Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(5)

Side by Side Diff: content/common/sandbox_linux/bpf_gpu_policy_linux.h

Issue 701443004: Linux sandbox: change the return type of HandleRequest (Closed) Base URL: https://chromium.googlesource.com/chromium/src.git@master
Patch Set: Add blank line in header file. Created 6 years, 1 month ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
« no previous file with comments | « no previous file | content/common/sandbox_linux/bpf_gpu_policy_linux.cc » ('j') | no next file with comments »
Toggle Intra-line Diffs ('i') | Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
OLDNEW
1 // Copyright 2013 The Chromium Authors. All rights reserved. 1 // Copyright 2013 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be 2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file. 3 // found in the LICENSE file.
4 4
5 #ifndef CONTENT_COMMON_SANDBOX_LINUX_BPF_GPU_POLICY_LINUX_H_ 5 #ifndef CONTENT_COMMON_SANDBOX_LINUX_BPF_GPU_POLICY_LINUX_H_
6 #define CONTENT_COMMON_SANDBOX_LINUX_BPF_GPU_POLICY_LINUX_H_ 6 #define CONTENT_COMMON_SANDBOX_LINUX_BPF_GPU_POLICY_LINUX_H_
7 7
8 #include <string> 8 #include <string>
9 #include <vector> 9 #include <vector>
10 10
11 #include "base/callback_forward.h" 11 #include "base/callback_forward.h"
12 #include "content/common/sandbox_linux/sandbox_bpf_base_policy_linux.h" 12 #include "content/common/sandbox_linux/sandbox_bpf_base_policy_linux.h"
13 13
14 namespace sandbox { 14 namespace sandbox {
15 namespace syscall_broker {
15 class BrokerProcess; 16 class BrokerProcess;
16 } 17 }
18 }
17 19
18 namespace content { 20 namespace content {
19 21
20 class GpuProcessPolicy : public SandboxBPFBasePolicy { 22 class GpuProcessPolicy : public SandboxBPFBasePolicy {
21 public: 23 public:
22 GpuProcessPolicy(); 24 GpuProcessPolicy();
23 explicit GpuProcessPolicy(bool allow_mincore); 25 explicit GpuProcessPolicy(bool allow_mincore);
24 ~GpuProcessPolicy() override; 26 ~GpuProcessPolicy() override;
25 27
26 sandbox::bpf_dsl::ResultExpr EvaluateSyscall( 28 sandbox::bpf_dsl::ResultExpr EvaluateSyscall(
27 int system_call_number) const override; 29 int system_call_number) const override;
28 30
29 bool PreSandboxHook() override; 31 bool PreSandboxHook() override;
30 32
31 protected: 33 protected:
32 // Start a broker process to handle open() inside the sandbox. 34 // Start a broker process to handle open() inside the sandbox.
33 // |broker_sandboxer_allocator| is a function pointer which can allocate a 35 // |broker_sandboxer_allocator| is a function pointer which can allocate a
34 // suitable sandbox policy for the broker process itself. 36 // suitable sandbox policy for the broker process itself.
35 // |read_whitelist_extra| and |write_whitelist_extra| are lists of file 37 // |read_whitelist_extra| and |write_whitelist_extra| are lists of file
36 // names that should be whitelisted by the broker process, in addition to 38 // names that should be whitelisted by the broker process, in addition to
37 // the basic ones. 39 // the basic ones.
38 void InitGpuBrokerProcess( 40 void InitGpuBrokerProcess(
39 sandbox::bpf_dsl::Policy* (*broker_sandboxer_allocator)(void), 41 sandbox::bpf_dsl::Policy* (*broker_sandboxer_allocator)(void),
40 const std::vector<std::string>& read_whitelist_extra, 42 const std::vector<std::string>& read_whitelist_extra,
41 const std::vector<std::string>& write_whitelist_extra); 43 const std::vector<std::string>& write_whitelist_extra);
42 44
43 sandbox::BrokerProcess* broker_process() { return broker_process_; } 45 sandbox::syscall_broker::BrokerProcess* broker_process() {
46 return broker_process_;
47 }
44 48
45 private: 49 private:
46 // A BrokerProcess is a helper that is started before the sandbox is engaged 50 // A BrokerProcess is a helper that is started before the sandbox is engaged
47 // and will serve requests to access files over an IPC channel. The client of 51 // and will serve requests to access files over an IPC channel. The client of
48 // this runs from a SIGSYS handler triggered by the seccomp-bpf sandbox. 52 // this runs from a SIGSYS handler triggered by the seccomp-bpf sandbox.
49 // This should never be destroyed, as after the sandbox is started it is 53 // This should never be destroyed, as after the sandbox is started it is
50 // vital to the process. 54 // vital to the process.
51 // This is allocated by InitGpuBrokerProcess, called from PreSandboxHook(), 55 // This is allocated by InitGpuBrokerProcess, called from PreSandboxHook(),
52 // which executes iff the sandbox is going to be enabled afterwards. 56 // which executes iff the sandbox is going to be enabled afterwards.
53 sandbox::BrokerProcess* broker_process_; 57 sandbox::syscall_broker::BrokerProcess* broker_process_;
54 58
55 // eglCreateWindowSurface() needs mincore(). 59 // eglCreateWindowSurface() needs mincore().
56 bool allow_mincore_; 60 bool allow_mincore_;
57 61
58 DISALLOW_COPY_AND_ASSIGN(GpuProcessPolicy); 62 DISALLOW_COPY_AND_ASSIGN(GpuProcessPolicy);
59 }; 63 };
60 64
61 } // namespace content 65 } // namespace content
62 66
63 #endif // CONTENT_COMMON_SANDBOX_LINUX_BPF_GPU_POLICY_LINUX_H_ 67 #endif // CONTENT_COMMON_SANDBOX_LINUX_BPF_GPU_POLICY_LINUX_H_
OLDNEW
« no previous file with comments | « no previous file | content/common/sandbox_linux/bpf_gpu_policy_linux.cc » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698