Index: content/common/sandbox_linux/android/sandbox_bpf_base_policy_android.cc |
diff --git a/content/common/sandbox_linux/android/sandbox_bpf_base_policy_android.cc b/content/common/sandbox_linux/android/sandbox_bpf_base_policy_android.cc |
index 4cd502d8487729950a891e6fc610a0bb946c35c5..a2384c9c440c54dbdaa6b12a78fd88decea23034 100644 |
--- a/content/common/sandbox_linux/android/sandbox_bpf_base_policy_android.cc |
+++ b/content/common/sandbox_linux/android/sandbox_bpf_base_policy_android.cc |
@@ -50,7 +50,8 @@ BoolExpr RestrictSocketArguments(const Arg<int>& domain, |
} // namespace |
SandboxBPFBasePolicyAndroid::SandboxBPFBasePolicyAndroid() |
- : SandboxBPFBasePolicy() {} |
+ : SandboxBPFBasePolicy(), |
+ pid_(getpid()) {} |
SandboxBPFBasePolicyAndroid::~SandboxBPFBasePolicyAndroid() {} |
@@ -122,6 +123,13 @@ ResultExpr SandboxBPFBasePolicyAndroid::EvaluateSyscall(int sysno) const { |
break; |
} |
+ // https://crbug.com/644759 |
+ if (sysno == __NR_rt_tgsigqueueinfo) { |
+ const Arg<pid_t> tgid(0); |
+ return If(tgid == pid_, Allow()) |
+ .Else(Error(EPERM)); |
+ } |
+ |
#if defined(__x86_64__) || defined(__arm__) || defined(__aarch64__) || \ |
defined(__mips__) |
if (sysno == __NR_socket) { |