dbus: revamp fd passing for i/o restrictions

dbus/message.cc

Index: dbus/message.cc
diff --git a/dbus/message.cc b/dbus/message.cc
index d52591217e47bedadb04afcaf57dfcc5b3fcb435..5bbfafb5325bed1f51df5b64cb2c202f18b7a501 100644
--- a/dbus/message.cc
+++ b/dbus/message.cc
@@ -11,6 +11,7 @@
 #include "base/logging.h"
 #include "base/platform_file.h"
 #include "base/stringprintf.h"
+#include "base/threading/thread_restrictions.h"
 #include "dbus/object_path.h"
 #include "third_party/protobuf/src/google/protobuf/message_lite.h"
 
@@ -37,6 +38,17 @@ static void AppendUint32Header(const std::string& header_name,
   }
 }
 
+// Checks if |fd| is suitable for sending/receiving.  We disallow
+// directories to avoid potential sandbox escapes.
+static bool CheckFileDescriptor(int fd) {
+  // NB: bypass i/o restrictions, current uses will not block
+  bool prev = base::ThreadRestrictions::SetIOAllowed(true);

[satorux1, 2012/05/04 22:31:22]

ThreadRestrictions::ScopedAllowIO would be simpler.

+  base::PlatformFileInfo info;
+  bool ok = base::GetPlatformFileInfo(fd, &info);
+  base::ThreadRestrictions::SetIOAllowed(prev);
+  return (ok && !info.is_directory);
+}
+
 }  // namespace
 
 namespace dbus {
@@ -691,10 +703,8 @@ void MessageWriter::AppendVariantOfBasic(int dbus_type, const void* value) {
 void MessageWriter::AppendFileDescriptor(const FileDescriptor& value) {
   CHECK(kDBusTypeUnixFdIsSupported);
 
-  base::PlatformFileInfo info;
   int fd = value.value();
-  bool ok = base::GetPlatformFileInfo(fd, &info);
-  if (!ok || info.is_directory) {
+  if (!CheckFileDescriptor(fd)) {

[satorux1, 2012/05/04 22:31:22]

Maybe this wasn't the right place to validate this. What about instead letting
the caller to to validate this, and we check it here:

if (!value.is_validated())
  LOG(FATAL) << "The caller should validate before passing a file descriptor";

     // NB: sending a directory potentially enables sandbox escape
     LOG(FATAL) << "Attempt to pass invalid file descriptor";
   }
@@ -968,9 +978,7 @@ bool MessageReader::PopFileDescriptor(FileDescriptor* value) {
   if (!success)
     return false;
 
-  base::PlatformFileInfo info;
-  bool ok = base::GetPlatformFileInfo(fd, &info);
-  if (!ok || info.is_directory) {
+  if (!CheckFileDescriptor(fd)) {
     base::ClosePlatformFile(fd);
     // NB: receiving a directory potentially enables sandbox escape
     LOG(FATAL) << "Attempt to receive invalid file descriptor";