OLD | NEW |
1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "content/common/sandbox_linux/bpf_gpu_policy_linux.h" | 5 #include "content/common/sandbox_linux/bpf_gpu_policy_linux.h" |
6 | 6 |
7 #include <dlfcn.h> | 7 #include <dlfcn.h> |
8 #include <errno.h> | 8 #include <errno.h> |
9 #include <fcntl.h> | 9 #include <fcntl.h> |
10 #include <sys/socket.h> | 10 #include <sys/socket.h> |
(...skipping 153 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
164 | 164 |
165 GpuProcessPolicy::GpuProcessPolicy() : broker_process_(NULL) {} | 165 GpuProcessPolicy::GpuProcessPolicy() : broker_process_(NULL) {} |
166 | 166 |
167 GpuProcessPolicy::~GpuProcessPolicy() {} | 167 GpuProcessPolicy::~GpuProcessPolicy() {} |
168 | 168 |
169 // Main policy for x86_64/i386. Extended by CrosArmGpuProcessPolicy. | 169 // Main policy for x86_64/i386. Extended by CrosArmGpuProcessPolicy. |
170 ErrorCode GpuProcessPolicy::EvaluateSyscall(SandboxBPF* sandbox, | 170 ErrorCode GpuProcessPolicy::EvaluateSyscall(SandboxBPF* sandbox, |
171 int sysno) const { | 171 int sysno) const { |
172 switch (sysno) { | 172 switch (sysno) { |
173 case __NR_ioctl: | 173 case __NR_ioctl: |
174 #if defined(__i386__) || defined(__x86_64__) | 174 #if defined(__i386__) || defined(__x86_64__) || defined(__mips__) |
175 // The Nvidia driver uses flags not in the baseline policy | 175 // The Nvidia driver uses flags not in the baseline policy |
176 // (MAP_LOCKED | MAP_EXECUTABLE | MAP_32BIT) | 176 // (MAP_LOCKED | MAP_EXECUTABLE | MAP_32BIT) |
177 case __NR_mmap: | 177 case __NR_mmap: |
178 #endif | 178 #endif |
179 // We also hit this on the linux_chromeos bot but don't yet know what | 179 // We also hit this on the linux_chromeos bot but don't yet know what |
180 // weird flags were involved. | 180 // weird flags were involved. |
181 case __NR_mprotect: | 181 case __NR_mprotect: |
182 // TODO(jln): restrict prctl. | 182 // TODO(jln): restrict prctl. |
183 case __NR_prctl: | 183 case __NR_prctl: |
184 case __NR_sched_getaffinity: | 184 case __NR_sched_getaffinity: |
(...skipping 77 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
262 broker_process_ = new BrokerProcess(GetFSDeniedErrno(), | 262 broker_process_ = new BrokerProcess(GetFSDeniedErrno(), |
263 read_whitelist, | 263 read_whitelist, |
264 write_whitelist); | 264 write_whitelist); |
265 // The initialization callback will perform generic initialization and then | 265 // The initialization callback will perform generic initialization and then |
266 // call broker_sandboxer_callback. | 266 // call broker_sandboxer_callback. |
267 CHECK(broker_process_->Init(base::Bind(&UpdateProcessTypeAndEnableSandbox, | 267 CHECK(broker_process_->Init(base::Bind(&UpdateProcessTypeAndEnableSandbox, |
268 broker_sandboxer_allocator))); | 268 broker_sandboxer_allocator))); |
269 } | 269 } |
270 | 270 |
271 } // namespace content | 271 } // namespace content |
OLD | NEW |