content: bpf: exclude the syscalls if arm64

content/common/sandbox_linux/bpf_gpu_policy_linux.cc

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/common/sandbox_linux/bpf_gpu_policy_linux.h"
 
 #include <dlfcn.h>
 #include <errno.h>
 #include <fcntl.h>
 #include <sys/socket.h>
@@ skipping 76 matching lines @@
   return !command_line.HasSwitch(switches::kDisableAcceleratedVideoDecode) ||
          accelerated_encode_enabled;
 }
 
 intptr_t GpuSIGSYS_Handler(const struct arch_seccomp_data& args,
                            void* aux_broker_process) {
   RAW_CHECK(aux_broker_process);
   BrokerProcess* broker_process =
       static_cast<BrokerProcess*>(aux_broker_process);
   switch (args.nr) {
+#if !defined(__aarch64__)
     case __NR_access:
       return broker_process->Access(reinterpret_cast<const char*>(args.args[0]),
                                     static_cast<int>(args.args[1]));
     case __NR_open:
 #if defined(MEMORY_SANITIZER)
       // http://crbug.com/372840
       __msan_unpoison_string(reinterpret_cast<const char*>(args.args[0]));
 #endif
       return broker_process->Open(reinterpret_cast<const char*>(args.args[0]),
                                   static_cast<int>(args.args[1]));
+#endif // !defined(__aarch64__)
     case __NR_openat:
       // Allow using openat() as open().
       if (static_cast<int>(args.args[0]) == AT_FDCWD) {
         return
             broker_process->Open(reinterpret_cast<const char*>(args.args[1]),
                                  static_cast<int>(args.args[2]));
       } else {
         return -EPERM;
       }
     default:
@@ skipping 14 matching lines @@
  private:
   GpuBrokerProcessPolicy() {}
   DISALLOW_COPY_AND_ASSIGN(GpuBrokerProcessPolicy);
 };
 
 // x86_64/i386 or desktop ARM.
 // A GPU broker policy is the same as a GPU policy with open and
 // openat allowed.
 ResultExpr GpuBrokerProcessPolicy::EvaluateSyscall(int sysno) const {
   switch (sysno) {
+#if !defined(__aarch64__)
     case __NR_access:
     case __NR_open:
+#endif // !defined(__aarch64__)
     case __NR_openat:
       return Allow();
     default:
       return GpuProcessPolicy::EvaluateSyscall(sysno);
   }
 }
 
 void UpdateProcessTypeToGpuBroker() {
   base::CommandLine::StringVector exec =
       base::CommandLine::ForCurrentProcess()->GetArgs();
@@ skipping 32 matching lines @@
 ResultExpr GpuProcessPolicy::EvaluateSyscall(int sysno) const {
   switch (sysno) {
     case __NR_ioctl:
       return Allow();
     case __NR_mincore:
       if (allow_mincore_) {
         return Allow();
       } else {
         return SandboxBPFBasePolicy::EvaluateSyscall(sysno);
       }
-#if defined(__i386__) || defined(__x86_64__) || defined(__mips__)
+#if defined(__i386__) || defined(__x86_64__) || defined(__mips__) \
+    || defined(__aarch64__)

[mdempsky, 2014/12/07 03:46:40]

Is this actually required?  The comment suggests this should be x86 specific,
which makes me think even the __mips__ presence is superfluous.

[cometzero, 2014/12/07 06:47:38]

You're right. I'll remove this inclusion on aarch64.

     // The Nvidia driver uses flags not in the baseline policy
     // (MAP_LOCKED | MAP_EXECUTABLE | MAP_32BIT)
     case __NR_mmap:
 #endif
     // We also hit this on the linux_chromeos bot but don't yet know what
     // weird flags were involved.
     case __NR_mprotect:
     // TODO(jln): restrict prctl.
     case __NR_prctl:
       return Allow();
+#if !defined(__aarch64__)
     case __NR_access:
     case __NR_open:
+#endif // !defined(__aarch64__)
     case __NR_openat:
       DCHECK(broker_process_);
       return Trap(GpuSIGSYS_Handler, broker_process_);
     case __NR_setpriority:
       return sandbox::RestrictGetSetpriority(GetPolicyPid());
     case __NR_sched_getaffinity:
     case __NR_sched_setaffinity:
       return sandbox::RestrictSchedTarget(GetPolicyPid(), sysno);
     default:
       if (SyscallSets::IsEventFd(sysno))
@@ skipping 57 matching lines @@
   }
 
   broker_process_ = new BrokerProcess(GetFSDeniedErrno(), permissions);
   // The initialization callback will perform generic initialization and then
   // call broker_sandboxer_callback.
   CHECK(broker_process_->Init(base::Bind(&UpdateProcessTypeAndEnableSandbox,
                                          broker_sandboxer_allocator)));
 }
 
 }  // namespace content