gpu.sb 5.3 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149
  1. ; Copyright 2017 The Chromium Authors. All rights reserved.
  2. ; Use of this source code is governed by a BSD-style license that can be
  3. ; found in the LICENSE file.
  4. ; --- The contents of common.sb implicitly included here. ---
  5. (deny default (with partial-symbolication))
  6. (debug deny)
  7. ; Allow cf prefs to work.
  8. (allow user-preference-read)
  9. (allow-cvms-blobs)
  10. (allow ipc-posix-shm)
  11. (define disable-metal-shader-cache "DISABLE_METAL_SHADER_CACHE")
  12. ; Allow communication between the GPU process and the UI server.
  13. (allow mach-lookup
  14. ; Needed for AudioToolbox AAC encoding (https://crbug.com/1321287) and
  15. ; xHE-AAC decoding (https://crbug.com/1289825).
  16. (global-name "com.apple.audio.AudioComponentRegistrar")
  17. (global-name "com.apple.bsd.dirhelper")
  18. (global-name "com.apple.CARenderServer")
  19. (global-name "com.apple.cfprefsd.agent")
  20. (global-name "com.apple.cfprefsd.daemon")
  21. (global-name "com.apple.CoreServices.coreservicesd")
  22. (global-name "com.apple.coreservices.launchservicesd")
  23. (global-name "com.apple.cvmsServ")
  24. (global-name "com.apple.gpumemd.source")
  25. (global-name "com.apple.lsd.mapdb")
  26. (global-name "com.apple.lsd.modifydb")
  27. (global-name "com.apple.powerlog.plxpclogger.xpc")
  28. (global-name "com.apple.PowerManagement.control")
  29. (global-name "com.apple.SecurityServer")
  30. (global-name "com.apple.system.notification_center")
  31. (global-name "com.apple.system.opendirectoryd.membership") ; https://crbug.com/1126350#c5
  32. (global-name "com.apple.tsm.uiserver")
  33. (global-name "com.apple.windowserver.active")
  34. )
  35. ; Needed for metal decoding - https://crbug.com/957217
  36. (if (>= os-version 1014)
  37. (allow mach-lookup (xpc-service-name "com.apple.MTLCompilerService"))
  38. )
  39. ; Needed for VideoToolbox H.264 SW and VP9 decoding - https://crbug.com/1113936
  40. (if (>= os-version 1016)
  41. (begin
  42. (allow mach-lookup (global-name "com.apple.trustd.agent"))
  43. (allow file-read* (path "/Library/Preferences/com.apple.security.plist"))
  44. )
  45. )
  46. ; Needed for WebGL - https://crbug.com/75343
  47. (allow iokit-open
  48. (iokit-connection "IOAccelerator")
  49. (iokit-user-client-class "AGPMClient")
  50. (iokit-user-client-class "AppleGraphicsControlClient")
  51. (iokit-user-client-class "AppleGraphicsPolicyClient")
  52. (iokit-user-client-class "AppleIntelMEUserClient")
  53. (iokit-user-client-class "AppleMGPUPowerControlClient")
  54. (iokit-user-client-class "AppleSNBFBUserClient")
  55. (iokit-user-client-class "IOAccelerationUserClient")
  56. (iokit-user-client-class "IOFramebufferSharedUserClient")
  57. (iokit-user-client-class "IOHIDParamUserClient")
  58. (iokit-user-client-class "IOSurfaceRootUserClient")
  59. (iokit-user-client-class "IOSurfaceSendRight")
  60. (iokit-user-client-class "RootDomainUserClient")
  61. )
  62. (allow iokit-set-properties
  63. (require-all (iokit-connection "IODisplay")
  64. (require-any (iokit-property "brightness")
  65. (iokit-property "linear-brightness")
  66. (iokit-property "commit")
  67. (iokit-property "rgcs")
  68. (iokit-property "ggcs")
  69. (iokit-property "bgcs")
  70. )))
  71. (allow ipc-posix-shm-read-data
  72. (ipc-posix-name "apple.shm.notification_center"))
  73. ; Needed for VideoToolbox usage - https://crbug.com/767037
  74. (if (>= os-version 1013)
  75. (allow mach-lookup
  76. (xpc-service-name "com.apple.coremedia.videodecoder")
  77. (xpc-service-name "com.apple.coremedia.videoencoder")
  78. (xpc-service-name-regex #"\.apple-extension-service$")
  79. ))
  80. (allow sysctl-read
  81. (sysctl-name "hw.busfrequency_max")
  82. (sysctl-name "hw.cachelinesize")
  83. (sysctl-name "hw.logicalcpu_max")
  84. (sysctl-name "hw.memsize")
  85. (sysctl-name "hw.model")
  86. (sysctl-name "kern.osvariant_status")
  87. )
  88. (allow file-read-data
  89. (path "/Library/MessageTracer/SubmitDiagInfo.default.domains.searchtree")
  90. (path "/System/Library/MessageTracer/SubmitDiagInfo.default.domains.searchtree")
  91. (regex (user-homedir-path #"/Library/Preferences/(.*/)?com\.apple\.driver\..*\.plist"))
  92. (regex (user-homedir-path #"/Library/Preferences/ByHost/com.apple.AppleGVA.*"))
  93. )
  94. (allow file-read*
  95. (path (user-homedir-path "/Library/Preferences")) ; List contents of preference directories https://crbug.com/1126350#c14.
  96. (path (user-homedir-path "/Library/Preferences/ByHost"))
  97. (subpath "/Library/GPUBundles")
  98. (subpath "/Library/Video/Plug-Ins")
  99. (subpath "/System/Library/ColorSync/Profiles")
  100. (subpath "/System/Library/Components/AudioCodecs.component")
  101. (subpath "/System/Library/CoreServices/RawCamera.bundle")
  102. (subpath "/System/Library/Extensions") ; https://crbug.com/515280
  103. (subpath "/System/Library/Video/Plug-Ins")
  104. )
  105. ; crbug.com/980134
  106. (allow file-read* file-write*
  107. (subpath (param darwin-user-cache-dir))
  108. (subpath (param darwin-user-dir))
  109. (subpath (param darwin-user-temp-dir))
  110. )
  111. (if (param-true? filter-syscalls-debug)
  112. (when (defined? 'syscall-unix)
  113. (deny syscall-unix (with send-signal SIGSYS))
  114. (allow syscall-unix
  115. (syscall-number SYS_csrctl)
  116. (syscall-number SYS_getentropy)
  117. (syscall-number SYS_getxattr)
  118. (syscall-number SYS_kdebug_typefilter)
  119. (syscall-number SYS_sigaltstack)
  120. (syscall-number SYS_write)
  121. (syscall-number SYS_write_nocancel)
  122. )))
  123. ; crbug.com/1159113
  124. (if (param-true? disable-metal-shader-cache)
  125. (let ((metal-cache-dir (subpath (string-append (param darwin-user-cache-dir)
  126. "/com.apple.metal"))))
  127. (deny file-read* metal-cache-dir)
  128. (deny file-write* metal-cache-dir))
  129. )