4 ms·
Looks to still allow direct GPU access, due to the missing GL proxy (there's a comment to that effect in the patch). IMO, this is a hole big enough to fit a tr
by daeken 13y ago
Looks to still allow direct GPU access, due to the missing GL proxy (there's a comment to that effect in the patch). IMO, this is a hole big enough to fit a truck through. Particularly with gralloc (GPU memory allocation facilities) being there, the risk of being able to completely own the system via the GPU and its driver is very high.
This is a great step in the right direction, but without the GL proxy, any sandbox is effectively made of tissue paper.
- zobzu 13y agoThis still seems to block "many" calls (the whitelist has other notes regarding other things waiting to be fixed). Ie this still noticeably raises the bar regardless, even thus all these allows have to be fixed for the sandbox to be on par, with, say, Chrome.