OLD | NEW |
1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "content/common/sandbox_linux/bpf_gpu_policy_linux.h" | 5 #include "content/common/sandbox_linux/bpf_gpu_policy_linux.h" |
6 | 6 |
7 #include <dlfcn.h> | 7 #include <dlfcn.h> |
8 #include <errno.h> | 8 #include <errno.h> |
9 #include <fcntl.h> | 9 #include <fcntl.h> |
10 #include <sys/socket.h> | 10 #include <sys/socket.h> |
(...skipping 148 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
159 } // namespace | 159 } // namespace |
160 | 160 |
161 GpuProcessPolicy::GpuProcessPolicy() : broker_process_(NULL) {} | 161 GpuProcessPolicy::GpuProcessPolicy() : broker_process_(NULL) {} |
162 | 162 |
163 GpuProcessPolicy::~GpuProcessPolicy() {} | 163 GpuProcessPolicy::~GpuProcessPolicy() {} |
164 | 164 |
165 // Main policy for x86_64/i386. Extended by CrosArmGpuProcessPolicy. | 165 // Main policy for x86_64/i386. Extended by CrosArmGpuProcessPolicy. |
166 ErrorCode GpuProcessPolicy::EvaluateSyscall(SandboxBPF* sandbox, | 166 ErrorCode GpuProcessPolicy::EvaluateSyscall(SandboxBPF* sandbox, |
167 int sysno) const { | 167 int sysno) const { |
168 switch (sysno) { | 168 switch (sysno) { |
169 // TODO(jln): restrict clone. | |
170 case __NR_clone: | |
171 case __NR_ioctl: | 169 case __NR_ioctl: |
172 #if defined(__i386__) || defined(__x86_64__) | 170 #if defined(__i386__) || defined(__x86_64__) |
173 // The Nvidia driver uses flags not in the baseline policy | 171 // The Nvidia driver uses flags not in the baseline policy |
174 // (MAP_LOCKED | MAP_EXECUTABLE | MAP_32BIT) | 172 // (MAP_LOCKED | MAP_EXECUTABLE | MAP_32BIT) |
175 case __NR_mmap: | 173 case __NR_mmap: |
176 #endif | 174 #endif |
177 // We also hit this on the linux_chromeos bot but don't yet know what | 175 // We also hit this on the linux_chromeos bot but don't yet know what |
178 // weird flags were involved. | 176 // weird flags were involved. |
179 case __NR_mprotect: | 177 case __NR_mprotect: |
180 case __NR_sched_getaffinity: | 178 case __NR_sched_getaffinity: |
181 case __NR_sched_setaffinity: | 179 case __NR_sched_setaffinity: |
182 case __NR_setpriority: | 180 case __NR_setpriority: |
183 return ErrorCode(ErrorCode::ERR_ALLOWED); | 181 return ErrorCode(ErrorCode::ERR_ALLOWED); |
184 case __NR_access: | 182 case __NR_access: |
185 case __NR_open: | 183 case __NR_open: |
186 case __NR_openat: | 184 case __NR_openat: |
187 DCHECK(broker_process_); | 185 DCHECK(broker_process_); |
188 return sandbox->Trap(GpuSIGSYS_Handler, broker_process_); | 186 return sandbox->Trap(GpuSIGSYS_Handler, broker_process_); |
189 default: | 187 default: |
190 // Allow *kill from the GPU process temporarily until fork() | |
191 // is denied here. | |
192 if (SyscallSets::IsKill(sysno)) | |
193 return ErrorCode(ErrorCode::ERR_ALLOWED); | |
194 if (SyscallSets::IsEventFd(sysno)) | 188 if (SyscallSets::IsEventFd(sysno)) |
195 return ErrorCode(ErrorCode::ERR_ALLOWED); | 189 return ErrorCode(ErrorCode::ERR_ALLOWED); |
196 | 190 |
197 // Default on the baseline policy. | 191 // Default on the baseline policy. |
198 return SandboxBPFBasePolicy::EvaluateSyscall(sandbox, sysno); | 192 return SandboxBPFBasePolicy::EvaluateSyscall(sandbox, sysno); |
199 } | 193 } |
200 } | 194 } |
201 | 195 |
202 bool GpuProcessPolicy::PreSandboxHook() { | 196 bool GpuProcessPolicy::PreSandboxHook() { |
203 // Warm up resources needed by the policy we're about to enable and | 197 // Warm up resources needed by the policy we're about to enable and |
(...skipping 58 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
262 broker_process_ = new BrokerProcess(GetFSDeniedErrno(), | 256 broker_process_ = new BrokerProcess(GetFSDeniedErrno(), |
263 read_whitelist, | 257 read_whitelist, |
264 write_whitelist); | 258 write_whitelist); |
265 // The initialization callback will perform generic initialization and then | 259 // The initialization callback will perform generic initialization and then |
266 // call broker_sandboxer_callback. | 260 // call broker_sandboxer_callback. |
267 CHECK(broker_process_->Init(base::Bind(&UpdateProcessTypeAndEnableSandbox, | 261 CHECK(broker_process_->Init(base::Bind(&UpdateProcessTypeAndEnableSandbox, |
268 broker_sandboxer_allocator))); | 262 broker_sandboxer_allocator))); |
269 } | 263 } |
270 | 264 |
271 } // namespace content | 265 } // namespace content |
OLD | NEW |