1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
|
// Copyright 2012 The Chromium Authors
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
#include "content/renderer/renderer_main_platform_delegate.h"
#include "base/android/build_info.h"
#include "base/metrics/histogram_macros.h"
#include "base/trace_event/trace_event.h"
#include "content/renderer/seccomp_sandbox_status_android.h"
#include "sandbox/linux/seccomp-bpf-helpers/seccomp_starter_android.h"
#include "sandbox/sandbox_buildflags.h"
#if BUILDFLAG(USE_SECCOMP_BPF)
#include "sandbox/linux/seccomp-bpf-helpers/baseline_policy_android.h"
#include "sandbox/policy/features.h"
#include "sandbox/policy/linux/bpf_renderer_policy_linux.h"
#include "sandbox/policy/mojom/sandbox.mojom.h"
#include "sandbox/policy/sandbox_type.h"
#endif
namespace content {
RendererMainPlatformDelegate::RendererMainPlatformDelegate(
const MainFunctionParams& parameters) {}
RendererMainPlatformDelegate::~RendererMainPlatformDelegate() {
}
void RendererMainPlatformDelegate::PlatformInitialize() {
}
void RendererMainPlatformDelegate::PlatformUninitialize() {
}
bool RendererMainPlatformDelegate::EnableSandbox() {
TRACE_EVENT0("startup", "RendererMainPlatformDelegate::EnableSandbox");
auto* info = base::android::BuildInfo::GetInstance();
sandbox::SeccompStarterAndroid starter(info->sdk_int());
// The policy compiler is only available if USE_SECCOMP_BPF is enabled.
#if BUILDFLAG(USE_SECCOMP_BPF)
sandbox::BaselinePolicyAndroid::RuntimeOptions options(
starter.GetDefaultBaselineOptions());
if (base::FeatureList::IsEnabled(
sandbox::policy::features::kRestrictRendererPoliciesInBaseline)) {
options.should_restrict_renderer_syscalls = true;
}
if (base::FeatureList::IsEnabled(
sandbox::policy::features::kRestrictCloneParameters)) {
options.should_restrict_clone_params = true;
}
if (sandbox::policy::SandboxTypeFromCommandLine(
*base::CommandLine::ForCurrentProcess()) ==
sandbox::mojom::Sandbox::kRenderer &&
base::FeatureList::IsEnabled(
sandbox::policy::features::kUseRendererProcessPolicy)) {
starter.set_policy(
std::make_unique<sandbox::policy::RendererProcessPolicy>(options));
} else {
starter.set_policy(
std::make_unique<sandbox::BaselinePolicyAndroid>(options));
}
#endif
starter.StartSandbox();
SetSeccompSandboxStatus(starter.status());
UMA_HISTOGRAM_ENUMERATION("Android.SeccompStatus.RendererSandbox",
starter.status(),
sandbox::SeccompSandboxStatus::STATUS_MAX);
return true;
}
} // namespace content
|
