Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(2343)

Unified Diff: sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.h

Issue 640123002: Linux sandbox: Restrict sched_* and ioprio_* calls in the cros arm GPU policy. (Closed) Base URL: https://chromium.googlesource.com/chromium/src.git@master
Patch Set: Created 6 years, 2 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
Index: sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.h
diff --git a/sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.h b/sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.h
index bf9909c6302b3a5e8fa18759c27e37e0c4c314f3..f0dba1b22f2d4fbe47e0285d154a7a915127e558 100644
--- a/sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.h
+++ b/sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.h
@@ -63,10 +63,14 @@ SANDBOX_EXPORT bpf_dsl::ResultExpr RestrictKillTarget(pid_t target_pid,
// Crash if FUTEX_CMP_REQUEUE_PI is used in the second argument of futex(2).
SANDBOX_EXPORT bpf_dsl::ResultExpr RestrictFutex();
-// Crash if |which| is not PRIO_PROCESS. EPERM if |who| is not 0, neither
+// Crash if |which| is not PRIO_PROCESS. EPERM if |who| is neither 0 nor
// |target_pid| while calling setpriority(2) / getpriority(2).
SANDBOX_EXPORT bpf_dsl::ResultExpr RestrictGetSetpriority(pid_t target_pid);
+// Crash if |which| is not PRIO_PROCESS. EPERM if |who| is neither 0 nor
+// |target_pid| while calling ioprio_set(2) / ioprio_get(2).
+SANDBOX_EXPORT bpf_dsl::ResultExpr RestrictIoPrioGetSet(pid_t target_pid);
+
// Restrict |clk_id| for clock_getres(), clock_gettime() and clock_settime().
// We allow accessing only CLOCK_MONOTONIC, CLOCK_PROCESS_CPUTIME_ID,
// CLOCK_REALTIME, and CLOCK_THREAD_CPUTIME_ID. In particular, this disallows

Powered by Google App Engine
This is Rietveld 408576698