| OLD | NEW |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include <asm/unistd.h> | 5 #include <asm/unistd.h> |
| 6 #include <dlfcn.h> | 6 #include <dlfcn.h> |
| 7 #include <errno.h> | 7 #include <errno.h> |
| 8 #include <fcntl.h> | 8 #include <fcntl.h> |
| 9 #include <linux/audit.h> | 9 #include <linux/audit.h> |
| 10 #include <linux/filter.h> | 10 #include <linux/filter.h> |
| (...skipping 1391 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 1402 !command_line.HasSwitch(switches::kDisableSeccompFilterSandbox)) { | 1402 !command_line.HasSwitch(switches::kDisableSeccompFilterSandbox)) { |
| 1403 return true; | 1403 return true; |
| 1404 } else { | 1404 } else { |
| 1405 return false; | 1405 return false; |
| 1406 } | 1406 } |
| 1407 } | 1407 } |
| 1408 | 1408 |
| 1409 bool SandboxSeccompBpf::ShouldEnableSeccompBpf( | 1409 bool SandboxSeccompBpf::ShouldEnableSeccompBpf( |
| 1410 const std::string& process_type) { | 1410 const std::string& process_type) { |
| 1411 #if defined(SECCOMP_BPF_SANDBOX) | 1411 #if defined(SECCOMP_BPF_SANDBOX) |
| 1412 #if defined(__arm__) |
| 1413 // We disable the sandbox on ARM for now until crbug.com/148856 is fixed. |
| 1414 return false; |
| 1415 #else |
| 1412 const CommandLine& command_line = *CommandLine::ForCurrentProcess(); | 1416 const CommandLine& command_line = *CommandLine::ForCurrentProcess(); |
| 1413 if (process_type == switches::kGpuProcess) | 1417 if (process_type == switches::kGpuProcess) |
| 1414 return !command_line.HasSwitch(switches::kDisableGpuSandbox); | 1418 return !command_line.HasSwitch(switches::kDisableGpuSandbox); |
| 1415 | 1419 |
| 1416 return true; | 1420 return true; |
| 1417 #endif | 1421 #endif // __arm__ |
| 1422 #endif // process_type |
| 1418 return false; | 1423 return false; |
| 1419 } | 1424 } |
| 1420 | 1425 |
| 1421 bool SandboxSeccompBpf::SupportsSandbox() { | 1426 bool SandboxSeccompBpf::SupportsSandbox() { |
| 1422 #if defined(SECCOMP_BPF_SANDBOX) | 1427 #if defined(SECCOMP_BPF_SANDBOX) |
| 1423 // TODO(jln): pass the saved proc_fd_ from the LinuxSandbox singleton | 1428 // TODO(jln): pass the saved proc_fd_ from the LinuxSandbox singleton |
| 1424 // here. | 1429 // here. |
| 1425 if (Sandbox::supportsSeccompSandbox(-1) == | 1430 if (Sandbox::supportsSeccompSandbox(-1) == |
| 1426 Sandbox::STATUS_AVAILABLE) { | 1431 Sandbox::STATUS_AVAILABLE) { |
| 1427 return true; | 1432 return true; |
| (...skipping 10 matching lines...) Expand all Loading... |
| 1438 // Process-specific policy. | 1443 // Process-specific policy. |
| 1439 ShouldEnableSeccompBpf(process_type) && | 1444 ShouldEnableSeccompBpf(process_type) && |
| 1440 SupportsSandbox()) { | 1445 SupportsSandbox()) { |
| 1441 return StartBpfSandbox(command_line, process_type); | 1446 return StartBpfSandbox(command_line, process_type); |
| 1442 } | 1447 } |
| 1443 #endif | 1448 #endif |
| 1444 return false; | 1449 return false; |
| 1445 } | 1450 } |
| 1446 | 1451 |
| 1447 } // namespace content | 1452 } // namespace content |
| OLD | NEW |