OLD | NEW |
---|---|
1 // Copyright 2013 The Chromium Authors. All rights reserved. | 1 // Copyright 2013 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #ifndef CONTENT_COMMON_SANDBOX_LINUX_BPF_GPU_POLICY_LINUX_H_ | 5 #ifndef CONTENT_COMMON_SANDBOX_LINUX_BPF_GPU_POLICY_LINUX_H_ |
6 #define CONTENT_COMMON_SANDBOX_LINUX_BPF_GPU_POLICY_LINUX_H_ | 6 #define CONTENT_COMMON_SANDBOX_LINUX_BPF_GPU_POLICY_LINUX_H_ |
7 | 7 |
8 #include <string> | 8 #include <string> |
9 #include <vector> | 9 #include <vector> |
10 | 10 |
(...skipping 11 matching lines...) Expand all Loading... | |
22 GpuProcessPolicy(); | 22 GpuProcessPolicy(); |
23 virtual ~GpuProcessPolicy(); | 23 virtual ~GpuProcessPolicy(); |
24 | 24 |
25 virtual ErrorCode EvaluateSyscall(SandboxBPF* sandbox_compiler, | 25 virtual ErrorCode EvaluateSyscall(SandboxBPF* sandbox_compiler, |
26 int system_call_number) const OVERRIDE; | 26 int system_call_number) const OVERRIDE; |
27 | 27 |
28 virtual bool PreSandboxHook() OVERRIDE; | 28 virtual bool PreSandboxHook() OVERRIDE; |
29 | 29 |
30 protected: | 30 protected: |
31 // Start a broker process to handle open() inside the sandbox. | 31 // Start a broker process to handle open() inside the sandbox. |
32 // |broker_sandboxer_callback| is a callback that will enable a suitable | 32 // |broker_sandboxer_allocator| is a function pointer which can allocate a |
33 // sandbox for the broker process itself. | 33 // suitable sandbox policy for the broker process itself. |
34 // |read_whitelist_extra| and |write_whitelist_extra| are lists of file | 34 // |read_whitelist_extra| and |write_whitelist_extra| are lists of file |
35 // names that should be whitelisted by the broker process, in addition to | 35 // names that should be whitelisted by the broker process, in addition to |
36 // the basic ones. | 36 // the basic ones. |
37 void InitGpuBrokerProcess( | 37 void InitGpuBrokerProcess( |
38 const base::Callback<bool(void)>& broker_sandboxer_callback, | 38 sandbox::SandboxBPFPolicy* (*broker_sandboxer_allocator)(void), |
Jorge Lucangeli Obes
2014/04/28 23:43:53
It was nice to have base::Callback's instead of fu
jln (very slow on Chromium)
2014/04/28 23:53:18
We could still make it a CallBack if we really wan
| |
39 const std::vector<std::string>& read_whitelist_extra, | 39 const std::vector<std::string>& read_whitelist_extra, |
40 const std::vector<std::string>& write_whitelist_extra); | 40 const std::vector<std::string>& write_whitelist_extra); |
41 | 41 |
42 sandbox::BrokerProcess* broker_process() { return broker_process_; } | 42 sandbox::BrokerProcess* broker_process() { return broker_process_; } |
43 | 43 |
44 private: | 44 private: |
45 // A BrokerProcess is a helper that is started before the sandbox is engaged | 45 // A BrokerProcess is a helper that is started before the sandbox is engaged |
46 // and will serve requests to access files over an IPC channel. The client of | 46 // and will serve requests to access files over an IPC channel. The client of |
47 // this runs from a SIGSYS handler triggered by the seccomp-bpf sandbox. | 47 // this runs from a SIGSYS handler triggered by the seccomp-bpf sandbox. |
48 // This should never be destroyed, as after the sandbox is started it is | 48 // This should never be destroyed, as after the sandbox is started it is |
49 // vital to the process. | 49 // vital to the process. |
50 // This is allocated by InitGpuBrokerProcess, called from PreSandboxHook(), | 50 // This is allocated by InitGpuBrokerProcess, called from PreSandboxHook(), |
51 // which executes iff the sandbox is going to be enabled afterwards. | 51 // which executes iff the sandbox is going to be enabled afterwards. |
52 sandbox::BrokerProcess* broker_process_; | 52 sandbox::BrokerProcess* broker_process_; |
53 DISALLOW_COPY_AND_ASSIGN(GpuProcessPolicy); | 53 DISALLOW_COPY_AND_ASSIGN(GpuProcessPolicy); |
54 }; | 54 }; |
55 | 55 |
56 } // namespace content | 56 } // namespace content |
57 | 57 |
58 #endif // CONTENT_COMMON_SANDBOX_LINUX_BPF_GPU_POLICY_LINUX_H_ | 58 #endif // CONTENT_COMMON_SANDBOX_LINUX_BPF_GPU_POLICY_LINUX_H_ |
OLD | NEW |