Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(24)

Side by Side Diff: content/common/sandbox_linux/bpf_renderer_policy_linux.cc

Issue 234533002: Remove a bunch of TOOLKIT_GTK in content/ and gpu/, as well as NPAPI plugins on linux (Closed) Base URL: svn://svn.chromium.org/chrome/trunk/src
Patch Set: rebase, skip changing browser_main_loop.cc because of presubmit issues, will follow up Created 6 years, 8 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch | Annotate | Revision Log
OLDNEW
1 // Copyright 2013 The Chromium Authors. All rights reserved. 1 // Copyright 2013 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be 2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file. 3 // found in the LICENSE file.
4 4
5 #include "content/common/sandbox_linux/bpf_renderer_policy_linux.h" 5 #include "content/common/sandbox_linux/bpf_renderer_policy_linux.h"
6 6
7 #include <errno.h> 7 #include <errno.h>
8 8
9 #include "base/basictypes.h" 9 #include "base/basictypes.h"
10 #include "build/build_config.h" 10 #include "build/build_config.h"
11 #include "content/common/sandbox_linux/sandbox_linux.h" 11 #include "content/common/sandbox_linux/sandbox_linux.h"
12 #include "sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.h" 12 #include "sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.h"
13 #include "sandbox/linux/seccomp-bpf-helpers/syscall_sets.h" 13 #include "sandbox/linux/seccomp-bpf-helpers/syscall_sets.h"
14 #include "sandbox/linux/seccomp-bpf/sandbox_bpf_policy.h" 14 #include "sandbox/linux/seccomp-bpf/sandbox_bpf_policy.h"
15 #include "sandbox/linux/services/linux_syscalls.h" 15 #include "sandbox/linux/services/linux_syscalls.h"
16 16
17 using sandbox::SyscallSets; 17 using sandbox::SyscallSets;
18 18
19 namespace content { 19 namespace content {
20 20
21 namespace {
22
23 inline bool IsUsingToolKitGtk() {
24 #if defined(TOOLKIT_GTK)
25 return true;
26 #else
27 return false;
28 #endif
29 }
30
31 } // namespace
32
33 RendererProcessPolicy::RendererProcessPolicy() {} 21 RendererProcessPolicy::RendererProcessPolicy() {}
34 RendererProcessPolicy::~RendererProcessPolicy() {} 22 RendererProcessPolicy::~RendererProcessPolicy() {}
35 23
36 ErrorCode RendererProcessPolicy::EvaluateSyscall(SandboxBPF* sandbox, 24 ErrorCode RendererProcessPolicy::EvaluateSyscall(SandboxBPF* sandbox,
37 int sysno) const { 25 int sysno) const {
38 switch (sysno) { 26 switch (sysno) {
39 case __NR_clone: 27 case __NR_clone:
40 return sandbox::RestrictCloneToThreadsAndEPERMFork(sandbox); 28 return sandbox::RestrictCloneToThreadsAndEPERMFork(sandbox);
41 case __NR_ioctl: 29 case __NR_ioctl:
42 return sandbox::RestrictIoctl(sandbox); 30 return sandbox::RestrictIoctl(sandbox);
(...skipping 22 matching lines...) Expand all
65 case __NR_sched_getscheduler: 53 case __NR_sched_getscheduler:
66 case __NR_sched_setscheduler: 54 case __NR_sched_setscheduler:
67 case __NR_setpriority: 55 case __NR_setpriority:
68 case __NR_sysinfo: 56 case __NR_sysinfo:
69 case __NR_times: 57 case __NR_times:
70 case __NR_uname: 58 case __NR_uname:
71 return ErrorCode(ErrorCode::ERR_ALLOWED); 59 return ErrorCode(ErrorCode::ERR_ALLOWED);
72 case __NR_prlimit64: 60 case __NR_prlimit64:
73 return ErrorCode(EPERM); // See crbug.com/160157. 61 return ErrorCode(EPERM); // See crbug.com/160157.
74 default: 62 default:
75 if (IsUsingToolKitGtk()) {
76 #if defined(__x86_64__) || defined(__arm__)
77 if (SyscallSets::IsSystemVSharedMemory(sysno))
78 return ErrorCode(ErrorCode::ERR_ALLOWED);
79 #endif
80 #if defined(__i386__)
81 if (SyscallSets::IsSystemVIpc(sysno))
82 return ErrorCode(ErrorCode::ERR_ALLOWED);
83 #endif
84 }
85
86 // Default on the content baseline policy. 63 // Default on the content baseline policy.
87 return SandboxBPFBasePolicy::EvaluateSyscall(sandbox, sysno); 64 return SandboxBPFBasePolicy::EvaluateSyscall(sandbox, sysno);
88 } 65 }
89 } 66 }
90 67
91 } // namespace content 68 } // namespace content
OLDNEW
« no previous file with comments | « content/common/sandbox_linux/bpf_ppapi_policy_linux.cc ('k') | content/common/swapped_out_messages.cc » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698