0c7fda8735
Add opt-in Linux renderer sandbox support to WebContent and WebWorker. Ladybird and test-web pass --enable-sandbox through when requested, and the renderer services only install the shared sandbox when that flag is present. Share one renderer policy for both services. Allow resource, font, shared library, WebGL, Wasm, audio, and local IPC paths needed at runtime, while keeping renderer filesystem writes mediated by Landlock. Allow Mesa and PulseAudio to probe their standard runtime state without escaping the renderer sandbox. Return EPERM for scheduler and priority changes so library initialization can fall back instead of crashing on a seccomp violation.
49 lines
1.1 KiB
C++
49 lines
1.1 KiB
C++
/*
|
|
* Copyright (c) 2026-present, the Ladybird developers.
|
|
*
|
|
* SPDX-License-Identifier: BSD-2-Clause
|
|
*/
|
|
|
|
#pragma once
|
|
|
|
#include <AK/Error.h>
|
|
#include <AK/Vector.h>
|
|
#include <linux/filter.h>
|
|
|
|
namespace Sandbox {
|
|
|
|
class SeccompPolicy {
|
|
public:
|
|
SeccompPolicy();
|
|
|
|
void deny_readonly_filesystem_probes();
|
|
void allow_readonly_file_opens();
|
|
void allow_filesystem_metadata_queries();
|
|
void allow_filesystem_writes();
|
|
void allow_file_descriptor_operations();
|
|
void allow_process_creation();
|
|
void allow_ipc();
|
|
void allow_network();
|
|
void allow_memory_without_executable_mappings();
|
|
void allow_executable_memory_mappings();
|
|
void allow_threads();
|
|
void allow_signals();
|
|
void allow_clocks();
|
|
void allow_gpu_device_operations();
|
|
void allow_process_metadata();
|
|
void allow_common_runtime();
|
|
void allow_prctl();
|
|
void allow_exit();
|
|
|
|
[[nodiscard]] ErrorOr<void> install();
|
|
|
|
private:
|
|
void append(sock_filter);
|
|
void append_architecture_check();
|
|
void append_load_syscall_number();
|
|
void append_kill();
|
|
|
|
Vector<sock_filter> m_filter;
|
|
};
|
|
|
|
}
|