Index: chrome/browser/gpu.sb |
diff --git a/chrome/browser/gpu.sb b/chrome/browser/gpu.sb |
index ce5b2d2f727472959c692847b43dd0bf945472a0..9cd27b829f2a4c5346160e424c3eb463ebc8df08 100644 |
--- a/chrome/browser/gpu.sb |
+++ b/chrome/browser/gpu.sb |
@@ -6,5 +6,14 @@ |
; *** The contents of chrome/common/common.sb are implicitly included here. *** |
-; TODO(thakis): Deny most things by default. |
-(allow default) |
+; The GPU process opens a shared memory file to communicate with the renderer. |
+; This is backed by a file in /var/folders. |
+(allow file-read* file-write* (regex "^/(private/)?(tmp|var)(/|$)")) |
jeremy
2010/12/03 14:22:09
I'm a bit apprehensive about opening this since th
Nico
2010/12/04 00:26:10
Worth thinking about…I've filed a bug and put in a
Nico
2010/12/04 01:58:36
Turns out that the ringbuffer creation fails if I
|
+ |
+; Without this, the GPU process prints |
+; *** CFMessagePort: bootstrap_register(): failed 268435459 (0x10000003) '(ipc/send) invalid destination port', port = 0x5907, name = 'com.apple.tsm.portname' |
+; That's probably harmless, but allowing the look-up is also probably harmless. |
jeremy
2010/12/03 14:22:09
I don't think you need this comment. Perhaps some
Nico
2010/12/04 00:26:10
Done.
jeremy
2010/12/05 08:04:50
Are you sure you need this? Does this cause thing
|
+(allow mach-lookup (global-name "com.apple.tsm.uiserver")) |
+ |
+; From renderer.sb |
jeremy
2010/12/03 14:22:09
Could you change this comment to the system call t
Nico
2010/12/04 00:26:10
Done, removed the comment.
|
+(allow file-read-metadata (literal "/")) |