| Index: components/nacl/loader/sandbox_linux/nacl_bpf_sandbox_linux.cc
|
| diff --git a/components/nacl/loader/sandbox_linux/nacl_bpf_sandbox_linux.cc b/components/nacl/loader/sandbox_linux/nacl_bpf_sandbox_linux.cc
|
| index e123523de2b0b0444abeceaa83bfb326e1b7aa5d..70d9e5f932b80ce35d65a53423a3095baeffb07c 100644
|
| --- a/components/nacl/loader/sandbox_linux/nacl_bpf_sandbox_linux.cc
|
| +++ b/components/nacl/loader/sandbox_linux/nacl_bpf_sandbox_linux.cc
|
| @@ -44,7 +44,7 @@ bool IsSystemVSharedMemory(int sysno) {
|
| }
|
| #endif
|
|
|
| -#if defined(__i386__)
|
| +#if defined(__i386__) || defined(__mips__)
|
| // Big system V multiplexing system call.
|
| bool IsSystemVIpc(int sysno) {
|
| switch (sysno) {
|
| @@ -76,17 +76,17 @@ ErrorCode NaClBPFSandboxPolicy::EvaluateSyscall(
|
| switch (sysno) {
|
| // TODO(jln): NaCl's GDB debug stub uses the following socket system calls,
|
| // see if it can be restricted a bit.
|
| -#if defined(__x86_64__) || defined(__arm__)
|
| +#if defined(__x86_64__) || defined(__arm__) || defined(__mips__)
|
| // transport_common.cc needs this.
|
| case __NR_accept:
|
| case __NR_setsockopt:
|
| -#elif defined(__i386__)
|
| +#elif defined(__i386__) || defined(__mips__)
|
| case __NR_socketcall:
|
| #endif
|
| // trusted/service_runtime/linux/thread_suspension.c needs sigwait() and is
|
| // used by NaCl's GDB debug stub.
|
| case __NR_rt_sigtimedwait:
|
| -#if defined(__i386__)
|
| +#if defined(__i386__) || defined(__mips__)
|
| // Needed on i386 to set-up the custom segments.
|
| case __NR_modify_ldt:
|
| #endif
|
| @@ -97,7 +97,7 @@ ErrorCode NaClBPFSandboxPolicy::EvaluateSyscall(
|
| // Below is fairly similar to the policy for a Chromium renderer.
|
| // TODO(jln): restrict clone(), ioctl() and prctl().
|
| case __NR_ioctl:
|
| -#if defined(__i386__) || defined(__x86_64__)
|
| +#if defined(__i386__) || defined(__x86_64__) || defined(__mips__)
|
| case __NR_getrlimit:
|
| #endif
|
| #if defined(__i386__) || defined(__arm__)
|
| @@ -133,7 +133,7 @@ ErrorCode NaClBPFSandboxPolicy::EvaluateSyscall(
|
| #if defined(__x86_64__) || defined(__arm__)
|
| if (IsSystemVSharedMemory(sysno))
|
| return ErrorCode(ErrorCode::ERR_ALLOWED);
|
| -#elif defined(__i386__)
|
| +#elif defined(__i386__) || defined(__mips__)
|
| if (IsSystemVIpc(sysno))
|
| return ErrorCode(ErrorCode::ERR_ALLOWED);
|
| #endif
|
| @@ -157,9 +157,7 @@ void RunSandboxSanityChecks() {
|
|
|
| #else
|
|
|
| -#if !defined(ARCH_CPU_MIPS_FAMILY)
|
| #error "Seccomp-bpf disabled on supported architecture!"
|
| -#endif
|
|
|
| #endif // defined(USE_SECCOMP_BPF)
|
|
|
|
|