2015-01-04  Michael Catanzaro  <mcatanzaro@igalia.com>

        [Linux] SeccompFilters: improve the port-agnostic whitelist

        https://bugs.webkit.org/show_bug.cgi?id=140064

        Reviewed by NOBODY (OOPS!).

        Allow the web process to access several files and directories that it

        was previously prohibited from accessing. This makes the web process

        much less likely to break.

        * Shared/linux/SeccompFilters/SyscallPolicy.cpp:

        (WebKit::SyscallPolicy::addDefaultWebProcessPolicy):

    addDirectoryPermission(ASCIILiteral("/lib64"), Read);

    addDirectoryPermission(ASCIILiteral("/usr/lib64"), Read);

    // Needed by at-spi2.

    addDirectoryPermission("/run/user/" + String::number(getuid()), ReadAndWrite);

    // Needed by WebKit's memory pressure handler

    addFilePermission(ASCIILiteral("/sys/fs/cgroup/memory/memory.pressure_level"), Read);

    addFilePermission(ASCIILiteral("/sys/fs/cgroup/memory/cgroup.event_control"), Read);

    // MIME type resolution.

    char* dataHomeDir = getenv("XDG_DATA_HOME");

    if (dataHomeDir)

        addDirectoryPermission(String::fromUTF8(dataHomeDir) + "/mime", Read);

    else if (homeDir)

        addDirectoryPermission(String::fromUTF8(homeDir) + "/.local/share/mime", Read);

#if ENABLE(WEBGL) || ENABLE(ACCELERATED_2D_CANVAS)

    // Needed on most non-Debian distros by libxshmfence <= 1.1, or newer

    // libxshmfence with older kernels (linux <= 3.16), for DRI3 shared memory.

    // Try removing this permission when we can rely on a newer libxshmfence.

    // See http://code.google.com/p/chromium/issues/detail?id=415681

    addDirectoryPermission(ASCIILiteral("/var/tmp"), ReadAndWrite);

    // Optional Mesa DRI configuration file

    addFilePermission(ASCIILiteral("/etc/drirc"), Read);

    if (homeDir)

        addFilePermission(String::fromUTF8(homeDir) + "/.drirc", Read);

    // Mesa uses udev.

    addDirectoryPermission(ASCIILiteral("/etc/udev"), Read);

    addDirectoryPermission(ASCIILiteral("/run/udev"), Read);

    addDirectoryPermission(ASCIILiteral("/sys/devices"), Read);

#endif

    // Needed by NVIDIA proprietary graphics driver

    if (homeDir)

        addDirectoryPermission(String::fromUTF8(homeDir) + "/.nv", Read);