NotForReview: Implement zero/one-copy texture for ozone freon using Intel DRM

sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.cc

Index: sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.cc
diff --git a/sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.cc b/sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.cc
index b315f12a8897af7a5921fff7b9984f8da289eaab..1e013229ef4b440c45956f3597c2b4f38757fbc0 100644
--- a/sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.cc
+++ b/sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.cc
@@ -32,6 +32,10 @@
 #include "sandbox/linux/seccomp-bpf/sandbox_bpf.h"
 #include "sandbox/linux/system_headers/linux_syscalls.h"
 
+#if defined(USE_OZONE_GBM_INTEL)
+#include <libdrm/i915_drm.h>
+#endif
+
 #if defined(OS_ANDROID)
 
 #include "sandbox/linux/system_headers/android_futex.h"
@@ -146,9 +150,24 @@ ResultExpr RestrictPrctl() {
 }
 
 ResultExpr RestrictIoctl() {
-  const Arg<int> request(1);
-  return Switch(request).CASES((TCGETS, FIONREAD), Allow()).Default(
-      CrashSIGSYSIoctl());
+// The type of DRM_IOCTL_XXX macro is long unsigned int.
+#if defined(USE_OZONE_GBM_INTEL)
+  auto reference_type = DRM_IOCTL_I915_GEM_MMAP;
+#else
+  auto reference_type = TCGETS;
+#endif
+  const Arg<decltype(reference_type)> request(1);
+  return Switch(request)
+      .CASES(((decltype(reference_type))TCGETS, FIONREAD), Allow())
+#if defined(USE_OZONE_GBM_INTEL)
+      .CASES((DRM_IOCTL_GEM_CLOSE, DRM_IOCTL_I915_GEM_GET_APERTURE,
+              DRM_IOCTL_I915_GEM_GET_TILING, DRM_IOCTL_I915_GEM_MMAP,
+              DRM_IOCTL_I915_GEM_SET_DOMAIN, DRM_IOCTL_I915_GEM_SW_FINISH,
+              DRM_IOCTL_I915_GEM_USERPTR, DRM_IOCTL_I915_GETPARAM,
+              DRM_IOCTL_PRIME_FD_TO_HANDLE),
+             Allow())

[dshwang, 2015/04/09 19:12:26]

Render process requires additional ioctl calls. It's same way in which Android
and OSX add more system call in white list.
I hope security owner review it.

[reveman, 2015/04/13 00:46:13]

This has unacceptable security implications, which is why we want to use vgem
instead.

[dshwang, 2015/04/14 13:15:55]

Even if we use vgem, we need some ioctl call in render process to map/unmap
for example, DRM_IOCTL_PRIME_FD_TO_HANDLE, DRM_IOCTL_MODE_MAP_DUMB

+#endif
+      .Default(CrashSIGSYSIoctl());
 }
 
 ResultExpr RestrictMmapFlags() {