From b759954486e727c3e9b5fea7b160547ceed70ac8 Mon Sep 17 00:00:00 2001 From: Andreas Kling Date: Fri, 19 Jun 2026 17:01:21 +0200 Subject: [PATCH] Compositor: Allow GPU driver executable mappings on Linux Let the Linux Compositor sandbox permit writable executable mappings used lazily by GPU drivers after WebGL context creation. Keep this allowance scoped to the Compositor process so WebContent retains the existing memory mapping restrictions. --- Libraries/LibSandbox/Seccomp.cpp | 26 ++++++++++++++++++++++++++ Libraries/LibSandbox/Seccomp.h | 1 + Services/Compositor/SandboxLinux.cpp | 3 +++ 3 files changed, 30 insertions(+) diff --git a/Libraries/LibSandbox/Seccomp.cpp b/Libraries/LibSandbox/Seccomp.cpp index 5a6d1b1221..6bb9c487db 100644 --- a/Libraries/LibSandbox/Seccomp.cpp +++ b/Libraries/LibSandbox/Seccomp.cpp @@ -1061,6 +1061,32 @@ void SeccompPolicy::allow_executable_memory_mappings() append(SECCOMP_LOAD_SYSCALL_NR); } +void SeccompPolicy::allow_writable_executable_memory_mappings() +{ + append(BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_mmap, 0, 5)); + append(SECCOMP_LOAD_ARGUMENT(2)); + append(BPF_STMT(BPF_ALU | BPF_AND | BPF_K, PROT_WRITE | PROT_EXEC)); + append(BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, PROT_WRITE | PROT_EXEC, 0, 1)); + append(SECCOMP_ALLOW); + append(SECCOMP_LOAD_SYSCALL_NR); + +#ifdef __NR_mmap2 + append(BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_mmap2, 0, 5)); + append(SECCOMP_LOAD_ARGUMENT(2)); + append(BPF_STMT(BPF_ALU | BPF_AND | BPF_K, PROT_WRITE | PROT_EXEC)); + append(BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, PROT_WRITE | PROT_EXEC, 0, 1)); + append(SECCOMP_ALLOW); + append(SECCOMP_LOAD_SYSCALL_NR); +#endif + + append(BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_mprotect, 0, 5)); + append(SECCOMP_LOAD_ARGUMENT(2)); + append(BPF_STMT(BPF_ALU | BPF_AND | BPF_K, PROT_WRITE | PROT_EXEC)); + append(BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, PROT_WRITE | PROT_EXEC, 0, 1)); + append(SECCOMP_ALLOW); + append(SECCOMP_LOAD_SYSCALL_NR); +} + void SeccompPolicy::allow_threads() { #ifdef __NR_clone diff --git a/Libraries/LibSandbox/Seccomp.h b/Libraries/LibSandbox/Seccomp.h index 79db4066bf..ea1ae4a275 100644 --- a/Libraries/LibSandbox/Seccomp.h +++ b/Libraries/LibSandbox/Seccomp.h @@ -27,6 +27,7 @@ public: void allow_network(); void allow_memory_without_executable_mappings(); void allow_executable_memory_mappings(); + void allow_writable_executable_memory_mappings(); void allow_threads(); void allow_signals(); void allow_clocks(); diff --git a/Services/Compositor/SandboxLinux.cpp b/Services/Compositor/SandboxLinux.cpp index e83ee51de9..531b031f40 100644 --- a/Services/Compositor/SandboxLinux.cpp +++ b/Services/Compositor/SandboxLinux.cpp @@ -70,6 +70,9 @@ ErrorOr apply_sandbox() policy.allow_gpu_device_operations(); policy.allow_common_runtime(); policy.allow_executable_memory_mappings(); + // Some GPU drivers allocate writable executable code heaps lazily after + // context creation, including while handling WebGL commands. + policy.allow_writable_executable_memory_mappings(); TRY(policy.install()); return {};