Linux Sandbox: sandbox workers

content/common/sandbox_seccomp_bpf_linux.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <asm/unistd.h>
 #include <dlfcn.h>
 #include <errno.h>
 #include <fcntl.h>
 #include <linux/audit.h>
 #include <linux/filter.h>
@@ skipping 1223 matching lines @@
       }
     default:
       if (IsEventFd(sysno))
         return ErrorCode(ErrorCode::ERR_ALLOWED);
 
       // Default on the baseline policy.
       return BaselinePolicy_x86_64(sysno);
   }
 }
 
-ErrorCode RendererProcessPolicy_x86_64(int sysno) {
+ErrorCode RendererOrWorkerProcessPolicy_x86_64(int sysno) {
   switch (sysno) {
     case __NR_ioctl:  // TODO(jln) investigate legitimate use in the renderer
                       // and see if alternatives can be used.
     case __NR_fdatasync:
     case __NR_fsync:
 #if defined(__i386__) || defined(__x86_64__)
     case __NR_getrlimit:
 #endif
     case __NR_pread64:
     case __NR_pwrite64:
@@ skipping 98 matching lines @@
     else
       return GpuProcessPolicy_x86_64;
   }
 
   if (process_type == switches::kPpapiPluginProcess) {
     // TODO(jln): figure out what to do with non-Flash PPAPI
     // out-of-process plug-ins.
     return FlashProcessPolicy_x86_64;
   }
 
-  if (process_type == switches::kRendererProcess) {
-    return RendererProcessPolicy_x86_64;
+  if (process_type == switches::kRendererProcess ||
+      process_type == switches::kWorkerProcess) {
+    return RendererOrWorkerProcessPolicy_x86_64;
   }
 
-  if (process_type == switches::kWorkerProcess) {
-    return BlacklistDebugAndNumaPolicy;
-  }
   NOTREACHED();
   // This will be our default if we need one.
   return AllowAllPolicy;
 #else
   // On other architectures (currently IA32 or ARM),
   // we only have a small blacklist at the moment.
   (void) process_type;
   return BlacklistDebugAndNumaPolicy;
 #endif  // __x86_64__
 }
@@ skipping 62 matching lines @@
       // Process-specific policy.
       ShouldEnableSeccompBpf(process_type) &&
       SupportsSandbox()) {
     return StartBpfSandbox(command_line, process_type);
   }
 #endif
   return false;
 }
 
 }  // namespace content