Linux Sandbox: sandbox workers

Linux Sandbox: sandbox workers

We sandbox workers with the same policy as the renderers within the
seccomp-bpf sandbox.

BUG=145327
NOTRY=true

Committed: http://src.chromium.org/viewvc/chrome?view=rev&revision=154521

[jln (very slow on Chromium), 2012-08-31 21:14:58]

We sandbox workers with the same policy that we use for general renderer
processes.

All Worker tests pass correctly with the new sandbox.

[cevans, 2012-08-31 21:15:37]

LGTM

On Fri, Aug 31, 2012 at 2:14 PM, <jln@chromium.org> wrote:

> Reviewers: Markus (顧孟勤), Chris Evans, Jorge Lucangeli Obes,
>
> Message:
> We sandbox workers with the same policy that we use for general renderer
> processes.
>
> All Worker tests pass correctly with the new sandbox.
>
> Description:
> Linux Sandbox: sandbox workers
>
> We sandbox workers with the same policy as the renderers within the
> seccomp-bpf sandbox.
>
> BUG=145327
>
>
> Please review this at
https://chromiumcodereview.**appspot.com/10907035/<https://chromiumcodereview...
>
> SVN Base:
svn://svn.chromium.org/chrome/**trunk/src<http://svn.chromium.org/chrome/trunk/src>
>
> Affected files:
>   M content/common/sandbox_**seccomp_bpf_linux.cc
>
>
> Index: content/common/sandbox_**seccomp_bpf_linux.cc
> diff --git a/content/common/sandbox_**seccomp_bpf_linux.cc
> b/content/common/sandbox_**seccomp_bpf_linux.cc
> index 0c2c07988eb6709ca427bc09b02a72**dc72f27f58..**
> cf05af715153dd68890ea28278cb0e**b78b25b30a 100644
> --- a/content/common/sandbox_**seccomp_bpf_linux.cc
> +++ b/content/common/sandbox_**seccomp_bpf_linux.cc
> @@ -1237,7 +1237,8 @@ playground2::Sandbox::**ErrorCode
> GpuProcessPolicy_x86_64(int sysno) {
>    }
>  }
>
> -playground2::Sandbox::**ErrorCode RendererProcessPolicy_x86_64(**int
> sysno) {
> +playground2::Sandbox::**ErrorCode RendererOrWorkerProcessPolicy_**x86_64(
> +    int sysno) {
>    switch (sysno) {
>      case __NR_ioctl:  // TODO(jln) investigate legitimate use in the
> renderer
>                        // and see if alternatives can be used.
> @@ -1356,13 +1357,11 @@ playground2::Sandbox::**EvaluateSyscall
> GetProcessSyscallPolicy(
>      return FlashProcessPolicy_x86_64;
>    }
>
> -  if (process_type == switches::kRendererProcess) {
> -    return RendererProcessPolicy_x86_64;
> +  if (process_type == switches::kRendererProcess ||
> +      process_type == switches::kWorkerProcess) {
> +    return RendererOrWorkerProcessPolicy_**x86_64;
>    }
>
> -  if (process_type == switches::kWorkerProcess) {
> -    return BlacklistDebugAndNumaPolicy;
> -  }
>    NOTREACHED();
>    // This will be our default if we need one.
>    return AllowAllPolicy;
>
>
>

[Markus (顧孟勤), 2012-08-31 22:00:49]

Nice :-) Go for it. LGTM

On Fri, Aug 31, 2012 at 2:15 PM, Chris Evans <cevans@google.com> wrote:

> LGTM
>
>
> On Fri, Aug 31, 2012 at 2:14 PM, <jln@chromium.org> wrote:
>
>> Reviewers: Markus (顧孟勤), Chris Evans, Jorge Lucangeli Obes,
>>
>> Message:
>> We sandbox workers with the same policy that we use for general renderer
>> processes.
>>
>> All Worker tests pass correctly with the new sandbox.
>>
>> Description:
>> Linux Sandbox: sandbox workers
>>
>> We sandbox workers with the same policy as the renderers within the
>> seccomp-bpf sandbox.
>>
>> BUG=145327
>>
>>
>> Please review this at
https://chromiumcodereview.**appspot.com/10907035/<https://chromiumcodereview...
>>
>> SVN Base:
svn://svn.chromium.org/chrome/**trunk/src<http://svn.chromium.org/chrome/trunk/src>
>>
>> Affected files:
>>   M content/common/sandbox_**seccomp_bpf_linux.cc
>>
>>
>> Index: content/common/sandbox_**seccomp_bpf_linux.cc
>> diff --git a/content/common/sandbox_**seccomp_bpf_linux.cc
>> b/content/common/sandbox_**seccomp_bpf_linux.cc
>> index 0c2c07988eb6709ca427bc09b02a72**dc72f27f58..**
>> cf05af715153dd68890ea28278cb0e**b78b25b30a 100644
>> --- a/content/common/sandbox_**seccomp_bpf_linux.cc
>> +++ b/content/common/sandbox_**seccomp_bpf_linux.cc
>> @@ -1237,7 +1237,8 @@ playground2::Sandbox::**ErrorCode
>> GpuProcessPolicy_x86_64(int sysno) {
>>    }
>>  }
>>
>> -playground2::Sandbox::**ErrorCode RendererProcessPolicy_x86_64(**int
>> sysno) {
>> +playground2::Sandbox::**ErrorCode RendererOrWorkerProcessPolicy_**
>> x86_64(
>> +    int sysno) {
>>    switch (sysno) {
>>      case __NR_ioctl:  // TODO(jln) investigate legitimate use in the
>> renderer
>>                        // and see if alternatives can be used.
>> @@ -1356,13 +1357,11 @@ playground2::Sandbox::**EvaluateSyscall
>> GetProcessSyscallPolicy(
>>      return FlashProcessPolicy_x86_64;
>>    }
>>
>> -  if (process_type == switches::kRendererProcess) {
>> -    return RendererProcessPolicy_x86_64;
>> +  if (process_type == switches::kRendererProcess ||
>> +      process_type == switches::kWorkerProcess) {
>> +    return RendererOrWorkerProcessPolicy_**x86_64;
>>    }
>>
>> -  if (process_type == switches::kWorkerProcess) {
>> -    return BlacklistDebugAndNumaPolicy;
>> -  }
>>    NOTREACHED();
>>    // This will be our default if we need one.
>>    return AllowAllPolicy;
>>
>>
>>
>

[Jorge Lucangeli Obes, 2012-08-31 22:02:53]

lgtm

FWIW, the linux_chromeos failure appears to be a flaky test, I saw it go by in
#chromium a couple of times.

[commit-bot: I haz the power, 2012-08-31 22:15:09]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/jln@chromium.org/10907035/1003

[commit-bot: I haz the power, 2012-08-31 22:16:24]

Change committed as 154521