1 /*
2 * Copyright (C) 2015 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16 #include <linux/filter.h>
17 #include <linux/seccomp.h>
18 #include <sys/stat.h>
19 #include <sys/prctl.h>
20 #include <string>
21 #include <sys/syscall.h>
22 #include <errno.h>
23
24 #include <jni.h>
25 #include "JNIHelp.h"
26 #include "ScopedUtfChars.h"
27
Java_libcore_java_io_FileTest_nativeTestFilesWithSurrogatePairs(JNIEnv * env,jobject,jstring baseDir)28 extern "C" void Java_libcore_java_io_FileTest_nativeTestFilesWithSurrogatePairs(
29 JNIEnv* env, jobject /* clazz */, jstring baseDir) {
30 ScopedUtfChars baseDirUtf(env, baseDir);
31
32 std::string base(baseDirUtf.c_str());
33 std::string subDir = base + "/dir_\xF0\x93\x80\x80";
34 std::string subFile = subDir + "/file_\xF0\x93\x80\x80";
35
36 struct stat sb;
37 int ret = stat(subDir.c_str(), &sb);
38 if (ret == -1) {
39 jniThrowIOException(env, errno);
40 }
41 if (!S_ISDIR(sb.st_mode)) {
42 jniThrowException(env, "java/lang/IllegalStateException", "expected dir");
43 }
44
45 ret = stat(subFile.c_str(), &sb);
46 if (ret == -1) {
47 jniThrowIOException(env, errno);
48 }
49
50 if (!S_ISREG(sb.st_mode)) {
51 jniThrowException(env, "java/lang/IllegalStateException", "expected file");
52 }
53 }
54
Java_libcore_java_io_FileTest_installSeccompFilter(JNIEnv *,jclass)55 extern "C" int Java_libcore_java_io_FileTest_installSeccompFilter(JNIEnv* , jclass /* clazz */) {
56 struct sock_filter filter[] = {
57 BPF_STMT(BPF_LD|BPF_W|BPF_ABS, offsetof(struct seccomp_data, nr)),
58
59 // for arm, mips, x86.
60 #ifdef __NR_fstatat64
61 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_fstatat64, 0, 1),
62 #else
63 // for arm64, x86_64.
64 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_newfstatat, 0, 1),
65 #endif
66 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ERRNO | EPERM),
67 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
68 };
69 struct sock_fprog prog = {
70 .len = (unsigned short)(sizeof(filter)/sizeof(filter[0])),
71 .filter = filter,
72 };
73 long ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
74
75 return ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog);
76 }
77