| OLD | NEW |
| 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "content/common/sandbox_linux/bpf_gpu_policy_linux.h" | 5 #include "content/common/sandbox_linux/bpf_gpu_policy_linux.h" |
| 6 | 6 |
| 7 #include <dlfcn.h> | 7 #include <dlfcn.h> |
| 8 #include <errno.h> | 8 #include <errno.h> |
| 9 #include <fcntl.h> | 9 #include <fcntl.h> |
| 10 #include <sys/socket.h> | 10 #include <sys/socket.h> |
| (...skipping 31 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 42 using sandbox::bpf_dsl::ResultExpr; | 42 using sandbox::bpf_dsl::ResultExpr; |
| 43 using sandbox::bpf_dsl::Trap; | 43 using sandbox::bpf_dsl::Trap; |
| 44 using sandbox::syscall_broker::BrokerFilePermission; | 44 using sandbox::syscall_broker::BrokerFilePermission; |
| 45 using sandbox::syscall_broker::BrokerProcess; | 45 using sandbox::syscall_broker::BrokerProcess; |
| 46 using sandbox::SyscallSets; | 46 using sandbox::SyscallSets; |
| 47 | 47 |
| 48 namespace content { | 48 namespace content { |
| 49 | 49 |
| 50 namespace { | 50 namespace { |
| 51 | 51 |
| 52 inline bool IsChromeOS() { | 52 inline bool IsChromeOSFoo() { |
| 53 #if defined(OS_CHROMEOS) | 53 #if defined(OS_CHROMEOS) |
| 54 return true; | 54 return true; |
| 55 #else | 55 #else |
| 56 return false; | 56 return false; |
| 57 #endif | 57 #endif |
| 58 } | 58 } |
| 59 | 59 |
| 60 inline bool IsArchitectureX86_64() { | 60 inline bool IsArchitectureX86_64() { |
| 61 #if defined(__x86_64__) | 61 #if defined(__x86_64__) |
| 62 return true; | 62 return true; |
| 63 #else | 63 #else |
| 64 return false; | 64 return false; |
| 65 #endif | 65 #endif |
| 66 } | 66 } |
| 67 | 67 |
| 68 inline bool IsArchitectureI386() { | 68 inline bool IsArchitectureI386() { |
| 69 #if defined(__i386__) | 69 #if defined(__i386__) |
| 70 return true; | 70 return true; |
| 71 #else | 71 #else |
| 72 return false; | 72 return false; |
| 73 #endif | 73 #endif |
| 74 } | 74 } |
| 75 | 75 |
| 76 inline bool IsArchitectureArm() { | 76 inline bool IsArchitectureArmFoo() { |
| 77 #if defined(__arm__) || defined(__aarch64__) | 77 #if defined(__arm__) || defined(__aarch64__) |
| 78 return true; | 78 return true; |
| 79 #else | 79 #else |
| 80 return false; | 80 return false; |
| 81 #endif | 81 #endif |
| 82 } | 82 } |
| 83 | 83 |
| 84 inline bool UseV4L2Codec() { | 84 inline bool UseV4L2Codec() { |
| 85 #if BUILDFLAG(USE_V4L2_CODEC) | 85 #if BUILDFLAG(USE_V4L2_CODEC) |
| 86 return true; | 86 return true; |
| (...skipping 191 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 278 return Allow(); | 278 return Allow(); |
| 279 | 279 |
| 280 // Default on the baseline policy. | 280 // Default on the baseline policy. |
| 281 return SandboxBPFBasePolicy::EvaluateSyscall(sysno); | 281 return SandboxBPFBasePolicy::EvaluateSyscall(sysno); |
| 282 } | 282 } |
| 283 } | 283 } |
| 284 | 284 |
| 285 bool GpuProcessPolicy::PreSandboxHook() { | 285 bool GpuProcessPolicy::PreSandboxHook() { |
| 286 // Warm up resources needed by the policy we're about to enable and | 286 // Warm up resources needed by the policy we're about to enable and |
| 287 // eventually start a broker process. | 287 // eventually start a broker process. |
| 288 const bool chromeos_arm_gpu = IsChromeOS() && IsArchitectureArm(); | 288 const bool chromeos_arm_gpu = IsChromeOSFoo() && IsArchitectureArmFoo(); |
| 289 // This policy is for x86 or Desktop. | 289 // This policy is for x86 or Desktop. |
| 290 DCHECK(!chromeos_arm_gpu); | 290 DCHECK(!chromeos_arm_gpu); |
| 291 | 291 |
| 292 DCHECK(!broker_process()); | 292 DCHECK(!broker_process()); |
| 293 // Create a new broker process. | 293 // Create a new broker process. |
| 294 InitGpuBrokerProcess( | 294 InitGpuBrokerProcess( |
| 295 GpuBrokerProcessPolicy::Create, | 295 GpuBrokerProcessPolicy::Create, |
| 296 std::vector<BrokerFilePermission>()); // No extra files in whitelist. | 296 std::vector<BrokerFilePermission>()); // No extra files in whitelist. |
| 297 | 297 |
| 298 if (IsArchitectureX86_64() || IsArchitectureI386()) { | 298 if (IsArchitectureX86_64() || IsArchitectureI386()) { |
| (...skipping 37 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 336 static const char kNvidiaParamsPath[] = "/proc/driver/nvidia/params"; | 336 static const char kNvidiaParamsPath[] = "/proc/driver/nvidia/params"; |
| 337 | 337 |
| 338 static const char kDevShm[] = "/dev/shm/"; | 338 static const char kDevShm[] = "/dev/shm/"; |
| 339 | 339 |
| 340 CHECK(broker_process_ == NULL); | 340 CHECK(broker_process_ == NULL); |
| 341 | 341 |
| 342 // All GPU process policies need these files brokered out. | 342 // All GPU process policies need these files brokered out. |
| 343 std::vector<BrokerFilePermission> permissions; | 343 std::vector<BrokerFilePermission> permissions; |
| 344 permissions.push_back(BrokerFilePermission::ReadOnly(kDriRcPath)); | 344 permissions.push_back(BrokerFilePermission::ReadOnly(kDriRcPath)); |
| 345 | 345 |
| 346 if (!IsChromeOS()) { | 346 if (!IsChromeOSFoo()) { |
| 347 // For shared memory. | 347 // For shared memory. |
| 348 permissions.push_back( | 348 permissions.push_back( |
| 349 BrokerFilePermission::ReadWriteCreateUnlinkRecursive(kDevShm)); | 349 BrokerFilePermission::ReadWriteCreateUnlinkRecursive(kDevShm)); |
| 350 // For DRI cards. | 350 // For DRI cards. |
| 351 for (int i = 0; i <= 9; ++i) { | 351 for (int i = 0; i <= 9; ++i) { |
| 352 permissions.push_back(BrokerFilePermission::ReadWrite( | 352 permissions.push_back(BrokerFilePermission::ReadWrite( |
| 353 base::StringPrintf("%s%d", kDriCardBasePath, i))); | 353 base::StringPrintf("%s%d", kDriCardBasePath, i))); |
| 354 } | 354 } |
| 355 // For Nvidia GLX driver. | 355 // For Nvidia GLX driver. |
| 356 permissions.push_back(BrokerFilePermission::ReadWrite(kNvidiaCtlPath)); | 356 permissions.push_back(BrokerFilePermission::ReadWrite(kNvidiaCtlPath)); |
| (...skipping 18 matching lines...) Expand all Loading... |
| 375 } | 375 } |
| 376 | 376 |
| 377 broker_process_ = new BrokerProcess(GetFSDeniedErrno(), permissions); | 377 broker_process_ = new BrokerProcess(GetFSDeniedErrno(), permissions); |
| 378 // The initialization callback will perform generic initialization and then | 378 // The initialization callback will perform generic initialization and then |
| 379 // call broker_sandboxer_callback. | 379 // call broker_sandboxer_callback. |
| 380 CHECK(broker_process_->Init(base::Bind(&UpdateProcessTypeAndEnableSandbox, | 380 CHECK(broker_process_->Init(base::Bind(&UpdateProcessTypeAndEnableSandbox, |
| 381 broker_sandboxer_allocator))); | 381 broker_sandboxer_allocator))); |
| 382 } | 382 } |
| 383 | 383 |
| 384 } // namespace content | 384 } // namespace content |
| OLD | NEW |