StarMirror/sandboxed-api
1
0
Fork 0
mirror of https://github.com/google/sandboxed-api.git synced 2024-03-22 13:11:30 +08:00
Code Issues Projects Releases Wiki Activity

Allow prctl(PR_SET_VMA, PR_SET_VMA_ANON_NAME, ...) with tcmalloc

Browse Source 
PiperOrigin-RevId: 540905937
Change-Id: I9275b193ff42b4741925c3cf825841ca9a4071db
This commit is contained in:
Sandboxed API Team 2023-06-16 09:33:25 -07:00 committed by Copybara-Service
parent 93c1423b15
commit cf43c0f02c
2 changed files with 20 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
sandboxed_api/sandbox2/policybuilder.cc
View File

@ -241,6 +241,7 @@ PolicyBuilder& PolicyBuilder::AllowTcMalloc() {
AllowSyscalls( AllowSyscalls(
{__NR_munmap, __NR_nanosleep, __NR_brk, __NR_mincore, __NR_membarrier}); {__NR_munmap, __NR_nanosleep, __NR_brk, __NR_mincore, __NR_membarrier});
AllowLimitedMadvise(); AllowLimitedMadvise();
AllowPrctlSetVma();
AddPolicyOnSyscall(__NR_mprotect, { AddPolicyOnSyscall(__NR_mprotect, {
ARG_32(2), ARG_32(2),
@ -866,6 +867,20 @@ PolicyBuilder& PolicyBuilder::AllowPrctlSetName() {
return *this; return *this;
} }
PolicyBuilder& PolicyBuilder::AllowPrctlSetVma() {
AddPolicyOnSyscall(__NR_prctl,
[](bpf_labels& labels) -> std::vector<sock_filter> {
return {
ARG_32(0),
JNE32(PR_SET_VMA, JUMP(&labels, prctlsetvma_end)),
ARG_32(1),
JEQ32(PR_SET_VMA_ANON_NAME, ALLOW),
LABEL(&labels, prctlsetvma_end),
};
});
return *this;
}
PolicyBuilder& PolicyBuilder::AllowFutexOp(int op) { PolicyBuilder& PolicyBuilder::AllowFutexOp(int op) {
return AddPolicyOnSyscall( return AddPolicyOnSyscall(
__NR_futex, { __NR_futex, {

5
sandboxed_api/sandbox2/policybuilder.h
View File

@ -512,6 +512,11 @@ class PolicyBuilder final {
// - prctl(PR_SET_NAME, ...) // - prctl(PR_SET_NAME, ...)
PolicyBuilder& AllowPrctlSetName(); PolicyBuilder& AllowPrctlSetName();
// Appends code to allow setting a name for an anonymous memory region.
// Allows the following
// - prctl(PR_SET_VMA, PR_SET_VMA_ANON_NAME, ...)
PolicyBuilder& AllowPrctlSetVma();
// Enables the syscalls necessary to start a statically linked binary // Enables the syscalls necessary to start a statically linked binary
// //
// NOTE: This will call BlockSyscallWithErrno(__NR_readlink, ENOENT). If you // NOTE: This will call BlockSyscallWithErrno(__NR_readlink, ENOENT). If you