| OLD | NEW |
| 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "content/common/sandbox_linux/bpf_gpu_policy_linux.h" | 5 #include "content/common/sandbox_linux/bpf_gpu_policy_linux.h" |
| 6 | 6 |
| 7 #include <dlfcn.h> | 7 #include <dlfcn.h> |
| 8 #include <errno.h> | 8 #include <errno.h> |
| 9 #include <fcntl.h> | 9 #include <fcntl.h> |
| 10 #include <sys/socket.h> | 10 #include <sys/socket.h> |
| (...skipping 30 matching lines...) Expand all Loading... |
| 41 using sandbox::bpf_dsl::ResultExpr; | 41 using sandbox::bpf_dsl::ResultExpr; |
| 42 using sandbox::bpf_dsl::Trap; | 42 using sandbox::bpf_dsl::Trap; |
| 43 using sandbox::syscall_broker::BrokerFilePermission; | 43 using sandbox::syscall_broker::BrokerFilePermission; |
| 44 using sandbox::syscall_broker::BrokerProcess; | 44 using sandbox::syscall_broker::BrokerProcess; |
| 45 using sandbox::SyscallSets; | 45 using sandbox::SyscallSets; |
| 46 | 46 |
| 47 namespace content { | 47 namespace content { |
| 48 | 48 |
| 49 namespace { | 49 namespace { |
| 50 | 50 |
| 51 inline bool IsChromeOS() { | 51 inline bool IsChromeOSFoo() { |
| 52 #if defined(OS_CHROMEOS) | 52 #if defined(OS_CHROMEOS) |
| 53 return true; | 53 return true; |
| 54 #else | 54 #else |
| 55 return false; | 55 return false; |
| 56 #endif | 56 #endif |
| 57 } | 57 } |
| 58 | 58 |
| 59 inline bool IsArchitectureX86_64() { | 59 inline bool IsArchitectureX86_64() { |
| 60 #if defined(__x86_64__) | 60 #if defined(__x86_64__) |
| 61 return true; | 61 return true; |
| 62 #else | 62 #else |
| 63 return false; | 63 return false; |
| 64 #endif | 64 #endif |
| 65 } | 65 } |
| 66 | 66 |
| 67 inline bool IsArchitectureI386() { | 67 inline bool IsArchitectureI386() { |
| 68 #if defined(__i386__) | 68 #if defined(__i386__) |
| 69 return true; | 69 return true; |
| 70 #else | 70 #else |
| 71 return false; | 71 return false; |
| 72 #endif | 72 #endif |
| 73 } | 73 } |
| 74 | 74 |
| 75 inline bool IsArchitectureArm() { | 75 inline bool IsArchitectureArmFoo() { |
| 76 #if defined(__arm__) || defined(__aarch64__) | 76 #if defined(__arm__) || defined(__aarch64__) |
| 77 return true; | 77 return true; |
| 78 #else | 78 #else |
| 79 return false; | 79 return false; |
| 80 #endif | 80 #endif |
| 81 } | 81 } |
| 82 | 82 |
| 83 inline bool UseV4L2Codec() { | 83 inline bool UseV4L2Codec() { |
| 84 #if defined(USE_V4L2_CODEC) | 84 #if defined(USE_V4L2_CODEC) |
| 85 return true; | 85 return true; |
| (...skipping 193 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 279 return Allow(); | 279 return Allow(); |
| 280 | 280 |
| 281 // Default on the baseline policy. | 281 // Default on the baseline policy. |
| 282 return SandboxBPFBasePolicy::EvaluateSyscall(sysno); | 282 return SandboxBPFBasePolicy::EvaluateSyscall(sysno); |
| 283 } | 283 } |
| 284 } | 284 } |
| 285 | 285 |
| 286 bool GpuProcessPolicy::PreSandboxHook() { | 286 bool GpuProcessPolicy::PreSandboxHook() { |
| 287 // Warm up resources needed by the policy we're about to enable and | 287 // Warm up resources needed by the policy we're about to enable and |
| 288 // eventually start a broker process. | 288 // eventually start a broker process. |
| 289 const bool chromeos_arm_gpu = IsChromeOS() && IsArchitectureArm(); | 289 const bool chromeos_arm_gpu = IsChromeOSFoo() && IsArchitectureArmFoo(); |
| 290 // This policy is for x86 or Desktop. | 290 // This policy is for x86 or Desktop. |
| 291 DCHECK(!chromeos_arm_gpu); | 291 DCHECK(!chromeos_arm_gpu); |
| 292 | 292 |
| 293 DCHECK(!broker_process()); | 293 DCHECK(!broker_process()); |
| 294 // Create a new broker process. | 294 // Create a new broker process. |
| 295 InitGpuBrokerProcess( | 295 InitGpuBrokerProcess( |
| 296 GpuBrokerProcessPolicy::Create, | 296 GpuBrokerProcessPolicy::Create, |
| 297 std::vector<BrokerFilePermission>()); // No extra files in whitelist. | 297 std::vector<BrokerFilePermission>()); // No extra files in whitelist. |
| 298 | 298 |
| 299 if (IsArchitectureX86_64() || IsArchitectureI386()) { | 299 if (IsArchitectureX86_64() || IsArchitectureI386()) { |
| (...skipping 37 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 337 static const char kNvidiaParamsPath[] = "/proc/driver/nvidia/params"; | 337 static const char kNvidiaParamsPath[] = "/proc/driver/nvidia/params"; |
| 338 | 338 |
| 339 static const char kDevShm[] = "/dev/shm/"; | 339 static const char kDevShm[] = "/dev/shm/"; |
| 340 | 340 |
| 341 CHECK(broker_process_ == NULL); | 341 CHECK(broker_process_ == NULL); |
| 342 | 342 |
| 343 // All GPU process policies need these files brokered out. | 343 // All GPU process policies need these files brokered out. |
| 344 std::vector<BrokerFilePermission> permissions; | 344 std::vector<BrokerFilePermission> permissions; |
| 345 permissions.push_back(BrokerFilePermission::ReadOnly(kDriRcPath)); | 345 permissions.push_back(BrokerFilePermission::ReadOnly(kDriRcPath)); |
| 346 | 346 |
| 347 if (!IsChromeOS()) { | 347 if (!IsChromeOSFoo()) { |
| 348 // For shared memory. | 348 // For shared memory. |
| 349 permissions.push_back( | 349 permissions.push_back( |
| 350 BrokerFilePermission::ReadWriteCreateUnlinkRecursive(kDevShm)); | 350 BrokerFilePermission::ReadWriteCreateUnlinkRecursive(kDevShm)); |
| 351 // For DRI cards. | 351 // For DRI cards. |
| 352 for (int i = 0; i <= 9; ++i) { | 352 for (int i = 0; i <= 9; ++i) { |
| 353 permissions.push_back(BrokerFilePermission::ReadWrite( | 353 permissions.push_back(BrokerFilePermission::ReadWrite( |
| 354 base::StringPrintf("%s%d", kDriCardBasePath, i))); | 354 base::StringPrintf("%s%d", kDriCardBasePath, i))); |
| 355 } | 355 } |
| 356 // For Nvidia GLX driver. | 356 // For Nvidia GLX driver. |
| 357 permissions.push_back(BrokerFilePermission::ReadWrite(kNvidiaCtlPath)); | 357 permissions.push_back(BrokerFilePermission::ReadWrite(kNvidiaCtlPath)); |
| (...skipping 18 matching lines...) Expand all Loading... |
| 376 } | 376 } |
| 377 | 377 |
| 378 broker_process_ = new BrokerProcess(GetFSDeniedErrno(), permissions); | 378 broker_process_ = new BrokerProcess(GetFSDeniedErrno(), permissions); |
| 379 // The initialization callback will perform generic initialization and then | 379 // The initialization callback will perform generic initialization and then |
| 380 // call broker_sandboxer_callback. | 380 // call broker_sandboxer_callback. |
| 381 CHECK(broker_process_->Init(base::Bind(&UpdateProcessTypeAndEnableSandbox, | 381 CHECK(broker_process_->Init(base::Bind(&UpdateProcessTypeAndEnableSandbox, |
| 382 broker_sandboxer_allocator))); | 382 broker_sandboxer_allocator))); |
| 383 } | 383 } |
| 384 | 384 |
| 385 } // namespace content | 385 } // namespace content |
| OLD | NEW |