| OLD | NEW |
| 1 // Copyright (c) 2009 The Chromium OS Authors. All rights reserved. | 1 // Copyright (c) 2009 The Chromium OS Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 // Some portions Copyright (c) 2009 The Chromium Authors. | 4 // Some portions Copyright (c) 2009 The Chromium Authors. |
| 5 // | 5 // |
| 6 // Implements MiniJail jailing logic. | 6 // Implements MiniJail jailing logic. |
| 7 | 7 |
| 8 #include "minijail.h" | 8 #include "minijail.h" |
| 9 | 9 |
| 10 #include <errno.h> | 10 #include <errno.h> |
| 11 | 11 |
| 12 namespace chromeos { | 12 namespace chromeos { |
| 13 | 13 |
| 14 bool MiniJail::Jail() const { | 14 bool MiniJail::Jail() const { |
| 15 // XXX This is a very early implementation of the jailing logic. | 15 // XXX This is a very early implementation of the jailing logic. |
| 16 // XXX Many features are missing or will be made more tunable. | 16 // XXX Many features are missing or will be made more tunable. |
| 17 const minijail::Options *opts = options(); | 17 const minijail::Options *opts = options(); |
| 18 if (!opts) { |
| 19 LOG(ERROR) << "No Options given. Initialize must be called first " |
| 20 << "with a valid Option pointer."; |
| 21 return false; |
| 22 } |
| 18 const minijail::Env *env = opts->env(); | 23 const minijail::Env *env = opts->env(); |
| 19 | 24 |
| 20 int namespaces = 0; | 25 int namespaces = 0; |
| 21 if (opts->namespace_pid()) | 26 if (opts->namespace_pid()) |
| 22 namespaces |= CLONE_NEWPID; | 27 namespaces |= CLONE_NEWPID; |
| 23 if (opts->namespace_vfs()) | 28 if (opts->namespace_vfs()) |
| 24 namespaces |= CLONE_NEWNS; | 29 namespaces |= CLONE_NEWNS; |
| 25 // Dumb forced exit on failure. | 30 // Dumb forced exit on failure. |
| 26 LOG_IF(FATAL, !env->EnterNamespace(namespaces)); | 31 LOG_IF(FATAL, !env->EnterNamespace(namespaces)); |
| 27 | 32 |
| (...skipping 29 matching lines...) Expand all Loading... |
| 57 | 62 |
| 58 if (opts->use_capabilities()) { | 63 if (opts->use_capabilities()) { |
| 59 // TODO(wad) use helpers to read caps from flags | 64 // TODO(wad) use helpers to read caps from flags |
| 60 LOG_IF(FATAL, !env->SanitizeCapabilities(0)); | 65 LOG_IF(FATAL, !env->SanitizeCapabilities(0)); |
| 61 LOG_IF(FATAL, !env->SanitizeBoundingSet(0)); | 66 LOG_IF(FATAL, !env->SanitizeBoundingSet(0)); |
| 62 } | 67 } |
| 63 return true; | 68 return true; |
| 64 } | 69 } |
| 65 | 70 |
| 66 } // namespace chromeos | 71 } // namespace chromeos |
| OLD | NEW |