| OLD | NEW |
| 1 // Copyright (c) 2011 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2011 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "content/browser/zygote_host_linux.h" | 5 #include "content/browser/zygote_host_linux.h" |
| 6 | 6 |
| 7 #include <dlfcn.h> | 7 #include <dlfcn.h> |
| 8 #include <fcntl.h> | 8 #include <fcntl.h> |
| 9 #include <pthread.h> | 9 #include <pthread.h> |
| 10 #include <sys/socket.h> | 10 #include <sys/socket.h> |
| (...skipping 781 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 792 if (g_proc_fd >= 0 && SeccompSandboxEnabled()) { | 792 if (g_proc_fd >= 0 && SeccompSandboxEnabled()) { |
| 793 if (!SupportsSeccompSandbox(g_proc_fd)) { | 793 if (!SupportsSeccompSandbox(g_proc_fd)) { |
| 794 // There are a good number of users who cannot use the seccomp sandbox | 794 // There are a good number of users who cannot use the seccomp sandbox |
| 795 // (e.g. because their distribution does not enable seccomp mode by | 795 // (e.g. because their distribution does not enable seccomp mode by |
| 796 // default). While we would prefer to deny execution in this case, it | 796 // default). While we would prefer to deny execution in this case, it |
| 797 // seems more realistic to continue in degraded mode. | 797 // seems more realistic to continue in degraded mode. |
| 798 LOG(ERROR) << "WARNING! This machine lacks support needed for the " | 798 LOG(ERROR) << "WARNING! This machine lacks support needed for the " |
| 799 "Seccomp sandbox. Running renderers with Seccomp " | 799 "Seccomp sandbox. Running renderers with Seccomp " |
| 800 "sandboxing disabled."; | 800 "sandboxing disabled."; |
| 801 } else { | 801 } else { |
| 802 // TODO(evan): switch to VLOG once we shake out all the sandbox bugs. | 802 VLOG(1) << "Enabling experimental Seccomp sandbox."; |
| 803 LOG(WARNING) << "Enabling experimental Seccomp sandbox; if you encounter " | |
| 804 << "any problems, please try running with " | |
| 805 << "--disable-seccomp-sandbox and file bugs."; | |
| 806 sandbox_flags |= ZygoteHost::kSandboxSeccomp; | 803 sandbox_flags |= ZygoteHost::kSandboxSeccomp; |
| 807 } | 804 } |
| 808 } | 805 } |
| 809 #endif // SECCOMP_SANDBOX | 806 #endif // SECCOMP_SANDBOX |
| 810 | 807 |
| 811 Zygote zygote(sandbox_flags, forkdelegate); | 808 Zygote zygote(sandbox_flags, forkdelegate); |
| 812 // This function call can return multiple times, once per fork(). | 809 // This function call can return multiple times, once per fork(). |
| 813 return zygote.ProcessRequests(); | 810 return zygote.ProcessRequests(); |
| 814 } | 811 } |
| OLD | NEW |