| OLD | NEW |
| 1 // Copyright 2013 The Chromium Authors. All rights reserved. | 1 // Copyright 2013 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #ifndef CONTENT_COMMON_SANDBOX_LINUX_BPF_GPU_POLICY_LINUX_H_ | 5 #ifndef CONTENT_COMMON_SANDBOX_LINUX_BPF_GPU_POLICY_LINUX_H_ |
| 6 #define CONTENT_COMMON_SANDBOX_LINUX_BPF_GPU_POLICY_LINUX_H_ | 6 #define CONTENT_COMMON_SANDBOX_LINUX_BPF_GPU_POLICY_LINUX_H_ |
| 7 | 7 |
| 8 #include <string> | 8 #include <string> |
| 9 #include <vector> | 9 #include <vector> |
| 10 | 10 |
| 11 #include "base/callback_forward.h" | 11 #include "base/callback_forward.h" |
| 12 #include "content/common/sandbox_linux/sandbox_bpf_base_policy_linux.h" | 12 #include "content/common/sandbox_linux/sandbox_bpf_base_policy_linux.h" |
| 13 | 13 |
| 14 namespace sandbox { | 14 namespace sandbox { |
| 15 class BrokerProcess; | 15 class BrokerProcess; |
| 16 } | 16 } |
| 17 | 17 |
| 18 namespace content { | 18 namespace content { |
| 19 | 19 |
| 20 class GpuProcessPolicy : public SandboxBPFBasePolicy { | 20 class GpuProcessPolicy : public SandboxBPFBasePolicy { |
| 21 public: | 21 public: |
| 22 GpuProcessPolicy(); | 22 GpuProcessPolicy(); |
| 23 explicit GpuProcessPolicy(bool allow_mincore); | 23 explicit GpuProcessPolicy(bool allow_mincore); |
| 24 virtual ~GpuProcessPolicy(); | 24 ~GpuProcessPolicy() override; |
| 25 | 25 |
| 26 virtual sandbox::bpf_dsl::ResultExpr EvaluateSyscall( | 26 sandbox::bpf_dsl::ResultExpr EvaluateSyscall( |
| 27 int system_call_number) const override; | 27 int system_call_number) const override; |
| 28 | 28 |
| 29 virtual bool PreSandboxHook() override; | 29 bool PreSandboxHook() override; |
| 30 | 30 |
| 31 protected: | 31 protected: |
| 32 // Start a broker process to handle open() inside the sandbox. | 32 // Start a broker process to handle open() inside the sandbox. |
| 33 // |broker_sandboxer_allocator| is a function pointer which can allocate a | 33 // |broker_sandboxer_allocator| is a function pointer which can allocate a |
| 34 // suitable sandbox policy for the broker process itself. | 34 // suitable sandbox policy for the broker process itself. |
| 35 // |read_whitelist_extra| and |write_whitelist_extra| are lists of file | 35 // |read_whitelist_extra| and |write_whitelist_extra| are lists of file |
| 36 // names that should be whitelisted by the broker process, in addition to | 36 // names that should be whitelisted by the broker process, in addition to |
| 37 // the basic ones. | 37 // the basic ones. |
| 38 void InitGpuBrokerProcess( | 38 void InitGpuBrokerProcess( |
| 39 sandbox::bpf_dsl::Policy* (*broker_sandboxer_allocator)(void), | 39 sandbox::bpf_dsl::Policy* (*broker_sandboxer_allocator)(void), |
| (...skipping 14 matching lines...) Expand all Loading... |
| 54 | 54 |
| 55 // eglCreateWindowSurface() needs mincore(). | 55 // eglCreateWindowSurface() needs mincore(). |
| 56 bool allow_mincore_; | 56 bool allow_mincore_; |
| 57 | 57 |
| 58 DISALLOW_COPY_AND_ASSIGN(GpuProcessPolicy); | 58 DISALLOW_COPY_AND_ASSIGN(GpuProcessPolicy); |
| 59 }; | 59 }; |
| 60 | 60 |
| 61 } // namespace content | 61 } // namespace content |
| 62 | 62 |
| 63 #endif // CONTENT_COMMON_SANDBOX_LINUX_BPF_GPU_POLICY_LINUX_H_ | 63 #endif // CONTENT_COMMON_SANDBOX_LINUX_BPF_GPU_POLICY_LINUX_H_ |
| OLD | NEW |