| OLD | NEW | 
|---|
| 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. | 
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be | 
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. | 
| 4 | 4 | 
| 5 #include "content/common/sandbox_linux/bpf_gpu_policy_linux.h" | 5 #include "content/common/sandbox_linux/bpf_gpu_policy_linux.h" | 
| 6 | 6 | 
| 7 #include <dlfcn.h> | 7 #include <dlfcn.h> | 
| 8 #include <errno.h> | 8 #include <errno.h> | 
| 9 #include <fcntl.h> | 9 #include <fcntl.h> | 
| 10 #include <sys/socket.h> | 10 #include <sys/socket.h> | 
| (...skipping 31 matching lines...) Expand 10 before | Expand all | Expand 10 after  Loading... | 
| 42 using sandbox::bpf_dsl::ResultExpr; | 42 using sandbox::bpf_dsl::ResultExpr; | 
| 43 using sandbox::bpf_dsl::Trap; | 43 using sandbox::bpf_dsl::Trap; | 
| 44 using sandbox::syscall_broker::BrokerFilePermission; | 44 using sandbox::syscall_broker::BrokerFilePermission; | 
| 45 using sandbox::syscall_broker::BrokerProcess; | 45 using sandbox::syscall_broker::BrokerProcess; | 
| 46 using sandbox::SyscallSets; | 46 using sandbox::SyscallSets; | 
| 47 | 47 | 
| 48 namespace content { | 48 namespace content { | 
| 49 | 49 | 
| 50 namespace { | 50 namespace { | 
| 51 | 51 | 
| 52 inline bool IsChromeOS() { | 52 inline bool IsChromeOSFoo() { | 
| 53 #if defined(OS_CHROMEOS) | 53 #if defined(OS_CHROMEOS) | 
| 54   return true; | 54   return true; | 
| 55 #else | 55 #else | 
| 56   return false; | 56   return false; | 
| 57 #endif | 57 #endif | 
| 58 } | 58 } | 
| 59 | 59 | 
| 60 inline bool IsArchitectureX86_64() { | 60 inline bool IsArchitectureX86_64() { | 
| 61 #if defined(__x86_64__) | 61 #if defined(__x86_64__) | 
| 62   return true; | 62   return true; | 
| 63 #else | 63 #else | 
| 64   return false; | 64   return false; | 
| 65 #endif | 65 #endif | 
| 66 } | 66 } | 
| 67 | 67 | 
| 68 inline bool IsArchitectureI386() { | 68 inline bool IsArchitectureI386() { | 
| 69 #if defined(__i386__) | 69 #if defined(__i386__) | 
| 70   return true; | 70   return true; | 
| 71 #else | 71 #else | 
| 72   return false; | 72   return false; | 
| 73 #endif | 73 #endif | 
| 74 } | 74 } | 
| 75 | 75 | 
| 76 inline bool IsArchitectureArm() { | 76 inline bool IsArchitectureArmFoo() { | 
| 77 #if defined(__arm__) || defined(__aarch64__) | 77 #if defined(__arm__) || defined(__aarch64__) | 
| 78   return true; | 78   return true; | 
| 79 #else | 79 #else | 
| 80   return false; | 80   return false; | 
| 81 #endif | 81 #endif | 
| 82 } | 82 } | 
| 83 | 83 | 
| 84 inline bool UseV4L2Codec() { | 84 inline bool UseV4L2Codec() { | 
| 85 #if BUILDFLAG(USE_V4L2_CODEC) | 85 #if BUILDFLAG(USE_V4L2_CODEC) | 
| 86   return true; | 86   return true; | 
| (...skipping 191 matching lines...) Expand 10 before | Expand all | Expand 10 after  Loading... | 
| 278         return Allow(); | 278         return Allow(); | 
| 279 | 279 | 
| 280       // Default on the baseline policy. | 280       // Default on the baseline policy. | 
| 281       return SandboxBPFBasePolicy::EvaluateSyscall(sysno); | 281       return SandboxBPFBasePolicy::EvaluateSyscall(sysno); | 
| 282   } | 282   } | 
| 283 } | 283 } | 
| 284 | 284 | 
| 285 bool GpuProcessPolicy::PreSandboxHook() { | 285 bool GpuProcessPolicy::PreSandboxHook() { | 
| 286   // Warm up resources needed by the policy we're about to enable and | 286   // Warm up resources needed by the policy we're about to enable and | 
| 287   // eventually start a broker process. | 287   // eventually start a broker process. | 
| 288   const bool chromeos_arm_gpu = IsChromeOS() && IsArchitectureArm(); | 288   const bool chromeos_arm_gpu = IsChromeOSFoo() && IsArchitectureArmFoo(); | 
| 289   // This policy is for x86 or Desktop. | 289   // This policy is for x86 or Desktop. | 
| 290   DCHECK(!chromeos_arm_gpu); | 290   DCHECK(!chromeos_arm_gpu); | 
| 291 | 291 | 
| 292   DCHECK(!broker_process()); | 292   DCHECK(!broker_process()); | 
| 293   // Create a new broker process. | 293   // Create a new broker process. | 
| 294   InitGpuBrokerProcess( | 294   InitGpuBrokerProcess( | 
| 295       GpuBrokerProcessPolicy::Create, | 295       GpuBrokerProcessPolicy::Create, | 
| 296       std::vector<BrokerFilePermission>());  // No extra files in whitelist. | 296       std::vector<BrokerFilePermission>());  // No extra files in whitelist. | 
| 297 | 297 | 
| 298   if (IsArchitectureX86_64() || IsArchitectureI386()) { | 298   if (IsArchitectureX86_64() || IsArchitectureI386()) { | 
| (...skipping 37 matching lines...) Expand 10 before | Expand all | Expand 10 after  Loading... | 
| 336   static const char kNvidiaParamsPath[] = "/proc/driver/nvidia/params"; | 336   static const char kNvidiaParamsPath[] = "/proc/driver/nvidia/params"; | 
| 337 | 337 | 
| 338   static const char kDevShm[] = "/dev/shm/"; | 338   static const char kDevShm[] = "/dev/shm/"; | 
| 339 | 339 | 
| 340   CHECK(broker_process_ == NULL); | 340   CHECK(broker_process_ == NULL); | 
| 341 | 341 | 
| 342   // All GPU process policies need these files brokered out. | 342   // All GPU process policies need these files brokered out. | 
| 343   std::vector<BrokerFilePermission> permissions; | 343   std::vector<BrokerFilePermission> permissions; | 
| 344   permissions.push_back(BrokerFilePermission::ReadOnly(kDriRcPath)); | 344   permissions.push_back(BrokerFilePermission::ReadOnly(kDriRcPath)); | 
| 345 | 345 | 
| 346   if (!IsChromeOS()) { | 346   if (!IsChromeOSFoo()) { | 
| 347     // For shared memory. | 347     // For shared memory. | 
| 348     permissions.push_back( | 348     permissions.push_back( | 
| 349         BrokerFilePermission::ReadWriteCreateUnlinkRecursive(kDevShm)); | 349         BrokerFilePermission::ReadWriteCreateUnlinkRecursive(kDevShm)); | 
| 350     // For DRI cards. | 350     // For DRI cards. | 
| 351     for (int i = 0; i <= 9; ++i) { | 351     for (int i = 0; i <= 9; ++i) { | 
| 352       permissions.push_back(BrokerFilePermission::ReadWrite( | 352       permissions.push_back(BrokerFilePermission::ReadWrite( | 
| 353           base::StringPrintf("%s%d", kDriCardBasePath, i))); | 353           base::StringPrintf("%s%d", kDriCardBasePath, i))); | 
| 354     } | 354     } | 
| 355     // For Nvidia GLX driver. | 355     // For Nvidia GLX driver. | 
| 356     permissions.push_back(BrokerFilePermission::ReadWrite(kNvidiaCtlPath)); | 356     permissions.push_back(BrokerFilePermission::ReadWrite(kNvidiaCtlPath)); | 
| (...skipping 18 matching lines...) Expand all  Loading... | 
| 375   } | 375   } | 
| 376 | 376 | 
| 377   broker_process_ = new BrokerProcess(GetFSDeniedErrno(), permissions); | 377   broker_process_ = new BrokerProcess(GetFSDeniedErrno(), permissions); | 
| 378   // The initialization callback will perform generic initialization and then | 378   // The initialization callback will perform generic initialization and then | 
| 379   // call broker_sandboxer_callback. | 379   // call broker_sandboxer_callback. | 
| 380   CHECK(broker_process_->Init(base::Bind(&UpdateProcessTypeAndEnableSandbox, | 380   CHECK(broker_process_->Init(base::Bind(&UpdateProcessTypeAndEnableSandbox, | 
| 381                                          broker_sandboxer_allocator))); | 381                                          broker_sandboxer_allocator))); | 
| 382 } | 382 } | 
| 383 | 383 | 
| 384 }  // namespace content | 384 }  // namespace content | 
| OLD | NEW | 
|---|