OLD | NEW |
1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "content/common/sandbox_linux/bpf_gpu_policy_linux.h" | 5 #include "content/common/sandbox_linux/bpf_gpu_policy_linux.h" |
6 | 6 |
7 #include <dlfcn.h> | 7 #include <dlfcn.h> |
8 #include <errno.h> | 8 #include <errno.h> |
9 #include <fcntl.h> | 9 #include <fcntl.h> |
10 #include <sys/socket.h> | 10 #include <sys/socket.h> |
(...skipping 159 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
170 | 170 |
171 GpuProcessPolicy::GpuProcessPolicy() : broker_process_(NULL) {} | 171 GpuProcessPolicy::GpuProcessPolicy() : broker_process_(NULL) {} |
172 | 172 |
173 GpuProcessPolicy::~GpuProcessPolicy() {} | 173 GpuProcessPolicy::~GpuProcessPolicy() {} |
174 | 174 |
175 // Main policy for x86_64/i386. Extended by CrosArmGpuProcessPolicy. | 175 // Main policy for x86_64/i386. Extended by CrosArmGpuProcessPolicy. |
176 ErrorCode GpuProcessPolicy::EvaluateSyscall(SandboxBPF* sandbox, | 176 ErrorCode GpuProcessPolicy::EvaluateSyscall(SandboxBPF* sandbox, |
177 int sysno) const { | 177 int sysno) const { |
178 switch (sysno) { | 178 switch (sysno) { |
179 case __NR_ioctl: | 179 case __NR_ioctl: |
180 #if defined(__i386__) || defined(__x86_64__) | 180 #if defined(__i386__) || defined(__x86_64__) || defined(__mips__) |
181 // The Nvidia driver uses flags not in the baseline policy | 181 // The Nvidia driver uses flags not in the baseline policy |
182 // (MAP_LOCKED | MAP_EXECUTABLE | MAP_32BIT) | 182 // (MAP_LOCKED | MAP_EXECUTABLE | MAP_32BIT) |
183 case __NR_mmap: | 183 case __NR_mmap: |
184 #endif | 184 #endif |
185 // We also hit this on the linux_chromeos bot but don't yet know what | 185 // We also hit this on the linux_chromeos bot but don't yet know what |
186 // weird flags were involved. | 186 // weird flags were involved. |
187 case __NR_mprotect: | 187 case __NR_mprotect: |
188 // TODO(jln): restrict prctl. | 188 // TODO(jln): restrict prctl. |
189 case __NR_prctl: | 189 case __NR_prctl: |
190 case __NR_sched_getaffinity: | 190 case __NR_sched_getaffinity: |
(...skipping 77 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
268 broker_process_ = new BrokerProcess(GetFSDeniedErrno(), | 268 broker_process_ = new BrokerProcess(GetFSDeniedErrno(), |
269 read_whitelist, | 269 read_whitelist, |
270 write_whitelist); | 270 write_whitelist); |
271 // The initialization callback will perform generic initialization and then | 271 // The initialization callback will perform generic initialization and then |
272 // call broker_sandboxer_callback. | 272 // call broker_sandboxer_callback. |
273 CHECK(broker_process_->Init(base::Bind(&UpdateProcessTypeAndEnableSandbox, | 273 CHECK(broker_process_->Init(base::Bind(&UpdateProcessTypeAndEnableSandbox, |
274 broker_sandboxer_allocator))); | 274 broker_sandboxer_allocator))); |
275 } | 275 } |
276 | 276 |
277 } // namespace content | 277 } // namespace content |
OLD | NEW |