| OLD | NEW |
| 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "sandbox/linux/services/credentials.h" | 5 #include "sandbox/linux/services/credentials.h" |
| 6 | 6 |
| 7 #include <errno.h> | 7 #include <errno.h> |
| 8 #include <signal.h> | 8 #include <signal.h> |
| 9 #include <stdio.h> | 9 #include <stdio.h> |
| 10 #include <sys/syscall.h> | 10 #include <sys/syscall.h> |
| (...skipping 102 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 113 // Converts a LinuxCapability to the corresponding Linux CAP_XXX value. | 113 // Converts a LinuxCapability to the corresponding Linux CAP_XXX value. |
| 114 int LinuxCapabilityToKernelValue(LinuxCapability cap) { | 114 int LinuxCapabilityToKernelValue(LinuxCapability cap) { |
| 115 switch (cap) { | 115 switch (cap) { |
| 116 case LinuxCapability::kCapSysChroot: | 116 case LinuxCapability::kCapSysChroot: |
| 117 return CAP_SYS_CHROOT; | 117 return CAP_SYS_CHROOT; |
| 118 case LinuxCapability::kCapSysAdmin: | 118 case LinuxCapability::kCapSysAdmin: |
| 119 return CAP_SYS_ADMIN; | 119 return CAP_SYS_ADMIN; |
| 120 } | 120 } |
| 121 | 121 |
| 122 LOG(FATAL) << "Invalid LinuxCapability: " << static_cast<int>(cap); | 122 LOG(FATAL) << "Invalid LinuxCapability: " << static_cast<int>(cap); |
| 123 return 0; |
| 123 } | 124 } |
| 124 | 125 |
| 125 } // namespace. | 126 } // namespace. |
| 126 | 127 |
| 127 bool Credentials::DropAllCapabilities(int proc_fd) { | 128 bool Credentials::DropAllCapabilities(int proc_fd) { |
| 128 if (!SetCapabilities(proc_fd, std::vector<LinuxCapability>())) { | 129 if (!SetCapabilities(proc_fd, std::vector<LinuxCapability>())) { |
| 129 return false; | 130 return false; |
| 130 } | 131 } |
| 131 | 132 |
| 132 CHECK(!HasAnyCapability()); | 133 CHECK(!HasAnyCapability()); |
| (...skipping 141 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 274 CHECK_LE(0, proc_fd); | 275 CHECK_LE(0, proc_fd); |
| 275 | 276 |
| 276 CHECK(ChrootToSafeEmptyDir()); | 277 CHECK(ChrootToSafeEmptyDir()); |
| 277 CHECK(!base::DirectoryExists(base::FilePath("/proc"))); | 278 CHECK(!base::DirectoryExists(base::FilePath("/proc"))); |
| 278 CHECK(!ProcUtil::HasOpenDirectory(proc_fd)); | 279 CHECK(!ProcUtil::HasOpenDirectory(proc_fd)); |
| 279 // We never let this function fail. | 280 // We never let this function fail. |
| 280 return true; | 281 return true; |
| 281 } | 282 } |
| 282 | 283 |
| 283 } // namespace sandbox. | 284 } // namespace sandbox. |
| OLD | NEW |