Index: content/common/sandbox_linux/bpf_renderer_policy_linux.cc |
diff --git a/content/common/sandbox_linux/bpf_renderer_policy_linux.cc b/content/common/sandbox_linux/bpf_renderer_policy_linux.cc |
index bd252ff755718d5cb28e29252416b5b2c927f835..d46bab1630d1f93a02cab5a989e6ac6e4e46e7b9 100644 |
--- a/content/common/sandbox_linux/bpf_renderer_policy_linux.cc |
+++ b/content/common/sandbox_linux/bpf_renderer_policy_linux.cc |
@@ -5,22 +5,50 @@ |
#include "content/common/sandbox_linux/bpf_renderer_policy_linux.h" |
#include <errno.h> |
+#include <sys/ioctl.h> |
#include "base/basictypes.h" |
#include "build/build_config.h" |
#include "content/common/sandbox_linux/sandbox_linux.h" |
#include "sandbox/linux/bpf_dsl/bpf_dsl.h" |
+#include "sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.h" |
#include "sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.h" |
#include "sandbox/linux/seccomp-bpf-helpers/syscall_sets.h" |
#include "sandbox/linux/system_headers/linux_syscalls.h" |
+#if defined(USE_VGEM_MAP) |
+#include <libdrm/vgem_drm.h> |
+#endif |
+ |
using sandbox::SyscallSets; |
using sandbox::bpf_dsl::Allow; |
+using sandbox::bpf_dsl::Arg; |
using sandbox::bpf_dsl::Error; |
using sandbox::bpf_dsl::ResultExpr; |
namespace content { |
+namespace { |
brettw
2015/08/26 22:27:49
Blank line after here.
dshwang
2015/08/27 12:47:09
Done.
|
+ResultExpr RestrictIoctl() { |
+#if defined(USE_VGEM_MAP) |
+ // The type of DRM_IOCTL_XXX macro is long unsigned int. |
+ auto reference_type = DRM_IOCTL_GEM_CLOSE; |
+#else |
+ auto reference_type = TCGETS; |
+#endif |
+ const Arg<decltype(reference_type)> request(1); |
+ return Switch(request) |
+ .SANDBOX_BPF_DSL_CASES( |
+ (static_cast<decltype(reference_type)>(TCGETS), FIONREAD), Allow()) |
+#if defined(USE_VGEM_MAP) |
+ .SANDBOX_BPF_DSL_CASES((DRM_IOCTL_GEM_CLOSE, DRM_IOCTL_VGEM_MODE_MAP_DUMB, |
+ DRM_IOCTL_PRIME_FD_TO_HANDLE), |
+ Allow()) |
+#endif |
+ .Default(sandbox::CrashSIGSYSIoctl()); |
+} |
+} |
brettw
2015/08/26 22:27:49
Blank line before here, and this line should look
dshwang
2015/08/27 12:47:09
Done.
|
+ |
RendererProcessPolicy::RendererProcessPolicy() {} |
RendererProcessPolicy::~RendererProcessPolicy() {} |
@@ -31,7 +59,7 @@ ResultExpr RendererProcessPolicy::EvaluateSyscall(int sysno) const { |
case __NR_clock_getres: |
return sandbox::RestrictClockID(); |
case __NR_ioctl: |
- return sandbox::RestrictIoctl(); |
+ return RestrictIoctl(); |
// Allow the system calls below. |
case __NR_fdatasync: |
case __NR_fsync: |