl
|
||||
[submodule "oss-internship-2020/curl/tests/googletest"]
|
||||
path = oss-internship-2020/curl/tests/googletest
|
||||
url = git@github.com:google/googletest.git
|
||||
|
|
61
oss-internship-2020/curl/sandbox.h
Normal file
61
oss-internship-2020/curl/sandbox.h
Normal file
|
@ -0,0 +1,61 @@
|
|||
// Copyright 2020 Google LLC
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
#include <syscall.h>
|
||||
|
||||
#include <cstdlib>
|
||||
|
||||
#include "curl_sapi.sapi.h"
|
||||
#include "sandboxed_api/util/flag.h"
|
||||
|
||||
class CurlSapiSandbox : public CurlSandbox {
|
||||
protected:
|
||||
std::unique_ptr<sandbox2::Policy> ModifyPolicy(
|
||||
sandbox2::PolicyBuilder* policy_builder) override {
|
||||
// Return a new policy
|
||||
return (*policy_builder)
|
||||
.AllowDynamicStartup()
|
||||
.AllowExit()
|
||||
.AllowFork()
|
||||
.AllowHandleSignals()
|
||||
.AllowOpen()
|
||||
.AllowRead()
|
||||
.AllowSafeFcntl()
|
||||
.AllowWrite()
|
||||
.AllowSyscalls({
|
||||
__NR_accept,
|
||||
__NR_access,
|
||||
__NR_bind,
|
||||
__NR_connect,
|
||||
__NR_futex,
|
||||
__NR_getpeername,
|
||||
__NR_getsockname,
|
||||
__NR_getsockopt,
|
||||
__NR_ioctl,
|
||||
__NR_listen,
|
||||
__NR_madvise,
|
||||
__NR_mmap,
|
||||
__NR_poll,
|
||||
__NR_recvfrom,
|
||||
__NR_recvmsg,
|
||||
__NR_sendmmsg,
|
||||
__NR_sendto,
|
||||
__NR_setsockopt,
|
||||
__NR_socket
|
||||
})
|
||||
.AllowUnrestrictedNetworking()
|
||||
.AddDirectory("/lib")
|
||||
.BuildOrDie();
|
||||
}
|
||||
};
|
1
oss-internship-2020/curl/tests/googletest
Submodule
1
oss-internship-2020/curl/tests/googletest
Submodule
|
@ -0,0 +1 @@
|
|||
Subproject commit adeef192947fbc0f68fa14a6c494c8df32177508
|
Loading…
Reference in New Issue
Block a user