1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
|
// Copyright 2020 The Chromium Authors
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
#include "content/utility/speech/speech_recognition_sandbox_hook_linux.h"
#include <dlfcn.h>
#include "base/files/file_util.h"
#include "components/soda/buildflags.h"
#include "components/soda/constants.h"
#include "sandbox/linux/syscall_broker/broker_command.h"
#include "sandbox/linux/syscall_broker/broker_file_permission.h"
using sandbox::syscall_broker::BrokerFilePermission;
using sandbox::syscall_broker::MakeBrokerCommandSet;
namespace speech {
namespace {
// Gets the file permissions required by the Speech On-Device API (SODA).
std::vector<BrokerFilePermission> GetSodaFilePermissions() {
auto soda_dir = GetSodaDirectory();
std::vector<BrokerFilePermission> permissions{
BrokerFilePermission::ReadOnly("/dev/urandom")};
// This may happen if a user doesn't have a SODA installation.
if (!soda_dir.empty()) {
permissions.push_back(BrokerFilePermission::ReadOnlyRecursive(
soda_dir.AsEndingWithSeparator().value()));
}
// This may happen if a user doesn't have any language packs installed.
auto language_packs_dir = GetSodaLanguagePacksDirectory();
if (!language_packs_dir.empty()) {
permissions.push_back(BrokerFilePermission::ReadOnlyRecursive(
language_packs_dir.AsEndingWithSeparator().value()));
}
#if BUILDFLAG(ENABLE_SODA_INTEGRATION_TESTS)
auto test_resources_dir = GetSodaTestResourcesDirectory();
if (!test_resources_dir.empty()) {
permissions.push_back(BrokerFilePermission::ReadOnlyRecursive(
test_resources_dir.AsEndingWithSeparator().value()));
}
#endif
return permissions;
}
} // namespace
bool SpeechRecognitionPreSandboxHook(
sandbox::policy::SandboxLinux::Options options) {
#if BUILDFLAG(ENABLE_SODA_INTEGRATION_TESTS)
base::FilePath test_binary_path = GetSodaTestBinaryPath();
DVLOG(0) << "SODA test binary path: " << test_binary_path.value().c_str();
DCHECK(base::PathExists(test_binary_path));
void* soda_test_library = dlopen(GetSodaTestBinaryPath().value().c_str(),
RTLD_NOW | RTLD_GLOBAL | RTLD_NODELETE);
DCHECK(soda_test_library);
#endif
void* soda_library = dlopen(GetSodaBinaryPath().value().c_str(),
RTLD_NOW | RTLD_GLOBAL | RTLD_NODELETE);
DCHECK(soda_library);
auto* instance = sandbox::policy::SandboxLinux::GetInstance();
instance->StartBrokerProcess(MakeBrokerCommandSet({
sandbox::syscall_broker::COMMAND_ACCESS,
sandbox::syscall_broker::COMMAND_OPEN,
sandbox::syscall_broker::COMMAND_READLINK,
sandbox::syscall_broker::COMMAND_STAT,
}),
GetSodaFilePermissions(), options);
instance->EngageNamespaceSandboxIfPossible();
return true;
}
} // namespace speech
|
