OLD | NEW |
---|---|
1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "content/common/sandbox_linux/bpf_gpu_policy_linux.h" | 5 #include "content/common/sandbox_linux/bpf_gpu_policy_linux.h" |
6 | 6 |
7 #include <dlfcn.h> | 7 #include <dlfcn.h> |
8 #include <errno.h> | 8 #include <errno.h> |
9 #include <fcntl.h> | 9 #include <fcntl.h> |
10 #include <sys/socket.h> | 10 #include <sys/socket.h> |
(...skipping 151 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
162 bool UpdateProcessTypeAndEnableSandbox(sandbox::bpf_dsl::SandboxBPFDSLPolicy* ( | 162 bool UpdateProcessTypeAndEnableSandbox(sandbox::bpf_dsl::SandboxBPFDSLPolicy* ( |
163 *broker_sandboxer_allocator)(void)) { | 163 *broker_sandboxer_allocator)(void)) { |
164 DCHECK(broker_sandboxer_allocator); | 164 DCHECK(broker_sandboxer_allocator); |
165 UpdateProcessTypeToGpuBroker(); | 165 UpdateProcessTypeToGpuBroker(); |
166 return SandboxSeccompBPF::StartSandboxWithExternalPolicy( | 166 return SandboxSeccompBPF::StartSandboxWithExternalPolicy( |
167 make_scoped_ptr(broker_sandboxer_allocator())); | 167 make_scoped_ptr(broker_sandboxer_allocator())); |
168 } | 168 } |
169 | 169 |
170 } // namespace | 170 } // namespace |
171 | 171 |
172 GpuProcessPolicy::GpuProcessPolicy() : broker_process_(NULL) {} | 172 GpuProcessPolicy::GpuProcessPolicy() : GpuProcessPolicy(false) { |
173 } | |
174 | |
175 GpuProcessPolicy::GpuProcessPolicy(bool allow_mincore) | |
176 : broker_process_(NULL), allow_mincore_(allow_mincore) { | |
177 } | |
173 | 178 |
174 GpuProcessPolicy::~GpuProcessPolicy() {} | 179 GpuProcessPolicy::~GpuProcessPolicy() {} |
175 | 180 |
176 // Main policy for x86_64/i386. Extended by CrosArmGpuProcessPolicy. | 181 // Main policy for x86_64/i386. Extended by CrosArmGpuProcessPolicy. |
177 ResultExpr GpuProcessPolicy::EvaluateSyscall(int sysno) const { | 182 ResultExpr GpuProcessPolicy::EvaluateSyscall(int sysno) const { |
183 if (allow_mincore_ && sysno == __NR_mincore) | |
Jorge Lucangeli Obes
2014/10/20 18:41:02
Please add this as a case in the switch statement
| |
184 return Allow(); | |
185 | |
178 switch (sysno) { | 186 switch (sysno) { |
179 case __NR_ioctl: | 187 case __NR_ioctl: |
180 #if defined(__i386__) || defined(__x86_64__) || defined(__mips__) | 188 #if defined(__i386__) || defined(__x86_64__) || defined(__mips__) |
181 // The Nvidia driver uses flags not in the baseline policy | 189 // The Nvidia driver uses flags not in the baseline policy |
182 // (MAP_LOCKED | MAP_EXECUTABLE | MAP_32BIT) | 190 // (MAP_LOCKED | MAP_EXECUTABLE | MAP_32BIT) |
183 case __NR_mmap: | 191 case __NR_mmap: |
184 #endif | 192 #endif |
185 // We also hit this on the linux_chromeos bot but don't yet know what | 193 // We also hit this on the linux_chromeos bot but don't yet know what |
186 // weird flags were involved. | 194 // weird flags were involved. |
187 case __NR_mprotect: | 195 case __NR_mprotect: |
(...skipping 82 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
270 broker_process_ = new BrokerProcess(GetFSDeniedErrno(), | 278 broker_process_ = new BrokerProcess(GetFSDeniedErrno(), |
271 read_whitelist, | 279 read_whitelist, |
272 write_whitelist); | 280 write_whitelist); |
273 // The initialization callback will perform generic initialization and then | 281 // The initialization callback will perform generic initialization and then |
274 // call broker_sandboxer_callback. | 282 // call broker_sandboxer_callback. |
275 CHECK(broker_process_->Init(base::Bind(&UpdateProcessTypeAndEnableSandbox, | 283 CHECK(broker_process_->Init(base::Bind(&UpdateProcessTypeAndEnableSandbox, |
276 broker_sandboxer_allocator))); | 284 broker_sandboxer_allocator))); |
277 } | 285 } |
278 | 286 |
279 } // namespace content | 287 } // namespace content |
OLD | NEW |