Mac: Tell the GPU sandbox to deny a few things.

chrome/common/sandbox_mac.mm

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/common/sandbox_mac.h"
 
 #include "base/debug_util.h"
 
 #import <Cocoa/Cocoa.h>
+#import <OpenGL/OpenGL.h>
+
 extern "C" {
 #include <sandbox.h>
 }
+#include <signal.h>
 #include <sys/param.h>
 
 #include "base/basictypes.h"
+#include "base/chrome_application_mac.h"
 #include "base/command_line.h"
 #include "base/file_util.h"
 #include "base/mac_util.h"
 #include "base/rand_util_c.h"
 #include "base/mac/scoped_cftyperef.h"
 #include "base/mac/scoped_nsautorelease_pool.h"
 #include "base/string16.h"
 #include "base/string_util.h"
 #include "base/sys_info.h"
 #include "base/sys_string_conversions.h"
@@ skipping 144 matching lines @@
 
 // Warm up System APIs that empirically need to be accessed before the Sandbox
 // is turned on.
 // This method is layed out in blocks, each one containing a separate function
 // that needs to be warmed up. The OS version on which we found the need to
 // enable the function is also noted.
 // This function is tested on the following OS versions:
 //     10.5.6, 10.6.0
 
 // static
-void Sandbox::SandboxWarmup() {
+void Sandbox::SandboxWarmup(SandboxProcessType sandbox_type) {
   base::mac::ScopedNSAutoreleasePool scoped_pool;
 
   { // CGColorSpaceCreateWithName(), CGBitmapContextCreate() - 10.5.6
     base::mac::ScopedCFTypeRef<CGColorSpaceRef> rgb_colorspace(
         CGColorSpaceCreateWithName(kCGColorSpaceGenericRGB));
 
     // Allocate a 1x1 image.
     char data[4];
     base::mac::ScopedCFTypeRef<CGContextRef> context(
         CGBitmapContextCreate(data, 1, 1, 8, 1 * 4,
@@ skipping 30 matching lines @@
      // Create a png with just enough data to get everything warmed up...
     char png_header[] = {0x89, 0x50, 0x4E, 0x47, 0x0D, 0x0A, 0x1A, 0x0A};
     NSData* data = [NSData dataWithBytes:png_header
                                   length:arraysize(png_header)];
     base::mac::ScopedCFTypeRef<CGImageSourceRef> img(
         CGImageSourceCreateWithData((CFDataRef)data,
         NULL));
     CGImageSourceGetStatus(img);
   }
 
   { // Native Client access to /dev/random.

[jeremy, 2010/12/03 14:22:09]

Could you special case this for NaCL while you're in here?

[Nico, 2010/12/04 00:26:10]

Done.

     GetUrandomFD();
   }
+
+  if (sandbox_type == SANDBOX_TYPE_GPU) {
+    {  // GPU-related stuff is very slow without this, probably because
+       // the sandbox prevents loading graphics drivers or some such.
+       CGLPixelFormatAttribute attribs[] = { (CGLPixelFormatAttribute)0 };
+       CGLPixelFormatObj format;
+       GLint n;
+       CGLChoosePixelFormat(attribs, &format, &n);
+       if (format)
+         CGLReleasePixelFormat(format);
+    }
+
+
+    { // Without this, the GPU process dies during [CrApplication init].
+      [CrApplication sharedApplication];

[jeremy, 2010/12/03 14:22:09]

Could you make sure you don't have access to the clipboard after the Sandbox is
enabled in the GPU process.

The unit tests should cover this but they can't accurately capture the same
environment as the original process.

[Nico, 2010/12/04 00:26:10]

The unit test used to fail and passes now. I think it's ok to rely on the test.

+    }
+  }
 }
 
 // static
 NSString* Sandbox::BuildAllowDirectoryAccessSandboxString(
     const FilePath& allowed_dir,
     SandboxVariableSubstitions* substitutions) {
   // A whitelist is used to determine which directories can be statted
   // This means that in the case of an /a/b/c/d/ directory, we may be able to
   // stat the leaf directory, but not it's parent.
   // The extension code in Chrome calls realpath() which fails if it can't call
@@ skipping 297 matching lines @@
   if (HANDLE_EINTR(fcntl(fd, F_GETPATH, canonical_path)) != 0) {
     PLOG(FATAL) << "GetCanonicalSandboxPath() failed for: "
                 << path->value();
     return;
   }
 
   *path = FilePath(canonical_path);
 }
 
 }  // namespace sandbox