OLD | NEW |
1 // Copyright (c) 2011 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2011 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "content/common/sandbox_mac.h" | 5 #include "content/common/sandbox_mac.h" |
6 | 6 |
7 #import <Cocoa/Cocoa.h> | 7 #import <Cocoa/Cocoa.h> |
8 | 8 |
9 extern "C" { | 9 extern "C" { |
10 #include <sandbox.h> | 10 #include <sandbox.h> |
(...skipping 57 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
68 dst->append(append); | 68 dst->append(append); |
69 return true; | 69 return true; |
70 } | 70 } |
71 | 71 |
72 // Errors quoting strings for the Sandbox profile are always fatal, report them | 72 // Errors quoting strings for the Sandbox profile are always fatal, report them |
73 // in a central place. | 73 // in a central place. |
74 NOINLINE void FatalStringQuoteException(const std::string& str) { | 74 NOINLINE void FatalStringQuoteException(const std::string& str) { |
75 // Copy bad string to the stack so it's recorded in the crash dump. | 75 // Copy bad string to the stack so it's recorded in the crash dump. |
76 char bad_string[256] = {0}; | 76 char bad_string[256] = {0}; |
77 base::strlcpy(bad_string, str.c_str(), arraysize(bad_string)); | 77 base::strlcpy(bad_string, str.c_str(), arraysize(bad_string)); |
78 LOG(FATAL) << "String quoting failed " << bad_string; | 78 DLOG(FATAL) << "String quoting failed " << bad_string; |
79 } | 79 } |
80 | 80 |
81 } // namespace | 81 } // namespace |
82 | 82 |
83 namespace sandbox { | 83 namespace sandbox { |
84 | 84 |
85 | 85 |
86 // static | 86 // static |
87 bool Sandbox::QuotePlainString(const std::string& src_utf8, std::string* dst) { | 87 bool Sandbox::QuotePlainString(const std::string& src_utf8, std::string* dst) { |
88 dst->clear(); | 88 dst->clear(); |
(...skipping 268 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
357 // Read in the sandbox profile and the common prefix file. | 357 // Read in the sandbox profile and the common prefix file. |
358 NSString* common_sandbox_prefix_path = | 358 NSString* common_sandbox_prefix_path = |
359 [base::mac::MainAppBundle() pathForResource:@"common" | 359 [base::mac::MainAppBundle() pathForResource:@"common" |
360 ofType:@"sb"]; | 360 ofType:@"sb"]; |
361 NSString* common_sandbox_prefix_data = | 361 NSString* common_sandbox_prefix_data = |
362 [NSString stringWithContentsOfFile:common_sandbox_prefix_path | 362 [NSString stringWithContentsOfFile:common_sandbox_prefix_path |
363 encoding:NSUTF8StringEncoding | 363 encoding:NSUTF8StringEncoding |
364 error:NULL]; | 364 error:NULL]; |
365 | 365 |
366 if (!common_sandbox_prefix_data) { | 366 if (!common_sandbox_prefix_data) { |
367 LOG(FATAL) << "Failed to find the sandbox profile on disk " | 367 DLOG(FATAL) << "Failed to find the sandbox profile on disk " |
368 << [common_sandbox_prefix_path fileSystemRepresentation]; | 368 << [common_sandbox_prefix_path fileSystemRepresentation]; |
369 return nil; | 369 return nil; |
370 } | 370 } |
371 | 371 |
372 NSString* sandbox_profile_path = | 372 NSString* sandbox_profile_path = |
373 [base::mac::MainAppBundle() pathForResource:sandbox_config_filename | 373 [base::mac::MainAppBundle() pathForResource:sandbox_config_filename |
374 ofType:@"sb"]; | 374 ofType:@"sb"]; |
375 NSString* sandbox_data = | 375 NSString* sandbox_data = |
376 [NSString stringWithContentsOfFile:sandbox_profile_path | 376 [NSString stringWithContentsOfFile:sandbox_profile_path |
377 encoding:NSUTF8StringEncoding | 377 encoding:NSUTF8StringEncoding |
378 error:NULL]; | 378 error:NULL]; |
379 | 379 |
380 if (!sandbox_data) { | 380 if (!sandbox_data) { |
381 LOG(FATAL) << "Failed to find the sandbox profile on disk " | 381 DLOG(FATAL) << "Failed to find the sandbox profile on disk " |
382 << [sandbox_profile_path fileSystemRepresentation]; | 382 << [sandbox_profile_path fileSystemRepresentation]; |
383 return nil; | 383 return nil; |
384 } | 384 } |
385 | 385 |
386 // Prefix sandbox_data with common_sandbox_prefix_data. | 386 // Prefix sandbox_data with common_sandbox_prefix_data. |
387 return [common_sandbox_prefix_data stringByAppendingString:sandbox_data]; | 387 return [common_sandbox_prefix_data stringByAppendingString:sandbox_data]; |
388 } | 388 } |
389 | 389 |
390 // static | 390 // static |
391 bool Sandbox::PostProcessSandboxProfile( | 391 bool Sandbox::PostProcessSandboxProfile( |
392 NSString* sandbox_template, | 392 NSString* sandbox_template, |
393 NSArray* comments_to_remove, | 393 NSArray* comments_to_remove, |
394 SandboxVariableSubstitions& substitutions, | 394 SandboxVariableSubstitions& substitutions, |
395 std::string *final_sandbox_profile_str) { | 395 std::string *final_sandbox_profile_str) { |
396 NSString* sandbox_data = [[sandbox_template copy] autorelease]; | 396 NSString* sandbox_data = [[sandbox_template copy] autorelease]; |
397 | 397 |
398 // Remove comments, e.g. ;10.6_ONLY . | 398 // Remove comments, e.g. ;10.6_ONLY . |
399 for (NSString* to_remove in comments_to_remove) { | 399 for (NSString* to_remove in comments_to_remove) { |
400 sandbox_data = [sandbox_data stringByReplacingOccurrencesOfString:to_remove | 400 sandbox_data = [sandbox_data stringByReplacingOccurrencesOfString:to_remove |
401 withString:@""]; | 401 withString:@""]; |
402 } | 402 } |
403 | 403 |
404 // Split string on "@" characters. | 404 // Split string on "@" characters. |
405 std::vector<std::string> raw_sandbox_pieces; | 405 std::vector<std::string> raw_sandbox_pieces; |
406 if (Tokenize([sandbox_data UTF8String], "@", &raw_sandbox_pieces) == 0) { | 406 if (Tokenize([sandbox_data UTF8String], "@", &raw_sandbox_pieces) == 0) { |
407 LOG(FATAL) << "Bad Sandbox profile, should contain at least one token (" | 407 DLOG(FATAL) << "Bad Sandbox profile, should contain at least one token (" |
408 << [sandbox_data UTF8String] | 408 << [sandbox_data UTF8String] |
409 << ")"; | 409 << ")"; |
410 return false; | 410 return false; |
411 } | 411 } |
412 | 412 |
413 // Iterate over string pieces and substitute variables, escaping as necessary. | 413 // Iterate over string pieces and substitute variables, escaping as necessary. |
414 size_t output_string_length = 0; | 414 size_t output_string_length = 0; |
415 std::vector<std::string> processed_sandbox_pieces(raw_sandbox_pieces.size()); | 415 std::vector<std::string> processed_sandbox_pieces(raw_sandbox_pieces.size()); |
416 for (std::vector<std::string>::iterator it = raw_sandbox_pieces.begin(); | 416 for (std::vector<std::string>::iterator it = raw_sandbox_pieces.begin(); |
417 it != raw_sandbox_pieces.end(); | 417 it != raw_sandbox_pieces.end(); |
418 ++it) { | 418 ++it) { |
419 std::string new_piece; | 419 std::string new_piece; |
(...skipping 121 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
541 std::string final_sandbox_profile_str; | 541 std::string final_sandbox_profile_str; |
542 if (!PostProcessSandboxProfile(sandbox_data, tokens_to_remove, substitutions, | 542 if (!PostProcessSandboxProfile(sandbox_data, tokens_to_remove, substitutions, |
543 &final_sandbox_profile_str)) { | 543 &final_sandbox_profile_str)) { |
544 return false; | 544 return false; |
545 } | 545 } |
546 | 546 |
547 // Initialize sandbox. | 547 // Initialize sandbox. |
548 char* error_buff = NULL; | 548 char* error_buff = NULL; |
549 int error = sandbox_init(final_sandbox_profile_str.c_str(), 0, &error_buff); | 549 int error = sandbox_init(final_sandbox_profile_str.c_str(), 0, &error_buff); |
550 bool success = (error == 0 && error_buff == NULL); | 550 bool success = (error == 0 && error_buff == NULL); |
551 LOG_IF(FATAL, !success) << "Failed to initialize sandbox: " | 551 DLOG_IF(FATAL, !success) << "Failed to initialize sandbox: " |
552 << error | 552 << error |
553 << " " | 553 << " " |
554 << error_buff; | 554 << error_buff; |
555 sandbox_free_error(error_buff); | 555 sandbox_free_error(error_buff); |
556 return success; | 556 return success; |
557 } | 557 } |
558 | 558 |
559 // static | 559 // static |
560 void Sandbox::GetCanonicalSandboxPath(FilePath* path) { | 560 void Sandbox::GetCanonicalSandboxPath(FilePath* path) { |
561 int fd = HANDLE_EINTR(open(path->value().c_str(), O_RDONLY)); | 561 int fd = HANDLE_EINTR(open(path->value().c_str(), O_RDONLY)); |
562 if (fd < 0) { | 562 if (fd < 0) { |
563 PLOG(FATAL) << "GetCanonicalSandboxPath() failed for: " | 563 DPLOG(FATAL) << "GetCanonicalSandboxPath() failed for: " |
564 << path->value(); | 564 << path->value(); |
565 return; | 565 return; |
566 } | 566 } |
567 file_util::ScopedFD file_closer(&fd); | 567 file_util::ScopedFD file_closer(&fd); |
568 | 568 |
569 FilePath::CharType canonical_path[MAXPATHLEN]; | 569 FilePath::CharType canonical_path[MAXPATHLEN]; |
570 if (HANDLE_EINTR(fcntl(fd, F_GETPATH, canonical_path)) != 0) { | 570 if (HANDLE_EINTR(fcntl(fd, F_GETPATH, canonical_path)) != 0) { |
571 PLOG(FATAL) << "GetCanonicalSandboxPath() failed for: " | 571 DPLOG(FATAL) << "GetCanonicalSandboxPath() failed for: " |
572 << path->value(); | 572 << path->value(); |
573 return; | 573 return; |
574 } | 574 } |
575 | 575 |
576 *path = FilePath(canonical_path); | 576 *path = FilePath(canonical_path); |
577 } | 577 } |
578 | 578 |
579 } // namespace sandbox | 579 } // namespace sandbox |
OLD | NEW |