Linux GPU sandbox: only allocate broker policy in the broker.

content/common/sandbox_linux/bpf_cros_arm_gpu_policy_linux.cc

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/common/sandbox_linux/bpf_cros_arm_gpu_policy_linux.h"
 
 #include <dlfcn.h>
 #include <errno.h>
 #include <fcntl.h>
 #include <sys/socket.h>
@@ skipping 76 matching lines @@
   read_whitelist->push_back(kXAuthorityPath);
   read_whitelist->push_back(kLdSoCache);
   read_whitelist->push_back(kLibGlesPath);
   read_whitelist->push_back(kLibEglPath);
 
   AddArmMaliGpuWhitelist(read_whitelist, write_whitelist);
 }
 
 class CrosArmGpuBrokerProcessPolicy : public CrosArmGpuProcessPolicy {
  public:
-  CrosArmGpuBrokerProcessPolicy() : CrosArmGpuProcessPolicy(false) {}
+  static sandbox::SandboxBPFPolicy* Create() {
+    return new CrosArmGpuBrokerProcessPolicy();
+  }
   virtual ~CrosArmGpuBrokerProcessPolicy() {}
 
   virtual ErrorCode EvaluateSyscall(SandboxBPF* sandbox_compiler,
                                     int system_call_number) const OVERRIDE;
 
  private:
+  CrosArmGpuBrokerProcessPolicy() : CrosArmGpuProcessPolicy(false) {}
   DISALLOW_COPY_AND_ASSIGN(CrosArmGpuBrokerProcessPolicy);
 };
 
 // A GPU broker policy is the same as a GPU policy with open and
 // openat allowed.
 ErrorCode CrosArmGpuBrokerProcessPolicy::EvaluateSyscall(SandboxBPF* sandbox,
     int sysno) const {
   switch (sysno) {
     case __NR_access:
     case __NR_open:
@@ skipping 48 matching lines @@
 bool CrosArmGpuProcessPolicy::PreSandboxHook() {
   DCHECK(IsChromeOS() && IsArchitectureArm());
   // Create a new broker process.
   DCHECK(!broker_process());
 
   std::vector<std::string> read_whitelist_extra;
   std::vector<std::string> write_whitelist_extra;
   // Add ARM-specific files to whitelist in the broker.
 
   AddArmGpuWhitelist(&read_whitelist_extra, &write_whitelist_extra);
-  InitGpuBrokerProcess(
-      base::Bind(&SandboxSeccompBPF::StartSandboxWithExternalPolicy,
-                 base::Passed(scoped_ptr<sandbox::SandboxBPFPolicy>(
-                     new CrosArmGpuBrokerProcessPolicy))),
-      read_whitelist_extra,
-      write_whitelist_extra);
+  InitGpuBrokerProcess(CrosArmGpuBrokerProcessPolicy::Create,
+                       read_whitelist_extra,
+                       write_whitelist_extra);
 
   const int dlopen_flag = RTLD_NOW | RTLD_GLOBAL | RTLD_NODELETE;
 
   // Preload the Mali library.
   dlopen("/usr/lib/libmali.so", dlopen_flag);
   // Preload the Tegra V4L2 (video decode acceleration) library.
   dlopen("/usr/lib/libtegrav4l2.so", dlopen_flag);
   // Resetting errno since platform-specific libraries will fail on other
   // platforms.
   errno = 0;
 
   return true;
 }
 
 }  // namespace content