Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(94)

Side by Side Diff: content/common/sandbox_linux/bpf_cros_arm_gpu_policy_linux.cc

Issue 640123002: Linux sandbox: Restrict sched_* and ioprio_* calls in the cros arm GPU policy. (Closed) Base URL: https://chromium.googlesource.com/chromium/src.git@master
Patch Set: Use the base GPU policy to determine whether sched_* syscalls are allowed Created 6 years, 2 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
« no previous file with comments | « no previous file | no next file » | no next file with comments »
Toggle Intra-line Diffs ('i') | Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
OLDNEW
1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be 2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file. 3 // found in the LICENSE file.
4 4
5 #include "content/common/sandbox_linux/bpf_cros_arm_gpu_policy_linux.h" 5 #include "content/common/sandbox_linux/bpf_cros_arm_gpu_policy_linux.h"
6 6
7 #include <dlfcn.h> 7 #include <dlfcn.h>
8 #include <errno.h> 8 #include <errno.h>
9 #include <fcntl.h> 9 #include <fcntl.h>
10 #include <sys/socket.h> 10 #include <sys/socket.h>
(...skipping 134 matching lines...) Expand 10 before | Expand all | Expand 10 after
145 case __NR_uname: 145 case __NR_uname:
146 return Allow(); 146 return Allow();
147 // Allow only AF_UNIX for |domain|. 147 // Allow only AF_UNIX for |domain|.
148 case __NR_socket: 148 case __NR_socket:
149 case __NR_socketpair: { 149 case __NR_socketpair: {
150 const Arg<int> domain(0); 150 const Arg<int> domain(0);
151 return If(domain == AF_UNIX, Allow()).Else(Error(EPERM)); 151 return If(domain == AF_UNIX, Allow()).Else(Error(EPERM));
152 } 152 }
153 #endif // defined(__arm__) 153 #endif // defined(__arm__)
154 default: 154 default:
155 if (SyscallSets::IsAdvancedScheduler(sysno))
156 return Allow();
157
158 // Default to the generic GPU policy. 155 // Default to the generic GPU policy.
159 return GpuProcessPolicy::EvaluateSyscall(sysno); 156 return GpuProcessPolicy::EvaluateSyscall(sysno);
160 } 157 }
161 } 158 }
162 159
163 bool CrosArmGpuProcessPolicy::PreSandboxHook() { 160 bool CrosArmGpuProcessPolicy::PreSandboxHook() {
164 DCHECK(IsChromeOS() && IsArchitectureArm()); 161 DCHECK(IsChromeOS() && IsArchitectureArm());
165 // Create a new broker process. 162 // Create a new broker process.
166 DCHECK(!broker_process()); 163 DCHECK(!broker_process());
167 164
(...skipping 13 matching lines...) Expand all
181 // Preload the Tegra V4L2 (video decode acceleration) library. 178 // Preload the Tegra V4L2 (video decode acceleration) library.
182 dlopen("/usr/lib/libtegrav4l2.so", dlopen_flag); 179 dlopen("/usr/lib/libtegrav4l2.so", dlopen_flag);
183 // Resetting errno since platform-specific libraries will fail on other 180 // Resetting errno since platform-specific libraries will fail on other
184 // platforms. 181 // platforms.
185 errno = 0; 182 errno = 0;
186 183
187 return true; 184 return true;
188 } 185 }
189 186
190 } // namespace content 187 } // namespace content
OLDNEW
« no previous file with comments | « no previous file | no next file » | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698