handler/mac: Log a warning when an exception message has a suspicious

handler/mac: Log a warning when an exception message has a suspicious
origin.

This adds AuditPIDFromMachMessageTrailer() to get the process ID of a
Mach message’s sender. Exception messages are considered suspicious when
not sent by the kernel or the exception process.

TEST=crashpad_util_test
R=rsesek@chromium.org

Committed: https://chromium.googlesource.com/crashpad/crashpad/+/5f19d639e1125eef56ee3d6cb43934dcf30c08e8

[Mark Mentovai, 2015-03-12 15:50:46]

mark@chromium.org changed reviewers:
+ rsesek@chromium.org

[Robert Sesek, 2015-03-12 16:01:06]

https://codereview.chromium.org/1001943002/diff/1/util/mach/notify_server_tes...
File util/mach/notify_server_test.cc (right):

https://codereview.chromium.org/1001943002/diff/1/util/mach/notify_server_tes...
util/mach/notify_server_test.cc:242:
MACH_RCV_TRAILER_ELEMENTS(MACH_RCV_TRAILER_AUDIT),
Would it be useful to collapse this expression into a MachMessageServer
constant?

[Mark Mentovai, 2015-03-12 17:46:53]

Patchset #2 (id:20001) has been deleted

[Mark Mentovai, 2015-03-12 17:50:52]

Updated.

https://codereview.chromium.org/1001943002/diff/1/util/mach/notify_server_tes...
File util/mach/notify_server_test.cc (right):

https://codereview.chromium.org/1001943002/diff/1/util/mach/notify_server_tes...
util/mach/notify_server_test.cc:242:
MACH_RCV_TRAILER_ELEMENTS(MACH_RCV_TRAILER_AUDIT),
Robert Sesek wrote:
> Would it be useful to collapse this expression into a MachMessageServer
> constant?

Good idea, done.

[Robert Sesek, 2015-03-12 17:57:51]

LGTM

[Mark Mentovai, 2015-03-12 18:03:43]

Committed patchset #3 (id:60001) manually as
5f19d639e1125eef56ee3d6cb43934dcf30c08e8 (presubmit successful).