From aa1926159ee706c26fca198bb51200da455fe1e9 Mon Sep 17 00:00:00 2001 From: Aliaksandr Kalenik Date: Thu, 18 Jun 2026 07:55:05 +0200 Subject: [PATCH] Services: Move GPU runtime access to Compositor WebGL rasterization now happens in the Compositor process, but the GPU runtime Landlock rules still lived only in WebContent. ANGLE initializes native EGL when a page creates a WebGL context, which happens after the Compositor sandbox is installed, so loading libEGL.so.1 and the Mesa/GLVND driver stack was denied. Grant the Compositor access to native GL/Vulkan driver and configuration paths, DRI devices, /sys, LD_LIBRARY_PATH entries, the Mesa shader cache, and executable mappings required by the driver stack. Remove the corresponding late filesystem access from WebContent. WebContent still initializes its Skia GPU backend before installing its sandbox, so it does not need to open the GPU runtime afterward; keep the GPU device seccomp allowance there because Skia continues to issue operations on already-opened GPU fds for display-list painting. --- Services/Compositor/SandboxLinux.cpp | 15 +++++++++++++++ Services/RendererSandboxLinux.cpp | 20 -------------------- 2 files changed, 15 insertions(+), 20 deletions(-) diff --git a/Services/Compositor/SandboxLinux.cpp b/Services/Compositor/SandboxLinux.cpp index f117bc2e30..5f28891ae6 100644 --- a/Services/Compositor/SandboxLinux.cpp +++ b/Services/Compositor/SandboxLinux.cpp @@ -24,6 +24,20 @@ ErrorOr apply_sandbox() for (auto const& path : TRY(Gfx::FontDatabase::font_directories())) TRY(Sandbox::add_landlock_path_if_exists(paths, path, Sandbox::LandlockPath::Access::ReadOnly)); TRY(Sandbox::add_landlock_path_if_exists(paths, TRY(String::formatted("{}/fonts", WebView::s_ladybird_resource_root)), Sandbox::LandlockPath::Access::ReadOnly)); + TRY(Sandbox::add_landlock_path_if_exists(paths, "/lib"sv, Sandbox::LandlockPath::Access::ReadOnly)); + TRY(Sandbox::add_landlock_path_if_exists(paths, "/lib64"sv, Sandbox::LandlockPath::Access::ReadOnly)); + TRY(Sandbox::add_landlock_path_if_exists(paths, "/usr/lib"sv, Sandbox::LandlockPath::Access::ReadOnly)); + TRY(Sandbox::add_landlock_path_if_exists(paths, "/usr/local/lib"sv, Sandbox::LandlockPath::Access::ReadOnly)); + TRY(Sandbox::add_landlock_path_if_exists(paths, "/etc/glvnd"sv, Sandbox::LandlockPath::Access::ReadOnly)); + TRY(Sandbox::add_landlock_path_if_exists(paths, "/usr/share/glvnd"sv, Sandbox::LandlockPath::Access::ReadOnly)); + TRY(Sandbox::add_landlock_path_if_exists(paths, "/usr/share/drirc.d"sv, Sandbox::LandlockPath::Access::ReadOnly)); + TRY(Sandbox::add_landlock_path_if_exists(paths, "/usr/share/vulkan"sv, Sandbox::LandlockPath::Access::ReadOnly)); + TRY(Sandbox::add_landlock_path_if_exists(paths, "/dev/dri"sv, Sandbox::LandlockPath::Access::ReadWrite)); + TRY(Sandbox::add_landlock_path_if_exists(paths, "/sys"sv, Sandbox::LandlockPath::Access::ReadOnly)); + if (auto library_path = Core::Environment::get("LD_LIBRARY_PATH"sv); library_path.has_value()) { + for (auto path : library_path->split_view(':')) + TRY(Sandbox::add_landlock_path_if_exists(paths, path, Sandbox::LandlockPath::Access::ReadOnly)); + } auto mesa_shader_cache_path = Core::Environment::get("MESA_SHADER_CACHE_DIR"sv) .map([](auto path) { return path.to_byte_string(); }) @@ -41,6 +55,7 @@ ErrorOr apply_sandbox() policy.allow_ipc(); policy.allow_gpu_device_operations(); policy.allow_common_runtime(); + policy.allow_executable_memory_mappings(); TRY(policy.install()); return {}; diff --git a/Services/RendererSandboxLinux.cpp b/Services/RendererSandboxLinux.cpp index 61188f8204..ce8e3a059d 100644 --- a/Services/RendererSandboxLinux.cpp +++ b/Services/RendererSandboxLinux.cpp @@ -33,20 +33,6 @@ ErrorOr apply_sandbox(Optional config_path) TRY(Sandbox::add_landlock_path_if_exists(paths, executable_path, Sandbox::LandlockPath::Access::ReadOnly)); TRY(Sandbox::add_landlock_path_if_exists(paths, LexicalPath::join(build_root, "lib"sv).string(), Sandbox::LandlockPath::Access::ReadOnly)); TRY(Sandbox::add_landlock_path_if_exists(paths, "/proc/self"sv, Sandbox::LandlockPath::Access::ReadOnly)); - TRY(Sandbox::add_landlock_path_if_exists(paths, "/lib"sv, Sandbox::LandlockPath::Access::ReadOnly)); - TRY(Sandbox::add_landlock_path_if_exists(paths, "/lib64"sv, Sandbox::LandlockPath::Access::ReadOnly)); - TRY(Sandbox::add_landlock_path_if_exists(paths, "/usr/lib"sv, Sandbox::LandlockPath::Access::ReadOnly)); - TRY(Sandbox::add_landlock_path_if_exists(paths, "/usr/local/lib"sv, Sandbox::LandlockPath::Access::ReadOnly)); - TRY(Sandbox::add_landlock_path_if_exists(paths, "/etc/glvnd"sv, Sandbox::LandlockPath::Access::ReadOnly)); - TRY(Sandbox::add_landlock_path_if_exists(paths, "/usr/share/glvnd"sv, Sandbox::LandlockPath::Access::ReadOnly)); - TRY(Sandbox::add_landlock_path_if_exists(paths, "/usr/share/drirc.d"sv, Sandbox::LandlockPath::Access::ReadOnly)); - TRY(Sandbox::add_landlock_path_if_exists(paths, "/usr/share/vulkan"sv, Sandbox::LandlockPath::Access::ReadOnly)); - TRY(Sandbox::add_landlock_path_if_exists(paths, "/dev/dri"sv, Sandbox::LandlockPath::Access::ReadWrite)); - TRY(Sandbox::add_landlock_path_if_exists(paths, "/sys"sv, Sandbox::LandlockPath::Access::ReadOnly)); - if (auto library_path = Core::Environment::get("LD_LIBRARY_PATH"sv); library_path.has_value()) { - for (auto path : library_path->split_view(':')) - TRY(Sandbox::add_landlock_path_if_exists(paths, path, Sandbox::LandlockPath::Access::ReadOnly)); - } for (auto const& path : TRY(Gfx::FontDatabase::font_directories())) TRY(Sandbox::add_landlock_path_if_exists(paths, path, Sandbox::LandlockPath::Access::ReadOnly)); @@ -57,12 +43,6 @@ ErrorOr apply_sandbox(Optional config_path) TRY(Sandbox::add_landlock_path_if_exists(paths, default_cranelift_compiler_path, Sandbox::LandlockPath::Access::ReadAndExecute)); } - auto mesa_shader_cache_path = Core::Environment::get("MESA_SHADER_CACHE_DIR"sv) - .map([](auto path) { return path.to_byte_string(); }) - .value_or_lazy_evaluated([] { return ByteString::formatted("{}/mesa_shader_cache", Core::StandardPaths::cache_directory()); }); - TRY(Core::Directory::create(mesa_shader_cache_path, Core::Directory::CreateDirectories::Yes)); - TRY(Sandbox::add_landlock_path_if_exists(paths, mesa_shader_cache_path, Sandbox::LandlockPath::Access::ReadWrite)); - auto pulse_runtime_path = LexicalPath::join(TRY(Core::StandardPaths::runtime_directory()), "pulse"sv).string(); TRY(Core::Directory::create(pulse_runtime_path, Core::Directory::CreateDirectories::Yes, 0700)); TRY(Sandbox::add_landlock_path_if_exists(paths, pulse_runtime_path, Sandbox::LandlockPath::Access::ReadWrite));