Add V4L2 device permissions on x86 CrOS which has ozone flag

content/common/sandbox_linux/bpf_gpu_policy_linux.cc

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/common/sandbox_linux/bpf_gpu_policy_linux.h"
 
 #include <dlfcn.h>
 #include <errno.h>
 #include <fcntl.h>
 #include <sys/socket.h>
@@ skipping 51 matching lines @@
 
 inline bool IsArchitectureI386() {
 #if defined(__i386__)
   return true;
 #else
   return false;
 #endif
 }
 
 inline bool IsArchitectureArm() {
-#if defined(__arm__)
+#if defined(__arm__) || defined(__aarch64__)
   return true;
 #else
   return false;
+#endif
+}
+
+inline bool IsOzone() {
+#if defined(USE_OZONE)
+  return true;
+#else
+  return false;
 #endif
 }
 
 bool IsAcceleratedVideoEnabled() {
   const base::CommandLine& command_line =
       *base::CommandLine::ForCurrentProcess();
   bool accelerated_encode_enabled = false;
 #if defined(OS_CHROMEOS)
   accelerated_encode_enabled =
       !command_line.HasSwitch(switches::kDisableVaapiAcceleratedVideoEncode);
@@ skipping 36 matching lines @@
                                  static_cast<int>(args.args[2]));
       } else {
         return -EPERM;
       }
     default:
       RAW_CHECK(false);
       return -ENOSYS;
   }
 }
 
+std::vector<BrokerFilePermission> GetV4L2GpuWhitelist() {

[wuchengli, 2015/01/05 08:42:44]

Better to pass vector as a function parameter to be consistent with
AddArmGpuWhitelist().

void AddV4L2GpuWhiteList(std::vector<BrokerFilePermission>* permissions)

[henryhsu, 2015/01/05 09:15:30]

Done.

+  std::vector<BrokerFilePermission> permissions;
+  // Device nodes for V4L2 video decode accelerator drivers.
+  static const char kDevVideoDecPath[] = "/dev/video-dec";
+
+  // Device nodes for V4L2 video encode accelerator drivers.
+  static const char kDevVideoEncPath[] = "/dev/video-enc";
+
+  permissions.push_back(BrokerFilePermission::ReadWrite(kDevVideoDecPath));
+  permissions.push_back(BrokerFilePermission::ReadWrite(kDevVideoEncPath));
+  return permissions;
+}
+
 class GpuBrokerProcessPolicy : public GpuProcessPolicy {
  public:
   static sandbox::bpf_dsl::Policy* Create() {
     return new GpuBrokerProcessPolicy();
   }
   ~GpuBrokerProcessPolicy() override {}
 
   ResultExpr EvaluateSyscall(int system_call_number) const override;
 
  private:
@@ skipping 151 matching lines @@
 
   CHECK(broker_process_ == NULL);
 
   // All GPU process policies need these files brokered out.
   std::vector<BrokerFilePermission> permissions;
   permissions.push_back(BrokerFilePermission::ReadWrite(kDriCard0Path));
   permissions.push_back(BrokerFilePermission::ReadOnly(kDriRcPath));
   if (!IsChromeOS()) {
     permissions.push_back(
         BrokerFilePermission::ReadWriteCreateUnlinkRecursive(kDevShm));
+  } else if (IsArchitectureArm() || IsOzone()){

[wuchengli, 2015/01/05 08:42:44]

This is incorrect. From GetGpuProcessSandbox in sandbox_seccomp_bpf_linux.cc,
ARM only calls CrosArmGpuProcessPolicy. I think you need to have
GetV4L2GpuWhitelist in GpuProcessPolicy and CrosArmGpuProcessPolicy can call it.

You can also see GpuProcessPolicy::PreSandboxHook has DCHECK(!chromeos_arm_gpu).

The CL description said it worked on pit. I don't understand why.

[henryhsu, 2015/01/05 09:15:30]

Arm only calls CrosArmGpuProcessPolicy. But it also calls InitGpuBrokerProcess
in CrosArmGpuProcessPolicy::PreSandboxHook. InitGpuBrokerProcess is a class
function of GpuProcessPolicy.

+    std::vector<BrokerFilePermission> v4l2_permissions = GetV4L2GpuWhitelist();
+    for (const auto& perm : v4l2_permissions) {
+      permissions.push_back(perm);
+    }
   }
 
   // Add eventual extra files from permissions_extra.
   for (const auto& perm : permissions_extra) {
     permissions.push_back(perm);
   }
 
   broker_process_ = new BrokerProcess(GetFSDeniedErrno(), permissions);
   // The initialization callback will perform generic initialization and then
   // call broker_sandboxer_callback.
   CHECK(broker_process_->Init(base::Bind(&UpdateProcessTypeAndEnableSandbox,
                                          broker_sandboxer_allocator)));
 }
 
 }  // namespace content