Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(290)

Unified Diff: content/common/sandbox_linux/bpf_gpu_policy_linux.cc

Issue 598203004: Linux sandbox: Restrict sched_* syscalls on the GPU and ppapi processes. (Closed) Base URL: https://chromium.googlesource.com/chromium/src.git@master
Patch Set: Created 6 years, 3 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
Index: content/common/sandbox_linux/bpf_gpu_policy_linux.cc
diff --git a/content/common/sandbox_linux/bpf_gpu_policy_linux.cc b/content/common/sandbox_linux/bpf_gpu_policy_linux.cc
index a05b66476c597ff8204ebe1f4615019ade92de30..01a9bd08235883c73dda85fd7ad439661ce0dd17 100644
--- a/content/common/sandbox_linux/bpf_gpu_policy_linux.cc
+++ b/content/common/sandbox_linux/bpf_gpu_policy_linux.cc
@@ -25,6 +25,7 @@
#include "content/common/sandbox_linux/sandbox_seccomp_bpf_linux.h"
#include "content/common/set_process_title.h"
#include "content/public/common/content_switches.h"
+#include "sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.h"
#include "sandbox/linux/seccomp-bpf-helpers/syscall_sets.h"
#include "sandbox/linux/seccomp-bpf/trap.h"
#include "sandbox/linux/services/broker_process.h"
@@ -186,15 +187,17 @@ ResultExpr GpuProcessPolicy::EvaluateSyscall(int sysno) const {
case __NR_mprotect:
// TODO(jln): restrict prctl.
case __NR_prctl:
- case __NR_sched_getaffinity:
- case __NR_sched_setaffinity:
- case __NR_setpriority:
return Allow();
case __NR_access:
case __NR_open:
case __NR_openat:
DCHECK(broker_process_);
return Trap(GpuSIGSYS_Handler, broker_process_);
+ case __NR_setpriority:
+ return sandbox::RestrictGetSetpriority(current_pid());
+ case __NR_sched_getaffinity:
+ case __NR_sched_setaffinity:
+ return sandbox::RestrictSchedTarget(current_pid(), sysno);
default:
if (SyscallSets::IsEventFd(sysno))
return Allow();

Powered by Google App Engine
This is Rietveld 408576698