StarMirror/sandboxed-api
1
0
Fork 0
mirror of https://github.com/google/sandboxed-api.git synced 2024-03-22 13:11:30 +08:00
Code Issues Projects Releases Wiki Activity

Handle prlimit64 in Allow*RLimit

Browse Source 
PiperOrigin-RevId: 598794581
Change-Id: If7898294aab1cf77f9b8007e4a9dc8bd74449f9b
This commit is contained in:
Wiktor Garbacz 2024-01-16 03:59:28 -08:00 committed by Copybara-Service
parent 9a06f3ac0c
commit fbfc2b9eac
1 changed files with 8 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
sandboxed_api/sandbox2/policybuilder.cc
View File

@ -805,6 +805,9 @@ PolicyBuilder& PolicyBuilder::AllowGetPGIDs() {
} }
PolicyBuilder& PolicyBuilder::AllowGetRlimit() { PolicyBuilder& PolicyBuilder::AllowGetRlimit() {
#ifdef __NR_prlimit64
AddPolicyOnSyscall(__NR_prlimit64, {ARG(2), JEQ64(0, 0, ALLOW)});
#endif
return AllowSyscalls({ return AllowSyscalls({
#ifdef __NR_getrlimit #ifdef __NR_getrlimit
__NR_getrlimit, __NR_getrlimit,
@ -817,6 +820,9 @@ PolicyBuilder& PolicyBuilder::AllowGetRlimit() {
PolicyBuilder& PolicyBuilder::AllowSetRlimit() { PolicyBuilder& PolicyBuilder::AllowSetRlimit() {
return AllowSyscalls({ return AllowSyscalls({
#ifdef __NR_prlimit64
__NR_prlimit64,
#endif
#ifdef __NR_setrlimit #ifdef __NR_setrlimit
__NR_setrlimit, __NR_setrlimit,
#endif #endif
@ -865,7 +871,7 @@ PolicyBuilder& PolicyBuilder::AllowLogForwarding() {
ARG_32(0), ARG_32(0),
JEQ32(SIG_BLOCK, ALLOW), JEQ32(SIG_BLOCK, ALLOW),
}); });
AllowSyscall(__NR_prlimit64); AllowGetRlimit();
// For LOG(FATAL) // For LOG(FATAL)
return AddPolicyOnSyscall(__NR_kill, return AddPolicyOnSyscall(__NR_kill,
@ -999,9 +1005,7 @@ PolicyBuilder& PolicyBuilder::AllowStaticStartup() {
OverridableBlockSyscallWithErrno(__NR_readlink, ENOENT); OverridableBlockSyscallWithErrno(__NR_readlink, ENOENT);
#endif #endif
#ifdef __NR_prlimit64 AllowGetRlimit();
OverridableBlockSyscallWithErrno(__NR_prlimit64, EPERM);
#endif
AddPolicyOnSyscall(__NR_mprotect, { AddPolicyOnSyscall(__NR_mprotect, {
ARG_32(2), ARG_32(2),
JEQ32(PROT_READ, ALLOW), JEQ32(PROT_READ, ALLOW),