| Index: src/platform/minijail/minijail.cc
|
| diff --git a/src/platform/minijail/minijail.cc b/src/platform/minijail/minijail.cc
|
| index bd6c8d64cfbe1f6e7a871c13cfcee62a2224dc1d..d7011d28259d40b281936798cb5daa954e5eb403 100644
|
| --- a/src/platform/minijail/minijail.cc
|
| +++ b/src/platform/minijail/minijail.cc
|
| @@ -27,19 +27,30 @@ bool MiniJail::Jail() const {
|
| namespaces |= CLONE_NEWPID;
|
| if (opts->namespace_vfs())
|
| namespaces |= CLONE_NEWNS;
|
| - // Dumb forced exit on failure.
|
| - LOG_IF(FATAL, !env->EnterNamespace(namespaces));
|
| + if (namespaces && !env->EnterNamespace(namespaces)) {
|
| + return false;
|
| + }
|
|
|
| - if (opts->namespace_vfs() && opts->add_readonly_mounts())
|
| - LOG_IF(FATAL, !env->Mount()); // TODO(wad) add flags
|
| + if (opts->namespace_vfs() && opts->add_readonly_mounts()) {
|
| + if (!env->Mount()) { // TODO(wad) add flags
|
| + return false;
|
| + }
|
| + }
|
|
|
| if (opts->use_capabilities()) {
|
| - LOG_IF(FATAL, !env->KeepRootCapabilities());
|
| - LOG_IF(FATAL, !env->DisableDefaultRootPrivileges());
|
| + if (!env->KeepRootCapabilities()) {
|
| + return false;
|
| + }
|
| + if (!env->DisableDefaultRootPrivileges()) {
|
| + return false;
|
| + }
|
| }
|
|
|
| - if (opts->disable_tracing())
|
| - LOG_IF(FATAL, !env->DisableTracing());
|
| + if (opts->disable_tracing()) {
|
| + if (!env->DisableTracing()) {
|
| + return false;
|
| + }
|
| + }
|
|
|
| uid_t uid = getuid();
|
| if (opts->change_uid()) {
|
| @@ -51,19 +62,30 @@ bool MiniJail::Jail() const {
|
| }
|
| // TODO(wad) separate group and user changes
|
| if (opts->change_uid() || opts->change_gid()) {
|
| - LOG_IF(FATAL, !env->ChangeUser(uid, gid));
|
| + DLOG(INFO) << "Attempting to change user and/or groups...";
|
| + if (!env->ChangeUser(uid, gid)) {
|
| + return false;
|
| + }
|
| }
|
|
|
| if (opts->enforce_syscalls_by_source()) {
|
| - LOG_IF(FATAL, !env->FilterSyscallsBySource());
|
| + if (!env->FilterSyscallsBySource()) {
|
| + return false;
|
| + }
|
| } else if (opts->enforce_syscalls_benchmark()) {
|
| - LOG_IF(FATAL, !env->FilterSyscallsBenchmarkOnly());
|
| + if (!env->FilterSyscallsBenchmarkOnly()) {
|
| + return false;
|
| + }
|
| }
|
|
|
| if (opts->use_capabilities()) {
|
| // TODO(wad) use helpers to read caps from flags
|
| - LOG_IF(FATAL, !env->SanitizeCapabilities(0));
|
| - LOG_IF(FATAL, !env->SanitizeBoundingSet(0));
|
| + if (!env->SanitizeCapabilities(0)) {
|
| + return false;
|
| + }
|
| + if (!env->SanitizeBoundingSet(0)) {
|
| + return false;
|
| + }
|
| }
|
| return true;
|
| }
|
|
|