Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(248)

Side by Side Diff: content/common/sandbox_linux/bpf_gpu_policy_linux.cc

Issue 2867693004: Snapshot of all changes to get jumbo in blink and content.
Patch Set: Rebased again Created 3 years, 5 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
OLDNEW
1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be 2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file. 3 // found in the LICENSE file.
4 4
5 #include "content/common/sandbox_linux/bpf_gpu_policy_linux.h" 5 #include "content/common/sandbox_linux/bpf_gpu_policy_linux.h"
6 6
7 #include <dlfcn.h> 7 #include <dlfcn.h>
8 #include <errno.h> 8 #include <errno.h>
9 #include <fcntl.h> 9 #include <fcntl.h>
10 #include <sys/socket.h> 10 #include <sys/socket.h>
(...skipping 30 matching lines...) Expand all
41 using sandbox::bpf_dsl::ResultExpr; 41 using sandbox::bpf_dsl::ResultExpr;
42 using sandbox::bpf_dsl::Trap; 42 using sandbox::bpf_dsl::Trap;
43 using sandbox::syscall_broker::BrokerFilePermission; 43 using sandbox::syscall_broker::BrokerFilePermission;
44 using sandbox::syscall_broker::BrokerProcess; 44 using sandbox::syscall_broker::BrokerProcess;
45 using sandbox::SyscallSets; 45 using sandbox::SyscallSets;
46 46
47 namespace content { 47 namespace content {
48 48
49 namespace { 49 namespace {
50 50
51 inline bool IsChromeOS() { 51 inline bool IsChromeOSFoo() {
52 #if defined(OS_CHROMEOS) 52 #if defined(OS_CHROMEOS)
53 return true; 53 return true;
54 #else 54 #else
55 return false; 55 return false;
56 #endif 56 #endif
57 } 57 }
58 58
59 inline bool IsArchitectureX86_64() { 59 inline bool IsArchitectureX86_64() {
60 #if defined(__x86_64__) 60 #if defined(__x86_64__)
61 return true; 61 return true;
62 #else 62 #else
63 return false; 63 return false;
64 #endif 64 #endif
65 } 65 }
66 66
67 inline bool IsArchitectureI386() { 67 inline bool IsArchitectureI386() {
68 #if defined(__i386__) 68 #if defined(__i386__)
69 return true; 69 return true;
70 #else 70 #else
71 return false; 71 return false;
72 #endif 72 #endif
73 } 73 }
74 74
75 inline bool IsArchitectureArm() { 75 inline bool IsArchitectureArmFoo() {
76 #if defined(__arm__) || defined(__aarch64__) 76 #if defined(__arm__) || defined(__aarch64__)
77 return true; 77 return true;
78 #else 78 #else
79 return false; 79 return false;
80 #endif 80 #endif
81 } 81 }
82 82
83 inline bool UseV4L2Codec() { 83 inline bool UseV4L2Codec() {
84 #if defined(USE_V4L2_CODEC) 84 #if defined(USE_V4L2_CODEC)
85 return true; 85 return true;
(...skipping 193 matching lines...) Expand 10 before | Expand all | Expand 10 after
279 return Allow(); 279 return Allow();
280 280
281 // Default on the baseline policy. 281 // Default on the baseline policy.
282 return SandboxBPFBasePolicy::EvaluateSyscall(sysno); 282 return SandboxBPFBasePolicy::EvaluateSyscall(sysno);
283 } 283 }
284 } 284 }
285 285
286 bool GpuProcessPolicy::PreSandboxHook() { 286 bool GpuProcessPolicy::PreSandboxHook() {
287 // Warm up resources needed by the policy we're about to enable and 287 // Warm up resources needed by the policy we're about to enable and
288 // eventually start a broker process. 288 // eventually start a broker process.
289 const bool chromeos_arm_gpu = IsChromeOS() && IsArchitectureArm(); 289 const bool chromeos_arm_gpu = IsChromeOSFoo() && IsArchitectureArmFoo();
290 // This policy is for x86 or Desktop. 290 // This policy is for x86 or Desktop.
291 DCHECK(!chromeos_arm_gpu); 291 DCHECK(!chromeos_arm_gpu);
292 292
293 DCHECK(!broker_process()); 293 DCHECK(!broker_process());
294 // Create a new broker process. 294 // Create a new broker process.
295 InitGpuBrokerProcess( 295 InitGpuBrokerProcess(
296 GpuBrokerProcessPolicy::Create, 296 GpuBrokerProcessPolicy::Create,
297 std::vector<BrokerFilePermission>()); // No extra files in whitelist. 297 std::vector<BrokerFilePermission>()); // No extra files in whitelist.
298 298
299 if (IsArchitectureX86_64() || IsArchitectureI386()) { 299 if (IsArchitectureX86_64() || IsArchitectureI386()) {
(...skipping 37 matching lines...) Expand 10 before | Expand all | Expand 10 after
337 static const char kNvidiaParamsPath[] = "/proc/driver/nvidia/params"; 337 static const char kNvidiaParamsPath[] = "/proc/driver/nvidia/params";
338 338
339 static const char kDevShm[] = "/dev/shm/"; 339 static const char kDevShm[] = "/dev/shm/";
340 340
341 CHECK(broker_process_ == NULL); 341 CHECK(broker_process_ == NULL);
342 342
343 // All GPU process policies need these files brokered out. 343 // All GPU process policies need these files brokered out.
344 std::vector<BrokerFilePermission> permissions; 344 std::vector<BrokerFilePermission> permissions;
345 permissions.push_back(BrokerFilePermission::ReadOnly(kDriRcPath)); 345 permissions.push_back(BrokerFilePermission::ReadOnly(kDriRcPath));
346 346
347 if (!IsChromeOS()) { 347 if (!IsChromeOSFoo()) {
348 // For shared memory. 348 // For shared memory.
349 permissions.push_back( 349 permissions.push_back(
350 BrokerFilePermission::ReadWriteCreateUnlinkRecursive(kDevShm)); 350 BrokerFilePermission::ReadWriteCreateUnlinkRecursive(kDevShm));
351 // For DRI cards. 351 // For DRI cards.
352 for (int i = 0; i <= 9; ++i) { 352 for (int i = 0; i <= 9; ++i) {
353 permissions.push_back(BrokerFilePermission::ReadWrite( 353 permissions.push_back(BrokerFilePermission::ReadWrite(
354 base::StringPrintf("%s%d", kDriCardBasePath, i))); 354 base::StringPrintf("%s%d", kDriCardBasePath, i)));
355 } 355 }
356 // For Nvidia GLX driver. 356 // For Nvidia GLX driver.
357 permissions.push_back(BrokerFilePermission::ReadWrite(kNvidiaCtlPath)); 357 permissions.push_back(BrokerFilePermission::ReadWrite(kNvidiaCtlPath));
(...skipping 18 matching lines...) Expand all
376 } 376 }
377 377
378 broker_process_ = new BrokerProcess(GetFSDeniedErrno(), permissions); 378 broker_process_ = new BrokerProcess(GetFSDeniedErrno(), permissions);
379 // The initialization callback will perform generic initialization and then 379 // The initialization callback will perform generic initialization and then
380 // call broker_sandboxer_callback. 380 // call broker_sandboxer_callback.
381 CHECK(broker_process_->Init(base::Bind(&UpdateProcessTypeAndEnableSandbox, 381 CHECK(broker_process_->Init(base::Bind(&UpdateProcessTypeAndEnableSandbox,
382 broker_sandboxer_allocator))); 382 broker_sandboxer_allocator)));
383 } 383 }
384 384
385 } // namespace content 385 } // namespace content
OLDNEW
« no previous file with comments | « content/common/resource_messages.h ('k') | content/common/service_worker/embedded_worker_messages.h » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698