Tweak the GPU process sandbox to allow accelerated video decode.

content/common/sandbox_init_linux.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/public/common/sandbox_init.h"
 
 #if defined(__i386__) || defined(__x86_64__)
 
 // This is an assert for GYP
 #if !defined(OS_LINUX)
   #error "Linux specific file compiled on non Linux OS!"
 #endif
 
 #include <asm/unistd.h>
+#include <dlfcn.h>
 #include <errno.h>
 #include <fcntl.h>
 #include <linux/audit.h>
 #include <linux/filter.h>
 #include <signal.h>
 #include <string.h>
 #include <sys/prctl.h>
 #include <sys/stat.h>
 #include <sys/types.h>
 #include <ucontext.h>
@@ skipping 114 matching lines @@
     case __NR_lstat:
     case __NR_chdir:
     case __NR_mknod:
     case __NR_mknodat:
       return true;
     default:
       return false;
   }
 }
 
+bool IsAcceleratedVideoDecodeEnabled() {

[jln (very slow on Chromium), 2012/07/26 17:53:54]

Any chance that gpu/ could export a function like this instead? It looks like
dangerous code duplication, doesn't it?

[Jorge Lucangeli Obes, 2012/07/26 18:33:36]

The code does not live in gpu/, it lives in
content/renderer/render_view_impl.cc. So I don't think so.

It is duplicated, but the only thing that can change is Linux being enabled, and
we should be informed of that in the linked bug.

[jln (very slow on Chromium), 2012/07/26 19:06:39]

Ok, we don't want to start refactoring code just for this, but could you at
least add a comment in renderer_view_impl.cc around use_accelerated_video_decode
and link to the bug?

+  // Accelerated video decode is currently enabled on Chrome OS,
+  // but not on Linux: crbug.com/137247.
+  bool is_enabled = false;
+#if defined(OS_CHROMEOS)

[jln (very slow on Chromium), 2012/07/26 17:53:54]

Please use IsChromeOS().

[Jorge Lucangeli Obes, 2012/07/26 18:33:36]

Done.

[piman, 2012/07/26 20:33:52]

FYI, IsChromeOS is different from #ifdef OS_CHROMEOS.

IsChromeOS is a run-time "detection" of whether you're running on a chrome OS
device - in practice, if $USER==chronos
OS_CHROMEOS is a compile-time define that's set if chromeos=1 is set in
GYP_DEFINES.
We can, and regularly do (including on bots) run a chromeos=1 build on linux,
where OS_CHROMEOS is defined but IsChromeOS is false. Be sure to take that into
account here.

+  is_enabled = true;
+#endif
+
+  const CommandLine& command_line = *CommandLine::ForCurrentProcess();
+  is_enabled &= !command_line.HasSwitch(

[jln (very slow on Chromium), 2012/07/26 17:53:54]

please, use && here so that we benefit from lazy evaluation.

[Jorge Lucangeli Obes, 2012/07/26 18:33:36]

Done.

+      switches::kDisableAcceleratedVideoDecode);
+
+  return is_enabled;
+}
+
 static const char kDriRcPath[] = "/etc/drirc";
 
 // TODO(jorgelo): limited to /etc/drirc for now, extend this to cover
 // other sandboxed file access cases.
 int OpenWithCache(const char* pathname, int flags) {
   static int drircfd = -1;
   static bool do_open = true;
   int res = -1;
 
   if (strcmp(pathname, kDriRcPath) == 0 && flags == O_RDONLY) {
@@ skipping 104 matching lines @@
     case __NR_getpid:  // Nvidia binary driver.
     case __NR_getppid:  // ATI binary driver.
     case __NR_shutdown:  // Virtual driver.
     case __NR_rt_sigaction:  // Breakpad signal handler.
       return playground2::Sandbox::SB_ALLOWED;
     case __NR_socket:
       return EACCES;  // Nvidia binary driver.
     case __NR_fchmod:
       return EPERM;  // ATI binary driver.
     case __NR_open:
-      // Hook open() in the GPU process to allow opening /etc/drirc,
-      // needed by Mesa.
-      // The hook needs dup(), lseek(), and close() to be allowed.
-      return playground2::Sandbox::ErrorCode(GpuOpenSIGSYS_Handler, NULL);
+      // Accelerated video decode is enabled by default only on Chrome OS.
+      if (IsAcceleratedVideoDecodeEnabled()) {
+        // Accelerated video decode needs to open /dev/dri/card0, and
+        // dup()'ing an already open file descriptor does not work.
+        // Allow open() even though it severely weakens the sandbox,
+        // to test the sandboxing mechanism in general.
+        // TODO(jorgelo): remove this once we solve the libva issue.
+        return playground2::Sandbox::SB_ALLOWED;
+      } else {
+        // Hook open() in the GPU process to allow opening /etc/drirc,
+        // needed by Mesa.
+        // The hook needs dup(), lseek(), and close() to be allowed.
+        return playground2::Sandbox::ErrorCode(GpuOpenSIGSYS_Handler, NULL);
+      }
     default:
       if (IsGettimeSyscall(sysno) ||
           IsKillSyscall(sysno)) { // GPU watchdog.
         return playground2::Sandbox::SB_ALLOWED;
       }
       // Generally, filename-based syscalls will fail with ENOENT to behave
       // similarly to a possible future setuid sandbox.
       if (IsFileSystemSyscall(sysno)) {
         return ENOENT;
       }
@@ skipping 96 matching lines @@
     // TODO(jln) we should not have to do that in a trivial policy.
     return ENOSYS;
   } else {
     return playground2::Sandbox::SB_ALLOWED;
   }
 }
 
 // Warms up/preloads resources needed by the policies.
 void WarmupPolicy(playground2::Sandbox::EvaluateSyscall policy) {
 #if defined(__x86_64__)
-  if (policy == GpuProcessPolicy_x86_64)
+  if (policy == GpuProcessPolicy_x86_64) {
     OpenWithCache(kDriRcPath, O_RDONLY);
+    // Accelerated video decode dlopen()'s this shared object
+    // inside the sandbox, so preload it now.
+    // TODO(jorgelo): generalize this to other platforms.
+    if (IsAcceleratedVideoDecodeEnabled()) {
+      const char kI965DrvVideoPath_64[] =
+          "/usr/lib64/va/drivers/i965_drv_video.so";
+      dlopen(kI965DrvVideoPath_64, RTLD_NOW|RTLD_GLOBAL|RTLD_NODELETE);
+    }
+  }
 #endif
 }
 
 // Is the sandbox fully disabled for this process?
 bool ShouldDisableSandbox(const CommandLine& command_line,
                           const std::string& process_type) {
   if (command_line.HasSwitch(switches::kNoSandbox) ||
       command_line.HasSwitch(switches::kDisableSeccompFilterSandbox)) {
     return true;
   }
@@ skipping 121 matching lines @@
 
 namespace content {
 
 void InitializeSandbox() {
 #if defined(__i386__) || defined(__x86_64__)
   InitializeSandbox_x86();
 #endif
 }
 
 }  // namespace content