services/service_manager/sandbox/linux/bpf_broker_policy_linux.h

// Copyright 2017 The Chromium Authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

#ifndef SERVICES_SERVICE_MANAGER_SANDBOX_LINUX_BPF_BROKER_POLICY_LINUX_H_
#define SERVICES_SERVICE_MANAGER_SANDBOX_LINUX_BPF_BROKER_POLICY_LINUX_H_

#include "sandbox/linux/bpf_dsl/bpf_dsl.h"
#include "sandbox/linux/syscall_broker/broker_command.h"
#include "services/service_manager/sandbox/export.h"
#include "services/service_manager/sandbox/linux/bpf_base_policy_linux.h"

namespace service_manager {

// A broker policy is one for a privileged syscall broker that allows
// access, open, openat, and (in the non-Chrome OS case) unlink.
class SERVICE_MANAGER_SANDBOX_EXPORT BrokerProcessPolicy
    : public BPFBasePolicy {
 public:
  explicit BrokerProcessPolicy(
      const sandbox::syscall_broker::BrokerCommandSet& allowed_command_set);
  ~BrokerProcessPolicy() override;

  sandbox::bpf_dsl::ResultExpr EvaluateSyscall(
      int system_call_number) const override;

 private:
  const sandbox::syscall_broker::BrokerCommandSet allowed_command_set_;

  DISALLOW_COPY_AND_ASSIGN(BrokerProcessPolicy);
};

}  // namespace service_manager

#endif  // SERVICES_SERVICE_MANAGER_SANDBOX_LINUX_BPF_BROKER_POLICY_LINUX_H_