dmaax/ladybird
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Services: Deny GPU operations in WebContent

Browse source 
WebContent no longer creates a GPU-backed Skia context, so its Linux
sandbox does not need the broad GPU device syscall allowance. Remove
allow_gpu_device_operations() from the renderer policy while keeping the
narrower file descriptor ioctl allowances used by IPC transport setup.
This commit is contained in:
Aliaksandr Kalenik 2026-06-18 09:15:23 +02:00 committed by Jelle Raaijmakers
parent 724ca7cc24
commit f6f68ece44
1 changed files with 0 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
Services/RendererSandboxLinux.cpp
View file

@ -57,7 +57,6 @@ ErrorOr<void> apply_sandbox(Optional<StringView> config_path)
policy.allow_file_descriptor_operations(); policy.allow_file_descriptor_operations();
policy.allow_process_creation(); policy.allow_process_creation();
policy.allow_ipc(); policy.allow_ipc();
policy.allow_gpu_device_operations();
policy.allow_common_runtime(); policy.allow_common_runtime();
policy.allow_executable_memory_mappings(); policy.allow_executable_memory_mappings();
TRY(policy.install()); TRY(policy.install());