ozone: ClientPixmapManager passes VGEM fd from browser to renderer.

content/browser/gpu/browser_client_native_pixmap_manager_ozone.cc

+// Copyright 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/browser/gpu/browser_client_native_pixmap_manager_ozone.h"
+
+#include "base/memory/singleton.h"
+#include "base/posix/eintr_wrapper.h"
+#include "content/common/gpu/client_native_pixmap_manager_ozone_messages.h"
+#include "content/public/browser/browser_thread.h"
+#include "ui/ozone/public/ozone_platform.h"
+
+namespace content {
+
+namespace {
+
+base::FileDescriptor DupVirtualDeviceFd(int virtual_device) {
+  int duped_fd = -1;
+  base::ThreadRestrictions::AssertIOAllowed();
+  duped_fd = HANDLE_EINTR(dup(virtual_device));
+  if (duped_fd < 0) {
+    PLOG(ERROR) << "dup() failed.";
+    return base::FileDescriptor();
+  }
+  return base::FileDescriptor(duped_fd, true);
+}
+
+void OnSendVirtualDevice(IPC::Sender* sender,
+                         const base::FileDescriptor& virtual_device) {
+  sender->Send(
+      new ChildClientNativePixmapManagerMsg_SetVirtualDevice(virtual_device));
+}
+
+}  // namespace
+
+struct BrowserClientNativePixmapManagerTrait
+    : public DefaultSingletonTraits<BrowserClientNativePixmapManager> {
+  static BrowserClientNativePixmapManager* New() {
+    BrowserClientNativePixmapManager* manager =
+        new BrowserClientNativePixmapManager();
+    manager->Initialize(ui::OzonePlatform::GetInstance()->GetVirtualDeviceFd());
+    return manager;
+  }
+};
+
+// static
+BrowserClientNativePixmapManager*
+BrowserClientNativePixmapManager::GetInstance() {
+  return Singleton<BrowserClientNativePixmapManager,
+                   BrowserClientNativePixmapManagerTrait>::get();
+}
+
+BrowserClientNativePixmapManager::BrowserClientNativePixmapManager() {}
+
+BrowserClientNativePixmapManager::~BrowserClientNativePixmapManager() {}
+
+void BrowserClientNativePixmapManager::Initialize(
+    const base::FileDescriptor& virtual_device) {
+  pixmap_manager_ = ui::ClientNativePixmapManager::Create(virtual_device);
+  virtual_device_ = virtual_device;
+}
+
+void BrowserClientNativePixmapManager::SendVirtualDevice(IPC::Sender* sender) {
+  base::SequencedWorkerPool* pool = content::BrowserThread::GetBlockingPool();
+  base::PostTaskAndReplyWithResult(
+      pool, FROM_HERE, base::Bind(&DupVirtualDeviceFd, virtual_device_.fd),

[spang, 2015/08/04 17:47:31]

I'm pretty sure that passing access to vgem by dup()ing a shared file descriptor
ends up giving all renderers a common handle namespace, which is completely
unacceptable from a security perspective.

We need to open a new vgem fd for each renderer.

[dshwang, 2015/08/05 09:44:26]

I don't fully catch up which point is vulnerable from security point of view.
This pattern follows MacOSX code, which also gives all renderers
|io_surface_manager_token_| in
https://code.google.com/p/chromium/codesearch#chromium/src/content/browser/re...

If it's problematic, how about round-trip communication in Patch Set 2;
https://codereview.chromium.org/1248713002/diff/20001/content/child/child_nat...
When renderer initializes ChildNativePixmapManagerOzone, it sends sync message
to browser to get vgem fd, although reveman didn't like this sync round-trip.
Ok, The next step is https://codereview.chromium.org/1134993003/ with the code.
After the CL landed, I'll come back to this CL.

+      base::Bind(&OnSendVirtualDevice, sender));
+}
+
+std::vector<ui::ClientNativePixmapManager::Configuration>
+BrowserClientNativePixmapManager::GetSupportedConfigurations() const {
+  return pixmap_manager_->GetSupportedConfigurations();
+}
+
+scoped_ptr<ui::ClientNativePixmap>
+BrowserClientNativePixmapManager::ImportClientNativePixmap(
+    base::FileDescriptor handle,
+    gfx::Size size,
+    ui::NativePixmapFormat format,
+    ui::NativePixmapUsage usage) {
+  return pixmap_manager_->ImportClientNativePixmap(handle, size, format, usage);
+}
+
+}  // namespace content