OLD | NEW |
---|---|
1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "content/common/sandbox_linux/bpf_gpu_policy_linux.h" | 5 #include "content/common/sandbox_linux/bpf_gpu_policy_linux.h" |
6 | 6 |
7 #include <dlfcn.h> | 7 #include <dlfcn.h> |
8 #include <errno.h> | 8 #include <errno.h> |
9 #include <fcntl.h> | 9 #include <fcntl.h> |
10 #include <sys/socket.h> | 10 #include <sys/socket.h> |
(...skipping 10 matching lines...) Expand all Loading... | |
21 #include "base/logging.h" | 21 #include "base/logging.h" |
22 #include "base/memory/scoped_ptr.h" | 22 #include "base/memory/scoped_ptr.h" |
23 #include "build/build_config.h" | 23 #include "build/build_config.h" |
24 #include "content/common/sandbox_linux/sandbox_bpf_base_policy_linux.h" | 24 #include "content/common/sandbox_linux/sandbox_bpf_base_policy_linux.h" |
25 #include "content/common/sandbox_linux/sandbox_seccomp_bpf_linux.h" | 25 #include "content/common/sandbox_linux/sandbox_seccomp_bpf_linux.h" |
26 #include "content/common/set_process_title.h" | 26 #include "content/common/set_process_title.h" |
27 #include "content/public/common/content_switches.h" | 27 #include "content/public/common/content_switches.h" |
28 #include "sandbox/linux/seccomp-bpf-helpers/syscall_sets.h" | 28 #include "sandbox/linux/seccomp-bpf-helpers/syscall_sets.h" |
29 #include "sandbox/linux/seccomp-bpf/sandbox_bpf.h" | 29 #include "sandbox/linux/seccomp-bpf/sandbox_bpf.h" |
30 #include "sandbox/linux/services/broker_process.h" | 30 #include "sandbox/linux/services/broker_process.h" |
31 #include "sandbox/linux/services/kernel_to_errno.h" | |
31 #include "sandbox/linux/services/linux_syscalls.h" | 32 #include "sandbox/linux/services/linux_syscalls.h" |
32 | 33 |
33 using sandbox::BrokerProcess; | 34 using sandbox::BrokerProcess; |
34 using sandbox::ErrorCode; | 35 using sandbox::ErrorCode; |
35 using sandbox::SandboxBPF; | 36 using sandbox::SandboxBPF; |
36 using sandbox::SyscallSets; | 37 using sandbox::SyscallSets; |
37 using sandbox::arch_seccomp_data; | 38 using sandbox::arch_seccomp_data; |
38 | 39 |
39 namespace content { | 40 namespace content { |
40 | 41 |
(...skipping 48 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
89 case __NR_open: | 90 case __NR_open: |
90 return broker_process->Open(reinterpret_cast<const char*>(args.args[0]), | 91 return broker_process->Open(reinterpret_cast<const char*>(args.args[0]), |
91 static_cast<int>(args.args[1])); | 92 static_cast<int>(args.args[1])); |
92 case __NR_openat: | 93 case __NR_openat: |
93 // Allow using openat() as open(). | 94 // Allow using openat() as open(). |
94 if (static_cast<int>(args.args[0]) == AT_FDCWD) { | 95 if (static_cast<int>(args.args[0]) == AT_FDCWD) { |
95 return | 96 return |
96 broker_process->Open(reinterpret_cast<const char*>(args.args[1]), | 97 broker_process->Open(reinterpret_cast<const char*>(args.args[1]), |
97 static_cast<int>(args.args[2])); | 98 static_cast<int>(args.args[2])); |
98 } else { | 99 } else { |
99 return -EPERM; | 100 return KernelRetToErrno(EPERM); |
jln (very slow on Chromium)
2014/05/16 19:30:17
This function is misnamed in this context. EPERM i
nedeljko
2014/05/22 17:38:55
Done.
| |
100 } | 101 } |
101 default: | 102 default: |
102 RAW_CHECK(false); | 103 RAW_CHECK(false); |
103 return -ENOSYS; | 104 return KernelRetToErrno(ENOSYS); |
104 } | 105 } |
105 } | 106 } |
106 | 107 |
107 class GpuBrokerProcessPolicy : public GpuProcessPolicy { | 108 class GpuBrokerProcessPolicy : public GpuProcessPolicy { |
108 public: | 109 public: |
109 static sandbox::SandboxBPFPolicy* Create() { | 110 static sandbox::SandboxBPFPolicy* Create() { |
110 return new GpuBrokerProcessPolicy(); | 111 return new GpuBrokerProcessPolicy(); |
111 } | 112 } |
112 virtual ~GpuBrokerProcessPolicy() {} | 113 virtual ~GpuBrokerProcessPolicy() {} |
113 | 114 |
(...skipping 46 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
160 | 161 |
161 GpuProcessPolicy::GpuProcessPolicy() : broker_process_(NULL) {} | 162 GpuProcessPolicy::GpuProcessPolicy() : broker_process_(NULL) {} |
162 | 163 |
163 GpuProcessPolicy::~GpuProcessPolicy() {} | 164 GpuProcessPolicy::~GpuProcessPolicy() {} |
164 | 165 |
165 // Main policy for x86_64/i386. Extended by CrosArmGpuProcessPolicy. | 166 // Main policy for x86_64/i386. Extended by CrosArmGpuProcessPolicy. |
166 ErrorCode GpuProcessPolicy::EvaluateSyscall(SandboxBPF* sandbox, | 167 ErrorCode GpuProcessPolicy::EvaluateSyscall(SandboxBPF* sandbox, |
167 int sysno) const { | 168 int sysno) const { |
168 switch (sysno) { | 169 switch (sysno) { |
169 case __NR_ioctl: | 170 case __NR_ioctl: |
170 #if defined(__i386__) || defined(__x86_64__) | 171 #if defined(__i386__) || defined(__x86_64__) || defined(__mips__) |
171 // The Nvidia driver uses flags not in the baseline policy | 172 // The Nvidia driver uses flags not in the baseline policy |
172 // (MAP_LOCKED | MAP_EXECUTABLE | MAP_32BIT) | 173 // (MAP_LOCKED | MAP_EXECUTABLE | MAP_32BIT) |
173 case __NR_mmap: | 174 case __NR_mmap: |
174 #endif | 175 #endif |
175 // We also hit this on the linux_chromeos bot but don't yet know what | 176 // We also hit this on the linux_chromeos bot but don't yet know what |
176 // weird flags were involved. | 177 // weird flags were involved. |
177 case __NR_mprotect: | 178 case __NR_mprotect: |
178 case __NR_sched_getaffinity: | 179 case __NR_sched_getaffinity: |
179 case __NR_sched_setaffinity: | 180 case __NR_sched_setaffinity: |
180 case __NR_setpriority: | 181 case __NR_setpriority: |
(...skipping 75 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
256 broker_process_ = new BrokerProcess(GetFSDeniedErrno(), | 257 broker_process_ = new BrokerProcess(GetFSDeniedErrno(), |
257 read_whitelist, | 258 read_whitelist, |
258 write_whitelist); | 259 write_whitelist); |
259 // The initialization callback will perform generic initialization and then | 260 // The initialization callback will perform generic initialization and then |
260 // call broker_sandboxer_callback. | 261 // call broker_sandboxer_callback. |
261 CHECK(broker_process_->Init(base::Bind(&UpdateProcessTypeAndEnableSandbox, | 262 CHECK(broker_process_->Init(base::Bind(&UpdateProcessTypeAndEnableSandbox, |
262 broker_sandboxer_allocator))); | 263 broker_sandboxer_allocator))); |
263 } | 264 } |
264 | 265 |
265 } // namespace content | 266 } // namespace content |
OLD | NEW |