| Index: content/common/sandbox_linux/bpf_gpu_policy_linux.cc
|
| diff --git a/content/common/sandbox_linux/bpf_gpu_policy_linux.cc b/content/common/sandbox_linux/bpf_gpu_policy_linux.cc
|
| index 2bdec2b0c672f1b31af9f506c50c0cf41e357dec..2460f02b65febb15e848fcba0a8315eaa2208906 100644
|
| --- a/content/common/sandbox_linux/bpf_gpu_policy_linux.cc
|
| +++ b/content/common/sandbox_linux/bpf_gpu_policy_linux.cc
|
| @@ -15,6 +15,7 @@
|
| #include <string>
|
| #include <vector>
|
|
|
| +#include "base/bind.h"
|
| #include "base/command_line.h"
|
| #include "base/compiler_specific.h"
|
| #include "base/logging.h"
|
| @@ -22,6 +23,7 @@
|
| #include "build/build_config.h"
|
| #include "content/common/sandbox_linux/sandbox_bpf_base_policy_linux.h"
|
| #include "content/common/sandbox_linux/sandbox_seccomp_bpf_linux.h"
|
| +#include "content/common/set_process_title.h"
|
| #include "content/public/common/content_switches.h"
|
| #include "sandbox/linux/seccomp-bpf-helpers/syscall_sets.h"
|
| #include "sandbox/linux/seccomp-bpf/sandbox_bpf.h"
|
| @@ -136,9 +138,24 @@ ErrorCode GpuBrokerProcessPolicy::EvaluateSyscall(SandboxBPF* sandbox,
|
| }
|
| }
|
|
|
| -bool EnableGpuBrokerPolicyCallback() {
|
| - return SandboxSeccompBPF::StartSandboxWithExternalPolicy(
|
| - scoped_ptr<sandbox::SandboxBPFPolicy>(new GpuBrokerProcessPolicy));
|
| +void UpdateProcessTypeToGpuBroker() {
|
| + CommandLine::StringVector exec = CommandLine::ForCurrentProcess()->GetArgs();
|
| + CommandLine::Reset();
|
| + CommandLine::Init(0, NULL);
|
| + CommandLine::ForCurrentProcess()->InitFromArgv(exec);
|
| + CommandLine::ForCurrentProcess()->AppendSwitchASCII(switches::kProcessType,
|
| + "gpu-broker");
|
| +
|
| + // Update the process title. The argv was already cached by the call to
|
| + // SetProcessTitleFromCommandLine in content_main_runner.cc, so we can pass
|
| + // NULL here (we don't have the original argv at this point).
|
| + SetProcessTitleFromCommandLine(NULL);
|
| +}
|
| +
|
| +bool UpdateProcessTypeAndEnableSandbox(
|
| + const base::Callback<bool(void)>& broker_sandboxer_callback) {
|
| + UpdateProcessTypeToGpuBroker();
|
| + return broker_sandboxer_callback.Run();
|
| }
|
|
|
| } // namespace
|
| @@ -188,7 +205,9 @@ bool GpuProcessPolicy::PreSandboxHook() {
|
| DCHECK(!broker_process());
|
| // Create a new broker process.
|
| InitGpuBrokerProcess(
|
| - EnableGpuBrokerPolicyCallback,
|
| + base::Bind(&SandboxSeccompBPF::StartSandboxWithExternalPolicy,
|
| + base::Passed(scoped_ptr<sandbox::SandboxBPFPolicy>(
|
| + new GpuBrokerProcessPolicy))),
|
| std::vector<std::string>(), // No extra files in whitelist.
|
| std::vector<std::string>());
|
|
|
| @@ -214,7 +233,7 @@ bool GpuProcessPolicy::PreSandboxHook() {
|
| }
|
|
|
| void GpuProcessPolicy::InitGpuBrokerProcess(
|
| - bool (*broker_sandboxer_callback)(void),
|
| + const base::Callback<bool(void)>& broker_sandboxer_callback,
|
| const std::vector<std::string>& read_whitelist_extra,
|
| const std::vector<std::string>& write_whitelist_extra) {
|
| static const char kDriRcPath[] = "/etc/drirc";
|
| @@ -241,8 +260,10 @@ void GpuProcessPolicy::InitGpuBrokerProcess(
|
| broker_process_ = new BrokerProcess(GetFSDeniedErrno(),
|
| read_whitelist,
|
| write_whitelist);
|
| - // Initialize the broker process and give it a sandbox callback.
|
| - CHECK(broker_process_->Init(broker_sandboxer_callback));
|
| + // The initialization callback will perform generic initialization and then
|
| + // call broker_sandboxer_callback.
|
| + CHECK(broker_process_->Init(base::Bind(&UpdateProcessTypeAndEnableSandbox,
|
| + broker_sandboxer_callback)));
|
| }
|
|
|
| } // namespace content
|
|
|