Linux Sandbox: Basic support for GPU broker.

sandbox/linux/services/broker_process.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sandbox/linux/services/broker_process.h"
 
 #include <fcntl.h>
 #include <sys/socket.h>
 #include <sys/stat.h>
 #include <sys/types.h>
@@ skipping 92 matching lines @@
       allowed_w_files_(allowed_w_files),
       ipc_socketpair_(-1) {
 }
 
 BrokerProcess::~BrokerProcess() {
   if (initialized_ && ipc_socketpair_ != -1) {
     void (HANDLE_EINTR(close(ipc_socketpair_)));
   }
 }
 
-bool BrokerProcess::Init(void* sandbox_callback) {
+bool BrokerProcess::Init(bool (*sandbox_callback)(void)) {
   CHECK(!initialized_);
-  CHECK_EQ(sandbox_callback, (void*) NULL) <<
-      "sandbox_callback is not implemented";
   int socket_pair[2];
   // Use SOCK_SEQPACKET, because we need to preserve message boundaries
   // but we also want to be notified (recvmsg should return and not block)
   // when the connection has been broken (one of the processes died).
   if (socketpair(AF_UNIX, SOCK_SEQPACKET, 0, socket_pair)) {
     LOG(ERROR) << "Failed to create socketpair";
     return false;
   }
 
   int child_pid = fork();
@@ skipping 14 matching lines @@
     initialized_ = true;
     return true;
   } else {
     // We are the broker.
     (void) HANDLE_EINTR(close(socket_pair[1]));
     // We should only be able to read from this IPC channel. We will send our
     // replies on a new file descriptor attached to the requests.
     shutdown(socket_pair[0], SHUT_WR);
     ipc_socketpair_ = socket_pair[0];
     is_child_ = true;
-    // TODO(jln): activate a sandbox here.
+    // Enable the sandbox if provided.
+    if (sandbox_callback) {
+      CHECK(sandbox_callback());
+    }
     initialized_ = true;
     for (;;) {
       HandleRequest();
     }
     _exit(1);
   }
   NOTREACHED();
 }
 
 // This function needs to be async signal safe.
@@ skipping 179 matching lines @@
           GetFileNameInWhitelist(allowed_w_files_, requested_filename,
                                  file_to_open);
       return allowed_for_read_and_write;
     }
     default:
       return false;
   }
 }
 
 }  // namespace sandbox.