Index: content/common/sandbox_linux/bpf_gpu_policy_linux.cc |
diff --git a/content/common/sandbox_linux/bpf_gpu_policy_linux.cc b/content/common/sandbox_linux/bpf_gpu_policy_linux.cc |
index 74f9871fc30a92c8cd3abca5527c5ebb896937d1..d5abb3cf76222f3cd998034619b33d1d292ddc66 100644 |
--- a/content/common/sandbox_linux/bpf_gpu_policy_linux.cc |
+++ b/content/common/sandbox_linux/bpf_gpu_policy_linux.cc |
@@ -169,7 +169,12 @@ bool UpdateProcessTypeAndEnableSandbox(sandbox::bpf_dsl::SandboxBPFDSLPolicy* ( |
} // namespace |
-GpuProcessPolicy::GpuProcessPolicy() : broker_process_(NULL) {} |
+GpuProcessPolicy::GpuProcessPolicy() : GpuProcessPolicy(false) { |
+} |
+ |
+GpuProcessPolicy::GpuProcessPolicy(bool allow_mincore) |
+ : broker_process_(NULL), allow_mincore_(allow_mincore) { |
+} |
GpuProcessPolicy::~GpuProcessPolicy() {} |
@@ -177,6 +182,13 @@ GpuProcessPolicy::~GpuProcessPolicy() {} |
ResultExpr GpuProcessPolicy::EvaluateSyscall(int sysno) const { |
switch (sysno) { |
case __NR_ioctl: |
+ return Allow(); |
+ case __NR_mincore: |
+ if (allow_mincore_) { |
+ return Allow(); |
+ } else { |
+ return SandboxBPFBasePolicy::EvaluateSyscall(sysno); |
+ } |
#if defined(__i386__) || defined(__x86_64__) || defined(__mips__) |
// The Nvidia driver uses flags not in the baseline policy |
// (MAP_LOCKED | MAP_EXECUTABLE | MAP_32BIT) |