OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "content/common/sandbox_mac.h" | 5 #include "content/common/sandbox_mac.h" |
6 | 6 |
7 #import <Cocoa/Cocoa.h> | 7 #import <Cocoa/Cocoa.h> |
8 | 8 |
9 extern "C" { | 9 extern "C" { |
10 #include <sandbox.h> | 10 #include <sandbox.h> |
(...skipping 264 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
275 gfx::GLSurface::InitializeOneOff(); | 275 gfx::GLSurface::InitializeOneOff(); |
276 } | 276 } |
277 } | 277 } |
278 | 278 |
279 // static | 279 // static |
280 NSString* Sandbox::BuildAllowDirectoryAccessSandboxString( | 280 NSString* Sandbox::BuildAllowDirectoryAccessSandboxString( |
281 const FilePath& allowed_dir, | 281 const FilePath& allowed_dir, |
282 SandboxVariableSubstitions* substitutions) { | 282 SandboxVariableSubstitions* substitutions) { |
283 // A whitelist is used to determine which directories can be statted | 283 // A whitelist is used to determine which directories can be statted |
284 // This means that in the case of an /a/b/c/d/ directory, we may be able to | 284 // This means that in the case of an /a/b/c/d/ directory, we may be able to |
285 // stat the leaf directory, but not it's parent. | 285 // stat the leaf directory, but not its parent. |
286 // The extension code in Chrome calls realpath() which fails if it can't call | 286 // The extension code in Chrome calls realpath() which fails if it can't call |
287 // stat() on one of the parent directories in the path. | 287 // stat() on one of the parent directories in the path. |
288 // The solution to this is to allow statting the parent directories themselves | 288 // The solution to this is to allow statting the parent directories themselves |
289 // but not their contents. We need to add a separate rule for each parent | 289 // but not their contents. We need to add a separate rule for each parent |
290 // directory. | 290 // directory. |
291 | 291 |
292 // The sandbox only understands "real" paths. This resolving step is | 292 // The sandbox only understands "real" paths. This resolving step is |
293 // needed so the caller doesn't need to worry about things like /var | 293 // needed so the caller doesn't need to worry about things like /var |
294 // being a link to /private/var (like in the paths CreateNewTempDirectory() | 294 // being a link to /private/var (like in the paths CreateNewTempDirectory() |
295 // returns). | 295 // returns). |
(...skipping 21 matching lines...) Expand all Loading... |
317 return nil; | 317 return nil; |
318 } | 318 } |
319 | 319 |
320 NSString* subdir_escaped_ns = | 320 NSString* subdir_escaped_ns = |
321 base::SysUTF8ToNSString(subdir_escaped.c_str()); | 321 base::SysUTF8ToNSString(subdir_escaped.c_str()); |
322 sandbox_command = | 322 sandbox_command = |
323 [sandbox_command stringByAppendingFormat:@"(literal \"%@\")", | 323 [sandbox_command stringByAppendingFormat:@"(literal \"%@\")", |
324 subdir_escaped_ns]; | 324 subdir_escaped_ns]; |
325 } | 325 } |
326 | 326 |
327 // Finally append the leaf directory. Unlike it's parents (for which only | 327 // Finally append the leaf directory. Unlike its parents (for which only |
328 // stat() should be allowed), the leaf directory needs full access. | 328 // stat() should be allowed), the leaf directory needs full access. |
329 (*substitutions)["ALLOWED_DIR"] = | 329 (*substitutions)["ALLOWED_DIR"] = |
330 SandboxSubstring(allowed_dir_canonical.value(), | 330 SandboxSubstring(allowed_dir_canonical.value(), |
331 SandboxSubstring::REGEX); | 331 SandboxSubstring::REGEX); |
332 sandbox_command = | 332 sandbox_command = |
333 [sandbox_command | 333 [sandbox_command |
334 stringByAppendingString:@") (allow file-read* file-write*" | 334 stringByAppendingString:@") (allow file-read* file-write*" |
335 " (regex #\"@ALLOWED_DIR@\") )"]; | 335 " (regex #\"@ALLOWED_DIR@\") )"]; |
336 return sandbox_command; | 336 return sandbox_command; |
337 } | 337 } |
(...skipping 237 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
575 if (HANDLE_EINTR(fcntl(fd, F_GETPATH, canonical_path)) != 0) { | 575 if (HANDLE_EINTR(fcntl(fd, F_GETPATH, canonical_path)) != 0) { |
576 DPLOG(FATAL) << "GetCanonicalSandboxPath() failed for: " | 576 DPLOG(FATAL) << "GetCanonicalSandboxPath() failed for: " |
577 << path->value(); | 577 << path->value(); |
578 return; | 578 return; |
579 } | 579 } |
580 | 580 |
581 *path = FilePath(canonical_path); | 581 *path = FilePath(canonical_path); |
582 } | 582 } |
583 | 583 |
584 } // namespace sandbox | 584 } // namespace sandbox |
OLD | NEW |