content: bpf: exclude the syscalls if arm64

content/common/sandbox_linux/bpf_cros_arm_gpu_policy_linux.cc

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/common/sandbox_linux/bpf_cros_arm_gpu_policy_linux.h"
 
 #include <dlfcn.h>
 #include <errno.h>
 #include <fcntl.h>
 #include <sys/socket.h>
@@ skipping 90 matching lines @@
 
  private:
   CrosArmGpuBrokerProcessPolicy() : CrosArmGpuProcessPolicy(false) {}
   DISALLOW_COPY_AND_ASSIGN(CrosArmGpuBrokerProcessPolicy);
 };
 
 // A GPU broker policy is the same as a GPU policy with open and
 // openat allowed.
 ResultExpr CrosArmGpuBrokerProcessPolicy::EvaluateSyscall(int sysno) const {
   switch (sysno) {
+#if !defined(aarch64)
     case __NR_access:

[mdempsky, 2014/12/07 03:46:40]

Do we need to allow __NR_accessat or something else?

[cometzero, 2014/12/07 06:47:38]

Hmm. There is no __NR_access on the arm64. Maybe __NR_faccessat can be used
instead of it.

[leecam, 2014/12/07 17:08:24]

Yep __NR_faccessat is the replacement for __NR_access.
In sandbox/linux/syscall_broker/broker_host.cc you'll see a sys_open function
that wraps 'open' so we ensure we directly call __NR_openat. It might be worth
doing something similar for __NR_access and explicitly calling the faccessat
syscall then only allowing that in the policy. That should work across all of
our supported architectures.

     case __NR_open:
+#endif // !defined(aarch64)
     case __NR_openat:
       return Allow();
     default:
       return CrosArmGpuProcessPolicy::EvaluateSyscall(sysno);
   }
 }
 
 }  // namespace
 
 CrosArmGpuProcessPolicy::CrosArmGpuProcessPolicy(bool allow_shmat)
@@ skipping 48 matching lines @@
   // Preload the Tegra V4L2 (video decode acceleration) library.
   dlopen("/usr/lib/libtegrav4l2.so", dlopen_flag);
   // Resetting errno since platform-specific libraries will fail on other
   // platforms.
   errno = 0;
 
   return true;
 }
 
 }  // namespace content