Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(117)

Side by Side Diff: content/common/sandbox_linux/bpf_gpu_policy_linux.cc

Issue 2867693004: Snapshot of all changes to get jumbo in blink and content.
Patch Set: Exclude certain files from jumbo because of a Windows problem Created 3 years, 3 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
« no previous file with comments | « content/common/cursors/webcursor_aurax11.cc ('k') | content/content.gni » ('j') | no next file with comments »
Toggle Intra-line Diffs ('i') | Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
OLDNEW
1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be 2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file. 3 // found in the LICENSE file.
4 4
5 #include "content/common/sandbox_linux/bpf_gpu_policy_linux.h" 5 #include "content/common/sandbox_linux/bpf_gpu_policy_linux.h"
6 6
7 #include <dlfcn.h> 7 #include <dlfcn.h>
8 #include <errno.h> 8 #include <errno.h>
9 #include <fcntl.h> 9 #include <fcntl.h>
10 #include <sys/socket.h> 10 #include <sys/socket.h>
(...skipping 31 matching lines...) Expand 10 before | Expand all | Expand 10 after
42 using sandbox::bpf_dsl::ResultExpr; 42 using sandbox::bpf_dsl::ResultExpr;
43 using sandbox::bpf_dsl::Trap; 43 using sandbox::bpf_dsl::Trap;
44 using sandbox::syscall_broker::BrokerFilePermission; 44 using sandbox::syscall_broker::BrokerFilePermission;
45 using sandbox::syscall_broker::BrokerProcess; 45 using sandbox::syscall_broker::BrokerProcess;
46 using sandbox::SyscallSets; 46 using sandbox::SyscallSets;
47 47
48 namespace content { 48 namespace content {
49 49
50 namespace { 50 namespace {
51 51
52 inline bool IsChromeOS() { 52 inline bool IsChromeOSFoo() {
53 #if defined(OS_CHROMEOS) 53 #if defined(OS_CHROMEOS)
54 return true; 54 return true;
55 #else 55 #else
56 return false; 56 return false;
57 #endif 57 #endif
58 } 58 }
59 59
60 inline bool IsArchitectureX86_64() { 60 inline bool IsArchitectureX86_64() {
61 #if defined(__x86_64__) 61 #if defined(__x86_64__)
62 return true; 62 return true;
63 #else 63 #else
64 return false; 64 return false;
65 #endif 65 #endif
66 } 66 }
67 67
68 inline bool IsArchitectureI386() { 68 inline bool IsArchitectureI386() {
69 #if defined(__i386__) 69 #if defined(__i386__)
70 return true; 70 return true;
71 #else 71 #else
72 return false; 72 return false;
73 #endif 73 #endif
74 } 74 }
75 75
76 inline bool IsArchitectureArm() { 76 inline bool IsArchitectureArmFoo() {
77 #if defined(__arm__) || defined(__aarch64__) 77 #if defined(__arm__) || defined(__aarch64__)
78 return true; 78 return true;
79 #else 79 #else
80 return false; 80 return false;
81 #endif 81 #endif
82 } 82 }
83 83
84 inline bool UseV4L2Codec() { 84 inline bool UseV4L2Codec() {
85 #if BUILDFLAG(USE_V4L2_CODEC) 85 #if BUILDFLAG(USE_V4L2_CODEC)
86 return true; 86 return true;
(...skipping 191 matching lines...) Expand 10 before | Expand all | Expand 10 after
278 return Allow(); 278 return Allow();
279 279
280 // Default on the baseline policy. 280 // Default on the baseline policy.
281 return SandboxBPFBasePolicy::EvaluateSyscall(sysno); 281 return SandboxBPFBasePolicy::EvaluateSyscall(sysno);
282 } 282 }
283 } 283 }
284 284
285 bool GpuProcessPolicy::PreSandboxHook() { 285 bool GpuProcessPolicy::PreSandboxHook() {
286 // Warm up resources needed by the policy we're about to enable and 286 // Warm up resources needed by the policy we're about to enable and
287 // eventually start a broker process. 287 // eventually start a broker process.
288 const bool chromeos_arm_gpu = IsChromeOS() && IsArchitectureArm(); 288 const bool chromeos_arm_gpu = IsChromeOSFoo() && IsArchitectureArmFoo();
289 // This policy is for x86 or Desktop. 289 // This policy is for x86 or Desktop.
290 DCHECK(!chromeos_arm_gpu); 290 DCHECK(!chromeos_arm_gpu);
291 291
292 DCHECK(!broker_process()); 292 DCHECK(!broker_process());
293 // Create a new broker process. 293 // Create a new broker process.
294 InitGpuBrokerProcess( 294 InitGpuBrokerProcess(
295 GpuBrokerProcessPolicy::Create, 295 GpuBrokerProcessPolicy::Create,
296 std::vector<BrokerFilePermission>()); // No extra files in whitelist. 296 std::vector<BrokerFilePermission>()); // No extra files in whitelist.
297 297
298 if (IsArchitectureX86_64() || IsArchitectureI386()) { 298 if (IsArchitectureX86_64() || IsArchitectureI386()) {
(...skipping 37 matching lines...) Expand 10 before | Expand all | Expand 10 after
336 static const char kNvidiaParamsPath[] = "/proc/driver/nvidia/params"; 336 static const char kNvidiaParamsPath[] = "/proc/driver/nvidia/params";
337 337
338 static const char kDevShm[] = "/dev/shm/"; 338 static const char kDevShm[] = "/dev/shm/";
339 339
340 CHECK(broker_process_ == NULL); 340 CHECK(broker_process_ == NULL);
341 341
342 // All GPU process policies need these files brokered out. 342 // All GPU process policies need these files brokered out.
343 std::vector<BrokerFilePermission> permissions; 343 std::vector<BrokerFilePermission> permissions;
344 permissions.push_back(BrokerFilePermission::ReadOnly(kDriRcPath)); 344 permissions.push_back(BrokerFilePermission::ReadOnly(kDriRcPath));
345 345
346 if (!IsChromeOS()) { 346 if (!IsChromeOSFoo()) {
347 // For shared memory. 347 // For shared memory.
348 permissions.push_back( 348 permissions.push_back(
349 BrokerFilePermission::ReadWriteCreateUnlinkRecursive(kDevShm)); 349 BrokerFilePermission::ReadWriteCreateUnlinkRecursive(kDevShm));
350 // For DRI cards. 350 // For DRI cards.
351 for (int i = 0; i <= 9; ++i) { 351 for (int i = 0; i <= 9; ++i) {
352 permissions.push_back(BrokerFilePermission::ReadWrite( 352 permissions.push_back(BrokerFilePermission::ReadWrite(
353 base::StringPrintf("%s%d", kDriCardBasePath, i))); 353 base::StringPrintf("%s%d", kDriCardBasePath, i)));
354 } 354 }
355 // For Nvidia GLX driver. 355 // For Nvidia GLX driver.
356 permissions.push_back(BrokerFilePermission::ReadWrite(kNvidiaCtlPath)); 356 permissions.push_back(BrokerFilePermission::ReadWrite(kNvidiaCtlPath));
(...skipping 18 matching lines...) Expand all
375 } 375 }
376 376
377 broker_process_ = new BrokerProcess(GetFSDeniedErrno(), permissions); 377 broker_process_ = new BrokerProcess(GetFSDeniedErrno(), permissions);
378 // The initialization callback will perform generic initialization and then 378 // The initialization callback will perform generic initialization and then
379 // call broker_sandboxer_callback. 379 // call broker_sandboxer_callback.
380 CHECK(broker_process_->Init(base::Bind(&UpdateProcessTypeAndEnableSandbox, 380 CHECK(broker_process_->Init(base::Bind(&UpdateProcessTypeAndEnableSandbox,
381 broker_sandboxer_allocator))); 381 broker_sandboxer_allocator)));
382 } 382 }
383 383
384 } // namespace content 384 } // namespace content
OLDNEW
« no previous file with comments | « content/common/cursors/webcursor_aurax11.cc ('k') | content/content.gni » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698