Index: sandbox/linux/services/namespace_sandbox.cc |
diff --git a/sandbox/linux/services/namespace_sandbox.cc b/sandbox/linux/services/namespace_sandbox.cc |
index dfee8b27a7b00d283102605c24aafc2f43f443c4..0f371ebfd3198e77d697e25ece5cfec4e141d164 100644 |
--- a/sandbox/linux/services/namespace_sandbox.cc |
+++ b/sandbox/linux/services/namespace_sandbox.cc |
@@ -5,7 +5,6 @@ |
#include "sandbox/linux/services/namespace_sandbox.h" |
#include <sched.h> |
-#include <signal.h> |
#include <stdlib.h> |
#include <sys/types.h> |
#include <unistd.h> |
@@ -18,11 +17,9 @@ |
#include "base/environment.h" |
#include "base/files/scoped_file.h" |
#include "base/logging.h" |
-#include "base/macros.h" |
#include "base/posix/eintr_wrapper.h" |
#include "base/process/launch.h" |
#include "base/process/process.h" |
-#include "sandbox/linux/services/credentials.h" |
#include "sandbox/linux/services/namespace_utils.h" |
namespace sandbox { |
@@ -64,20 +61,6 @@ |
const char kSandboxUSERNSEnvironmentVarName[] = "SBX_USER_NS"; |
const char kSandboxPIDNSEnvironmentVarName[] = "SBX_PID_NS"; |
const char kSandboxNETNSEnvironmentVarName[] = "SBX_NET_NS"; |
- |
-// Linux supports up to 64 signals. This should be updated if that ever changes. |
-int g_signal_exit_codes[64]; |
- |
-void TerminationSignalHandler(int sig) { |
- // Return a special exit code so that the process is detected as terminated by |
- // a signal. |
- const size_t sig_idx = static_cast<size_t>(sig); |
- if (sig_idx < arraysize(g_signal_exit_codes)) { |
- _exit(g_signal_exit_codes[sig_idx]); |
- } |
- |
- _exit(NamespaceSandbox::kDefaultExitCode); |
-} |
} // namespace |
@@ -128,65 +111,6 @@ |
} |
// static |
-pid_t NamespaceSandbox::ForkInNewPidNamespace(bool drop_capabilities_in_child) { |
- const pid_t pid = |
- base::ForkWithFlags(CLONE_NEWPID | SIGCHLD, nullptr, nullptr); |
- if (pid < 0) { |
- return pid; |
- } |
- |
- if (pid == 0) { |
- DCHECK_EQ(1, getpid()); |
- if (drop_capabilities_in_child) { |
- // Since we just forked, we are single-threaded, so this should be safe. |
- CHECK(Credentials::DropAllCapabilitiesOnCurrentThread()); |
- } |
- return 0; |
- } |
- |
- return pid; |
-} |
- |
-// static |
-void NamespaceSandbox::InstallDefaultTerminationSignalHandlers() { |
- static const int kDefaultTermSignals[] = { |
- SIGHUP, SIGINT, SIGABRT, SIGQUIT, SIGPIPE, SIGTERM, SIGUSR1, SIGUSR2, |
- }; |
- |
- for (const int sig : kDefaultTermSignals) { |
- InstallTerminationSignalHandler(sig, kDefaultExitCode); |
- } |
-} |
- |
-// static |
-bool NamespaceSandbox::InstallTerminationSignalHandler( |
- int sig, |
- int exit_code) { |
- struct sigaction old_action; |
- PCHECK(sigaction(sig, nullptr, &old_action) == 0); |
- |
- if (old_action.sa_flags & SA_SIGINFO && |
- old_action.sa_sigaction != nullptr) { |
- return false; |
- } else if (old_action.sa_handler != SIG_DFL) { |
- return false; |
- } |
- |
- const size_t sig_idx = static_cast<size_t>(sig); |
- CHECK_LT(sig_idx, arraysize(g_signal_exit_codes)); |
- |
- DCHECK_GE(exit_code, 0); |
- DCHECK_LT(exit_code, 256); |
- |
- g_signal_exit_codes[sig_idx] = exit_code; |
- |
- struct sigaction action = {}; |
- action.sa_handler = &TerminationSignalHandler; |
- PCHECK(sigaction(sig, &action, nullptr) == 0); |
- return true; |
-} |
- |
-// static |
bool NamespaceSandbox::InNewUserNamespace() { |
return getenv(kSandboxUSERNSEnvironmentVarName) != nullptr; |
} |