| OLD | NEW |
| 1 // Copyright (c) 2011 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2011 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "content/common/sandbox_mac.h" | 5 #include "content/common/sandbox_mac.h" |
| 6 | 6 |
| 7 #import <Cocoa/Cocoa.h> | 7 #import <Cocoa/Cocoa.h> |
| 8 | 8 |
| 9 extern "C" { | 9 extern "C" { |
| 10 #include <sandbox.h> | 10 #include <sandbox.h> |
| (...skipping 57 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 68 dst->append(append); | 68 dst->append(append); |
| 69 return true; | 69 return true; |
| 70 } | 70 } |
| 71 | 71 |
| 72 // Errors quoting strings for the Sandbox profile are always fatal, report them | 72 // Errors quoting strings for the Sandbox profile are always fatal, report them |
| 73 // in a central place. | 73 // in a central place. |
| 74 NOINLINE void FatalStringQuoteException(const std::string& str) { | 74 NOINLINE void FatalStringQuoteException(const std::string& str) { |
| 75 // Copy bad string to the stack so it's recorded in the crash dump. | 75 // Copy bad string to the stack so it's recorded in the crash dump. |
| 76 char bad_string[256] = {0}; | 76 char bad_string[256] = {0}; |
| 77 base::strlcpy(bad_string, str.c_str(), arraysize(bad_string)); | 77 base::strlcpy(bad_string, str.c_str(), arraysize(bad_string)); |
| 78 DLOG(FATAL) << "String quoting failed " << bad_string; | 78 LOG(FATAL) << "String quoting failed " << bad_string; |
| 79 } | 79 } |
| 80 | 80 |
| 81 } // namespace | 81 } // namespace |
| 82 | 82 |
| 83 namespace sandbox { | 83 namespace sandbox { |
| 84 | 84 |
| 85 | 85 |
| 86 // static | 86 // static |
| 87 bool Sandbox::QuotePlainString(const std::string& src_utf8, std::string* dst) { | 87 bool Sandbox::QuotePlainString(const std::string& src_utf8, std::string* dst) { |
| 88 dst->clear(); | 88 dst->clear(); |
| (...skipping 268 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 357 // Read in the sandbox profile and the common prefix file. | 357 // Read in the sandbox profile and the common prefix file. |
| 358 NSString* common_sandbox_prefix_path = | 358 NSString* common_sandbox_prefix_path = |
| 359 [base::mac::MainAppBundle() pathForResource:@"common" | 359 [base::mac::MainAppBundle() pathForResource:@"common" |
| 360 ofType:@"sb"]; | 360 ofType:@"sb"]; |
| 361 NSString* common_sandbox_prefix_data = | 361 NSString* common_sandbox_prefix_data = |
| 362 [NSString stringWithContentsOfFile:common_sandbox_prefix_path | 362 [NSString stringWithContentsOfFile:common_sandbox_prefix_path |
| 363 encoding:NSUTF8StringEncoding | 363 encoding:NSUTF8StringEncoding |
| 364 error:NULL]; | 364 error:NULL]; |
| 365 | 365 |
| 366 if (!common_sandbox_prefix_data) { | 366 if (!common_sandbox_prefix_data) { |
| 367 DLOG(FATAL) << "Failed to find the sandbox profile on disk " | 367 LOG(FATAL) << "Failed to find the sandbox profile on disk " |
| 368 << [common_sandbox_prefix_path fileSystemRepresentation]; | 368 << [common_sandbox_prefix_path fileSystemRepresentation]; |
| 369 return nil; | 369 return nil; |
| 370 } | 370 } |
| 371 | 371 |
| 372 NSString* sandbox_profile_path = | 372 NSString* sandbox_profile_path = |
| 373 [base::mac::MainAppBundle() pathForResource:sandbox_config_filename | 373 [base::mac::MainAppBundle() pathForResource:sandbox_config_filename |
| 374 ofType:@"sb"]; | 374 ofType:@"sb"]; |
| 375 NSString* sandbox_data = | 375 NSString* sandbox_data = |
| 376 [NSString stringWithContentsOfFile:sandbox_profile_path | 376 [NSString stringWithContentsOfFile:sandbox_profile_path |
| 377 encoding:NSUTF8StringEncoding | 377 encoding:NSUTF8StringEncoding |
| 378 error:NULL]; | 378 error:NULL]; |
| 379 | 379 |
| 380 if (!sandbox_data) { | 380 if (!sandbox_data) { |
| 381 DLOG(FATAL) << "Failed to find the sandbox profile on disk " | 381 LOG(FATAL) << "Failed to find the sandbox profile on disk " |
| 382 << [sandbox_profile_path fileSystemRepresentation]; | 382 << [sandbox_profile_path fileSystemRepresentation]; |
| 383 return nil; | 383 return nil; |
| 384 } | 384 } |
| 385 | 385 |
| 386 // Prefix sandbox_data with common_sandbox_prefix_data. | 386 // Prefix sandbox_data with common_sandbox_prefix_data. |
| 387 return [common_sandbox_prefix_data stringByAppendingString:sandbox_data]; | 387 return [common_sandbox_prefix_data stringByAppendingString:sandbox_data]; |
| 388 } | 388 } |
| 389 | 389 |
| 390 // static | 390 // static |
| 391 bool Sandbox::PostProcessSandboxProfile( | 391 bool Sandbox::PostProcessSandboxProfile( |
| 392 NSString* sandbox_template, | 392 NSString* sandbox_template, |
| 393 NSArray* comments_to_remove, | 393 NSArray* comments_to_remove, |
| 394 SandboxVariableSubstitions& substitutions, | 394 SandboxVariableSubstitions& substitutions, |
| 395 std::string *final_sandbox_profile_str) { | 395 std::string *final_sandbox_profile_str) { |
| 396 NSString* sandbox_data = [[sandbox_template copy] autorelease]; | 396 NSString* sandbox_data = [[sandbox_template copy] autorelease]; |
| 397 | 397 |
| 398 // Remove comments, e.g. ;10.6_ONLY . | 398 // Remove comments, e.g. ;10.6_ONLY . |
| 399 for (NSString* to_remove in comments_to_remove) { | 399 for (NSString* to_remove in comments_to_remove) { |
| 400 sandbox_data = [sandbox_data stringByReplacingOccurrencesOfString:to_remove | 400 sandbox_data = [sandbox_data stringByReplacingOccurrencesOfString:to_remove |
| 401 withString:@""]; | 401 withString:@""]; |
| 402 } | 402 } |
| 403 | 403 |
| 404 // Split string on "@" characters. | 404 // Split string on "@" characters. |
| 405 std::vector<std::string> raw_sandbox_pieces; | 405 std::vector<std::string> raw_sandbox_pieces; |
| 406 if (Tokenize([sandbox_data UTF8String], "@", &raw_sandbox_pieces) == 0) { | 406 if (Tokenize([sandbox_data UTF8String], "@", &raw_sandbox_pieces) == 0) { |
| 407 DLOG(FATAL) << "Bad Sandbox profile, should contain at least one token (" | 407 LOG(FATAL) << "Bad Sandbox profile, should contain at least one token (" |
| 408 << [sandbox_data UTF8String] | 408 << [sandbox_data UTF8String] |
| 409 << ")"; | 409 << ")"; |
| 410 return false; | 410 return false; |
| 411 } | 411 } |
| 412 | 412 |
| 413 // Iterate over string pieces and substitute variables, escaping as necessary. | 413 // Iterate over string pieces and substitute variables, escaping as necessary. |
| 414 size_t output_string_length = 0; | 414 size_t output_string_length = 0; |
| 415 std::vector<std::string> processed_sandbox_pieces(raw_sandbox_pieces.size()); | 415 std::vector<std::string> processed_sandbox_pieces(raw_sandbox_pieces.size()); |
| 416 for (std::vector<std::string>::iterator it = raw_sandbox_pieces.begin(); | 416 for (std::vector<std::string>::iterator it = raw_sandbox_pieces.begin(); |
| 417 it != raw_sandbox_pieces.end(); | 417 it != raw_sandbox_pieces.end(); |
| 418 ++it) { | 418 ++it) { |
| 419 std::string new_piece; | 419 std::string new_piece; |
| (...skipping 121 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 541 std::string final_sandbox_profile_str; | 541 std::string final_sandbox_profile_str; |
| 542 if (!PostProcessSandboxProfile(sandbox_data, tokens_to_remove, substitutions, | 542 if (!PostProcessSandboxProfile(sandbox_data, tokens_to_remove, substitutions, |
| 543 &final_sandbox_profile_str)) { | 543 &final_sandbox_profile_str)) { |
| 544 return false; | 544 return false; |
| 545 } | 545 } |
| 546 | 546 |
| 547 // Initialize sandbox. | 547 // Initialize sandbox. |
| 548 char* error_buff = NULL; | 548 char* error_buff = NULL; |
| 549 int error = sandbox_init(final_sandbox_profile_str.c_str(), 0, &error_buff); | 549 int error = sandbox_init(final_sandbox_profile_str.c_str(), 0, &error_buff); |
| 550 bool success = (error == 0 && error_buff == NULL); | 550 bool success = (error == 0 && error_buff == NULL); |
| 551 DLOG_IF(FATAL, !success) << "Failed to initialize sandbox: " | 551 LOG_IF(FATAL, !success) << "Failed to initialize sandbox: " |
| 552 << error | 552 << error |
| 553 << " " | 553 << " " |
| 554 << error_buff; | 554 << error_buff; |
| 555 sandbox_free_error(error_buff); | 555 sandbox_free_error(error_buff); |
| 556 return success; | 556 return success; |
| 557 } | 557 } |
| 558 | 558 |
| 559 // static | 559 // static |
| 560 void Sandbox::GetCanonicalSandboxPath(FilePath* path) { | 560 void Sandbox::GetCanonicalSandboxPath(FilePath* path) { |
| 561 int fd = HANDLE_EINTR(open(path->value().c_str(), O_RDONLY)); | 561 int fd = HANDLE_EINTR(open(path->value().c_str(), O_RDONLY)); |
| 562 if (fd < 0) { | 562 if (fd < 0) { |
| 563 DPLOG(FATAL) << "GetCanonicalSandboxPath() failed for: " | 563 PLOG(FATAL) << "GetCanonicalSandboxPath() failed for: " |
| 564 << path->value(); | 564 << path->value(); |
| 565 return; | 565 return; |
| 566 } | 566 } |
| 567 file_util::ScopedFD file_closer(&fd); | 567 file_util::ScopedFD file_closer(&fd); |
| 568 | 568 |
| 569 FilePath::CharType canonical_path[MAXPATHLEN]; | 569 FilePath::CharType canonical_path[MAXPATHLEN]; |
| 570 if (HANDLE_EINTR(fcntl(fd, F_GETPATH, canonical_path)) != 0) { | 570 if (HANDLE_EINTR(fcntl(fd, F_GETPATH, canonical_path)) != 0) { |
| 571 DPLOG(FATAL) << "GetCanonicalSandboxPath() failed for: " | 571 PLOG(FATAL) << "GetCanonicalSandboxPath() failed for: " |
| 572 << path->value(); | 572 << path->value(); |
| 573 return; | 573 return; |
| 574 } | 574 } |
| 575 | 575 |
| 576 *path = FilePath(canonical_path); | 576 *path = FilePath(canonical_path); |
| 577 } | 577 } |
| 578 | 578 |
| 579 } // namespace sandbox | 579 } // namespace sandbox |
| OLD | NEW |