| OLD | NEW |
| 1 // Copyright (c) 2010 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2010 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "chrome/nacl/nacl_main_platform_delegate.h" | 5 #include "chrome/nacl/nacl_main_platform_delegate.h" |
| 6 | 6 |
| 7 #include "base/command_line.h" | 7 #include "base/command_line.h" |
| 8 #include "chrome/common/chrome_switches.h" | 8 #include "chrome/common/chrome_switches.h" |
| 9 #include "seccompsandbox/sandbox.h" | 9 #include "seccompsandbox/sandbox.h" |
| 10 | 10 |
| (...skipping 16 matching lines...) Expand all Loading... |
| 27 // http://code.google.com/p/chromium/wiki/LinuxSUIDSandbox | 27 // http://code.google.com/p/chromium/wiki/LinuxSUIDSandbox |
| 28 return; | 28 return; |
| 29 } | 29 } |
| 30 | 30 |
| 31 void NaClMainPlatformDelegate::EnableSandbox() { | 31 void NaClMainPlatformDelegate::EnableSandbox() { |
| 32 // The setuid sandbox is started in the zygote process: zygote_main_linux.cc | 32 // The setuid sandbox is started in the zygote process: zygote_main_linux.cc |
| 33 // http://code.google.com/p/chromium/wiki/LinuxSUIDSandbox | 33 // http://code.google.com/p/chromium/wiki/LinuxSUIDSandbox |
| 34 // | 34 // |
| 35 // The seccomp sandbox is started in the renderer. | 35 // The seccomp sandbox is started in the renderer. |
| 36 // http://code.google.com/p/seccompsandbox/ | 36 // http://code.google.com/p/seccompsandbox/ |
| 37 #if defined(ARCH_CPU_X86_FAMILY) && !defined(CHROMIUM_SELINUX) | 37 #if defined(ARCH_CPU_X86_FAMILY) && !defined(CHROMIUM_SELINUX) && \ |
| 38 !defined(__clang__) |
| 38 // N.b. SupportsSeccompSandbox() returns a cached result, as we already | 39 // N.b. SupportsSeccompSandbox() returns a cached result, as we already |
| 39 // called it earlier in the zygote. Thus, it is OK for us to not pass in | 40 // called it earlier in the zygote. Thus, it is OK for us to not pass in |
| 40 // a file descriptor for "/proc". | 41 // a file descriptor for "/proc". |
| 41 if (switches::SeccompSandboxEnabled() && SupportsSeccompSandbox(-1)) | 42 if (switches::SeccompSandboxEnabled() && SupportsSeccompSandbox(-1)) |
| 42 StartSeccompSandbox(); | 43 StartSeccompSandbox(); |
| 43 #endif | 44 #endif |
| 44 } | 45 } |
| 45 | 46 |
| 46 bool NaClMainPlatformDelegate::RunSandboxTests() { | 47 bool NaClMainPlatformDelegate::RunSandboxTests() { |
| 47 // The sandbox is started in the zygote process: zygote_main_linux.cc | 48 // The sandbox is started in the zygote process: zygote_main_linux.cc |
| 48 // http://code.google.com/p/chromium/wiki/LinuxSUIDSandbox | 49 // http://code.google.com/p/chromium/wiki/LinuxSUIDSandbox |
| 49 return true; | 50 return true; |
| 50 } | 51 } |
| OLD | NEW |