bpf gpu policy: Change GPU bpf policy to support DRI3

content/common/sandbox_linux/bpf_gpu_policy_linux.cc

Index: content/common/sandbox_linux/bpf_gpu_policy_linux.cc
diff --git a/content/common/sandbox_linux/bpf_gpu_policy_linux.cc b/content/common/sandbox_linux/bpf_gpu_policy_linux.cc
index 711f9b4a552b23ed22d4a4060ad89bbf7b0ab6ee..bc155991fe242a272e7a410cc8182ff1c9d25f31 100644
--- a/content/common/sandbox_linux/bpf_gpu_policy_linux.cc
+++ b/content/common/sandbox_linux/bpf_gpu_policy_linux.cc
@@ -141,6 +141,9 @@ ResultExpr GpuBrokerProcessPolicy::EvaluateSyscall(int sysno) const {
     case __NR_access:
     case __NR_open:
     case __NR_openat:
+#if !defined(OS_CHROMEOS)
+    case __NR_unlink:

[Ken Russell (switch to Gerrit), 2014/12/03 19:48:15]

This doesn't allow arbitrary files to be unlinked, does it? There's a filter
elsewhere in the sandbox which evaluates the arguments? Is it worth adding a
comment and perhaps a pointer to the other code?

[jln (very slow on Chromium), 2014/12/03 19:57:59]

This would indeed. Lee, what requires that? This would be a major break from the
sandbox: we mandate O_EXCL precisely to prevent taking over files owned by
another process. Allowing unlink would break that (in addition to the obvious
annoyance of attackers being able to delete your files).

Moreover, even if we decided we needed this (which we *really* shouldn't), this
should be brokered away, in order to keep the model of the sandbox whole (We
should be able to entirely dump FS access from the GPU process, which we
hopefully will materialize soon with a chroot to an empty dir or something like
this).

[Jorge Lucangeli Obes, 2014/12/03 21:01:50]

This is the broker policy.

[leecam, 2014/12/03 21:28:29]

Done.

+#endif
       return Allow();
     default:
       return GpuProcessPolicy::EvaluateSyscall(sysno);
@@ -184,6 +187,9 @@ GpuProcessPolicy::~GpuProcessPolicy() {}
 // Main policy for x86_64/i386. Extended by CrosArmGpuProcessPolicy.
 ResultExpr GpuProcessPolicy::EvaluateSyscall(int sysno) const {
   switch (sysno) {
+#if !defined(OS_CHROMEOS)
+    case __NR_ftruncate:
+#endif
     case __NR_ioctl:
       return Allow();
     case __NR_mincore:
@@ -261,6 +267,7 @@ void GpuProcessPolicy::InitGpuBrokerProcess(
     const std::vector<BrokerFilePermission>& permissions_extra) {
   static const char kDriRcPath[] = "/etc/drirc";
   static const char kDriCard0Path[] = "/dev/dri/card0";
+  static const char kDevShm[] = "/dev/shm/";
 
   CHECK(broker_process_ == NULL);
 
@@ -268,6 +275,10 @@ void GpuProcessPolicy::InitGpuBrokerProcess(
   std::vector<BrokerFilePermission> permissions;
   permissions.push_back(BrokerFilePermission::ReadWrite(kDriCard0Path));
   permissions.push_back(BrokerFilePermission::ReadOnly(kDriRcPath));
+  if (!IsChromeOS()) {
+    permissions.push_back(
+        BrokerFilePermission::ReadWriteCreateUnlinkRecursive(kDevShm));
+  }
 
   // Add eventual extra files from permissions_extra.
   for (const auto& perm : permissions_extra) {