Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(350)

Side by Side Diff: content/common/sandbox_linux/bpf_gpu_policy_linux.h

Issue 163433011: Clarify the process title of GPU broker process. (Closed) Base URL: https://git.chromium.org/chromium/src.git@master
Patch Set: Build fix for unittests Created 6 years, 10 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
OLDNEW
1 // Copyright 2013 The Chromium Authors. All rights reserved. 1 // Copyright 2013 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be 2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file. 3 // found in the LICENSE file.
4 4
5 #ifndef CONTENT_COMMON_SANDBOX_LINUX_BPF_GPU_POLICY_LINUX_H_ 5 #ifndef CONTENT_COMMON_SANDBOX_LINUX_BPF_GPU_POLICY_LINUX_H_
6 #define CONTENT_COMMON_SANDBOX_LINUX_BPF_GPU_POLICY_LINUX_H_ 6 #define CONTENT_COMMON_SANDBOX_LINUX_BPF_GPU_POLICY_LINUX_H_
7 7
8 #include <string> 8 #include <string>
9 #include <vector> 9 #include <vector>
10 10
11 #include "base/callback_forward.h"
11 #include "content/common/sandbox_linux/sandbox_bpf_base_policy_linux.h" 12 #include "content/common/sandbox_linux/sandbox_bpf_base_policy_linux.h"
12 13
13 namespace sandbox { 14 namespace sandbox {
14 class BrokerProcess; 15 class BrokerProcess;
15 } 16 }
16 17
17 namespace content { 18 namespace content {
18 19
19 class GpuProcessPolicy : public SandboxBPFBasePolicy { 20 class GpuProcessPolicy : public SandboxBPFBasePolicy {
20 public: 21 public:
21 GpuProcessPolicy(); 22 GpuProcessPolicy();
22 virtual ~GpuProcessPolicy(); 23 virtual ~GpuProcessPolicy();
23 24
24 virtual ErrorCode EvaluateSyscall(SandboxBPF* sandbox_compiler, 25 virtual ErrorCode EvaluateSyscall(SandboxBPF* sandbox_compiler,
25 int system_call_number) const OVERRIDE; 26 int system_call_number) const OVERRIDE;
26 27
27 virtual bool PreSandboxHook() OVERRIDE; 28 virtual bool PreSandboxHook() OVERRIDE;
28 29
29 protected: 30 protected:
30 // Start a broker process to handle open() inside the sandbox. 31 // Start a broker process to handle open() inside the sandbox.
31 // |broker_sandboxer_callback| is a callback that will enable a suitable 32 // |gpu_broker_child_init_callback| is a callback that will enable a suitable
32 // sandbox for the broker process itself. 33 // sandbox for the broker process itself.
jln (very slow on Chromium) 2014/02/20 23:38:52 Let's call it clearly broker_sandboxer_callback si
dshwang 2014/02/21 07:03:13 yep, done.
33 // |read_whitelist_extra| and |write_whitelist_extra| are lists of file 34 // |read_whitelist_extra| and |write_whitelist_extra| are lists of file
34 // names that should be whitelisted by the broker process, in addition to 35 // names that should be whitelisted by the broker process, in addition to
35 // the basic ones. 36 // the basic ones.
36 void InitGpuBrokerProcess( 37 void InitGpuBrokerProcess(
37 bool (*broker_sandboxer_callback)(void), 38 const base::Callback<bool(void)>& gpu_broker_child_init_callback,
38 const std::vector<std::string>& read_whitelist_extra, 39 const std::vector<std::string>& read_whitelist_extra,
39 const std::vector<std::string>& write_whitelist_extra); 40 const std::vector<std::string>& write_whitelist_extra);
40 41
41 sandbox::BrokerProcess* broker_process() { return broker_process_; } 42 sandbox::BrokerProcess* broker_process() { return broker_process_; }
42 43
43 private: 44 private:
44 // A BrokerProcess is a helper that is started before the sandbox is engaged 45 // A BrokerProcess is a helper that is started before the sandbox is engaged
45 // and will serve requests to access files over an IPC channel. The client of 46 // and will serve requests to access files over an IPC channel. The client of
46 // this runs from a SIGSYS handler triggered by the seccomp-bpf sandbox. 47 // this runs from a SIGSYS handler triggered by the seccomp-bpf sandbox.
47 // This should never be destroyed, as after the sandbox is started it is 48 // This should never be destroyed, as after the sandbox is started it is
48 // vital to the process. 49 // vital to the process.
49 // This is allocated by InitGpuBrokerProcess, called from PreSandboxHook(), 50 // This is allocated by InitGpuBrokerProcess, called from PreSandboxHook(),
50 // which executes iff the sandbox is going to be enabled afterwards. 51 // which executes iff the sandbox is going to be enabled afterwards.
51 sandbox::BrokerProcess* broker_process_; 52 sandbox::BrokerProcess* broker_process_;
52 DISALLOW_COPY_AND_ASSIGN(GpuProcessPolicy); 53 DISALLOW_COPY_AND_ASSIGN(GpuProcessPolicy);
53 }; 54 };
54 55
55 } // namespace content 56 } // namespace content
56 57
57 #endif // CONTENT_COMMON_SANDBOX_LINUX_BPF_GPU_POLICY_LINUX_H_ 58 #endif // CONTENT_COMMON_SANDBOX_LINUX_BPF_GPU_POLICY_LINUX_H_
OLDNEW

Powered by Google App Engine
This is Rietveld 408576698