OLD | NEW |
1 // Copyright (c) 2011 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2011 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "content/browser/zygote_host_linux.h" | 5 #include "content/browser/zygote_host_linux.h" |
6 | 6 |
7 #include <dlfcn.h> | 7 #include <dlfcn.h> |
8 #include <fcntl.h> | 8 #include <fcntl.h> |
9 #include <pthread.h> | 9 #include <pthread.h> |
10 #include <sys/socket.h> | 10 #include <sys/socket.h> |
(...skipping 781 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
792 if (g_proc_fd >= 0 && SeccompSandboxEnabled()) { | 792 if (g_proc_fd >= 0 && SeccompSandboxEnabled()) { |
793 if (!SupportsSeccompSandbox(g_proc_fd)) { | 793 if (!SupportsSeccompSandbox(g_proc_fd)) { |
794 // There are a good number of users who cannot use the seccomp sandbox | 794 // There are a good number of users who cannot use the seccomp sandbox |
795 // (e.g. because their distribution does not enable seccomp mode by | 795 // (e.g. because their distribution does not enable seccomp mode by |
796 // default). While we would prefer to deny execution in this case, it | 796 // default). While we would prefer to deny execution in this case, it |
797 // seems more realistic to continue in degraded mode. | 797 // seems more realistic to continue in degraded mode. |
798 LOG(ERROR) << "WARNING! This machine lacks support needed for the " | 798 LOG(ERROR) << "WARNING! This machine lacks support needed for the " |
799 "Seccomp sandbox. Running renderers with Seccomp " | 799 "Seccomp sandbox. Running renderers with Seccomp " |
800 "sandboxing disabled."; | 800 "sandboxing disabled."; |
801 } else { | 801 } else { |
802 // TODO(evan): switch to VLOG once we shake out all the sandbox bugs. | 802 VLOG(1) << "Enabling experimental Seccomp sandbox."; |
803 LOG(WARNING) << "Enabling experimental Seccomp sandbox; if you encounter " | |
804 << "any problems, please try running with " | |
805 << "--disable-seccomp-sandbox and file bugs."; | |
806 sandbox_flags |= ZygoteHost::kSandboxSeccomp; | 803 sandbox_flags |= ZygoteHost::kSandboxSeccomp; |
807 } | 804 } |
808 } | 805 } |
809 #endif // SECCOMP_SANDBOX | 806 #endif // SECCOMP_SANDBOX |
810 | 807 |
811 Zygote zygote(sandbox_flags, forkdelegate); | 808 Zygote zygote(sandbox_flags, forkdelegate); |
812 // This function call can return multiple times, once per fork(). | 809 // This function call can return multiple times, once per fork(). |
813 return zygote.ProcessRequests(); | 810 return zygote.ProcessRequests(); |
814 } | 811 } |
OLD | NEW |