diff options
| author | cevans@chromium.org <cevans@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2012-04-20 20:32:35 +0000 |
|---|---|---|
| committer | cevans@chromium.org <cevans@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2012-04-20 20:32:35 +0000 |
| commit | df1ca36c8857b066a6a593b2009541528de2a071 (patch) | |
| tree | 8757adbbcd5ff9fd3cbf29cd9fd1025f0b10ea03 /content/common/sandbox_init_linux.cc | |
| parent | c53bff6f39a8e27a5cb7cde0c1aeb7cc3ec762ee (diff) | |
| download | chromium_src-df1ca36c8857b066a6a593b2009541528de2a071.zip chromium_src-df1ca36c8857b066a6a593b2009541528de2a071.tar.gz chromium_src-df1ca36c8857b066a6a593b2009541528de2a071.tar.bz2 | |
Allow kill(self) for the GPU watchdog.
TBR=jorgelo
Review URL: https://chromiumcodereview.appspot.com/10165009
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@133256 0039d316-1c4b-4281-b951-d872f2087c98
Diffstat (limited to 'content/common/sandbox_init_linux.cc')
| -rw-r--r-- | content/common/sandbox_init_linux.cc | 40 |
1 files changed, 34 insertions, 6 deletions
diff --git a/content/common/sandbox_init_linux.cc b/content/common/sandbox_init_linux.cc index b44034f..8805d72 100644 --- a/content/common/sandbox_init_linux.cc +++ b/content/common/sandbox_init_linux.cc @@ -106,6 +106,12 @@ static void EmitLoad(int offset, std::vector<struct sock_filter>* program) { program->push_back(filter); } +static void EmitLoadArg(int arg, std::vector<struct sock_filter>* program) { + // Each argument is 8 bytes, independent of architecture, and start at + // an offset of 16 bytes, indepdendent of architecture. + EmitLoad(((arg - 1) * 8) + 16, program); +} + static void EmitJEQJT1(int value, std::vector<struct sock_filter>* program) { struct sock_filter filter; filter.code = BPF_JMP+BPF_JEQ+BPF_K; @@ -115,11 +121,13 @@ static void EmitJEQJT1(int value, std::vector<struct sock_filter>* program) { program->push_back(filter); } -static void EmitJEQJF1(int value, std::vector<struct sock_filter>* program) { +static void EmitJEQJF(int value, + int jf, + std::vector<struct sock_filter>* program) { struct sock_filter filter; filter.code = BPF_JMP+BPF_JEQ+BPF_K; filter.jt = 0; - filter.jf = 1; + filter.jf = jf; filter.k = value; program->push_back(filter); } @@ -146,13 +154,27 @@ static void EmitPreamble(std::vector<struct sock_filter>* program) { } static void EmitAllowSyscall(int nr, std::vector<struct sock_filter>* program) { - EmitJEQJF1(nr, program); + EmitJEQJF(nr, 1, program); + EmitRet(SECCOMP_RET_ALLOW, program); +} + +static void EmitAllowSyscallArgN(int nr, + int arg_nr, + int arg_val, + std::vector<struct sock_filter>* program) { + // Jump forward 4 on no-match so that we also skip the unneccessary reload of + // syscall_nr. (It is unneccessary because we have not trashed it yet.) + EmitJEQJF(nr, 4, program); + EmitLoadArg(arg_nr, program); + EmitJEQJF(arg_val, 1, program); EmitRet(SECCOMP_RET_ALLOW, program); + // We trashed syscall_nr so put it back in the accumulator. + EmitLoad(0, program); } static void EmitFailSyscall(int nr, int err, std::vector<struct sock_filter>* program) { - EmitJEQJF1(nr, program); + EmitJEQJF(nr, 1, program); EmitRet(SECCOMP_RET_ERRNO | err, program); } @@ -160,6 +182,11 @@ static void EmitTrap(std::vector<struct sock_filter>* program) { EmitRet(SECCOMP_RET_TRAP, program); } +static void EmitAllowKillSelf(int signal, + std::vector<struct sock_filter>* program) { + EmitAllowSyscallArgN(__NR_kill, 2, signal, program); +} + static void ApplyGPUPolicy(std::vector<struct sock_filter>* program) { // "Hot" syscalls go first. EmitAllowSyscall(__NR_read, program); @@ -203,8 +230,9 @@ static void ApplyGPUPolicy(std::vector<struct sock_filter>* program) { EmitAllowSyscall(__NR_munlock, program); EmitAllowSyscall(__NR_exit, program); EmitAllowSyscall(__NR_exit_group, program); - EmitAllowSyscall(__NR_getpid, program); - EmitAllowSyscall(__NR_getppid, program); + EmitAllowSyscall(__NR_getpid, program); // Seen in Nvidia binary driver. + EmitAllowSyscall(__NR_getppid, program); // Seen in ATI binary driver. + EmitAllowKillSelf(SIGTERM, program); // GPU watchdog. EmitFailSyscall(__NR_open, ENOENT, program); EmitFailSyscall(__NR_access, ENOENT, program); |