| OLD | NEW |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #ifndef SECCOMP_BPF_STANDALONE | |
| 6 #include "base/logging.h" | |
| 7 #include "base/posix/eintr_wrapper.h" | |
| 8 #endif | |
| 9 | |
| 10 #include "sandbox/linux/seccomp-bpf/codegen.h" | 5 #include "sandbox/linux/seccomp-bpf/codegen.h" |
| 11 #include "sandbox/linux/seccomp-bpf/sandbox_bpf.h" | 6 #include "sandbox/linux/seccomp-bpf/sandbox_bpf.h" |
| 12 #include "sandbox/linux/seccomp-bpf/syscall_iterator.h" | 7 #include "sandbox/linux/seccomp-bpf/syscall_iterator.h" |
| 13 #include "sandbox/linux/seccomp-bpf/verifier.h" | 8 #include "sandbox/linux/seccomp-bpf/verifier.h" |
| 14 | 9 |
| 15 namespace { | 10 namespace { |
| 16 | 11 |
| 17 void WriteFailedStderrSetupMessage(int out_fd) { | 12 void WriteFailedStderrSetupMessage(int out_fd) { |
| 18 const char* error_string = strerror(errno); | 13 const char* error_string = strerror(errno); |
| 19 static const char msg[] = "You have reproduced a puzzling issue.\n" | 14 static const char msg[] = "Failed to set up stderr: "; |
| 20 "Please, report to crbug.com/152530!\n" | |
| 21 "Failed to set up stderr: "; | |
| 22 if (HANDLE_EINTR(write(out_fd, msg, sizeof(msg)-1)) > 0 && error_string && | 15 if (HANDLE_EINTR(write(out_fd, msg, sizeof(msg)-1)) > 0 && error_string && |
| 23 HANDLE_EINTR(write(out_fd, error_string, strlen(error_string))) > 0 && | 16 HANDLE_EINTR(write(out_fd, error_string, strlen(error_string))) > 0 && |
| 24 HANDLE_EINTR(write(out_fd, "\n", 1))) { | 17 HANDLE_EINTR(write(out_fd, "\n", 1))) { |
| 25 } | 18 } |
| 26 } | 19 } |
| 27 | 20 |
| 28 } // namespace | 21 } // namespace |
| 29 | 22 |
| 30 // The kernel gives us a sandbox, we turn it into a playground :-) | 23 // The kernel gives us a sandbox, we turn it into a playground :-) |
| 31 // This is version 2 of the playground; version 1 was built on top of | 24 // This is version 2 of the playground; version 1 was built on top of |
| (...skipping 75 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 107 sigprocmask(SIG_SETMASK, &oldMask, NULL); // OK, if it fails | 100 sigprocmask(SIG_SETMASK, &oldMask, NULL); // OK, if it fails |
| 108 SANDBOX_DIE("fork() failed unexpectedly"); | 101 SANDBOX_DIE("fork() failed unexpectedly"); |
| 109 } | 102 } |
| 110 | 103 |
| 111 // In the child process | 104 // In the child process |
| 112 if (!pid) { | 105 if (!pid) { |
| 113 // Test a very simple sandbox policy to verify that we can | 106 // Test a very simple sandbox policy to verify that we can |
| 114 // successfully turn on sandboxing. | 107 // successfully turn on sandboxing. |
| 115 Die::EnableSimpleExit(); | 108 Die::EnableSimpleExit(); |
| 116 | 109 |
| 117 errno = 0; | |
| 118 if (HANDLE_EINTR(close(fds[0]))) { | 110 if (HANDLE_EINTR(close(fds[0]))) { |
| 119 // This call to close() has been failing in strange ways. See | |
| 120 // crbug.com/152530. So we only fail in debug mode now. | |
| 121 #if !defined(NDEBUG) | |
| 122 WriteFailedStderrSetupMessage(fds[1]); | 111 WriteFailedStderrSetupMessage(fds[1]); |
| 123 SANDBOX_DIE(NULL); | 112 SANDBOX_DIE(NULL); |
| 124 #endif | |
| 125 } | 113 } |
| 126 if (HANDLE_EINTR(dup2(fds[1], 2)) != 2) { | 114 if (HANDLE_EINTR(dup2(fds[1], 2)) != 2) { |
| 127 // Stderr could very well be a file descriptor to .xsession-errors, or | 115 // Stderr could very well be a file descriptor to .xsession-errors, or |
| 128 // another file, which could be backed by a file system that could cause | 116 // another file, which could be backed by a file system that could cause |
| 129 // dup2 to fail while trying to close stderr. It's important that we do | 117 // dup2 to fail while trying to close stderr. It's important that we do |
| 130 // not fail on trying to close stderr. | 118 // not fail on trying to close stderr. |
| 131 // If dup2 fails here, we will continue normally, this means that our | 119 // If dup2 fails here, we will continue normally, this means that our |
| 132 // parent won't cause a fatal failure if something writes to stderr in | 120 // parent won't cause a fatal failure if something writes to stderr in |
| 133 // this child. | 121 // this child. |
| 134 #if !defined(NDEBUG) | 122 } |
| 135 // In DEBUG builds, we still want to get a report. | 123 if (HANDLE_EINTR(close(fds[1]))) { |
| 136 WriteFailedStderrSetupMessage(fds[1]); | 124 WriteFailedStderrSetupMessage(fds[1]); |
| 137 SANDBOX_DIE(NULL); | 125 SANDBOX_DIE(NULL); |
| 138 #endif | |
| 139 } | |
| 140 if (HANDLE_EINTR(close(fds[1]))) { | |
| 141 // This call to close() has been failing in strange ways. See | |
| 142 // crbug.com/152530. So we only fail in debug mode now. | |
| 143 #if !defined(NDEBUG) | |
| 144 WriteFailedStderrSetupMessage(fds[1]); | |
| 145 SANDBOX_DIE(NULL); | |
| 146 #endif | |
| 147 } | 126 } |
| 148 | 127 |
| 149 evaluators_.clear(); | 128 evaluators_.clear(); |
| 150 setSandboxPolicy(syscallEvaluator, NULL); | 129 setSandboxPolicy(syscallEvaluator, NULL); |
| 151 setProcFd(proc_fd); | 130 setProcFd(proc_fd); |
| 152 | 131 |
| 153 // By passing "quiet=true" to "startSandboxInternal()" we suppress | 132 // By passing "quiet=true" to "startSandboxInternal()" we suppress |
| 154 // messages for expected and benign failures (e.g. if the current | 133 // messages for expected and benign failures (e.g. if the current |
| 155 // kernel lacks support for BPF filters). | 134 // kernel lacks support for BPF filters). |
| 156 startSandboxInternal(true); | 135 startSandboxInternal(true); |
| (...skipping 508 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 665 Sandbox::SandboxStatus Sandbox::status_ = STATUS_UNKNOWN; | 644 Sandbox::SandboxStatus Sandbox::status_ = STATUS_UNKNOWN; |
| 666 int Sandbox::proc_fd_ = -1; | 645 int Sandbox::proc_fd_ = -1; |
| 667 Sandbox::Evaluators Sandbox::evaluators_; | 646 Sandbox::Evaluators Sandbox::evaluators_; |
| 668 Sandbox::ErrMap Sandbox::errMap_; | 647 Sandbox::ErrMap Sandbox::errMap_; |
| 669 Sandbox::Traps *Sandbox::traps_ = NULL; | 648 Sandbox::Traps *Sandbox::traps_ = NULL; |
| 670 Sandbox::TrapIds Sandbox::trapIds_; | 649 Sandbox::TrapIds Sandbox::trapIds_; |
| 671 ErrorCode *Sandbox::trapArray_ = NULL; | 650 ErrorCode *Sandbox::trapArray_ = NULL; |
| 672 size_t Sandbox::trapArraySize_ = 0; | 651 size_t Sandbox::trapArraySize_ = 0; |
| 673 | 652 |
| 674 } // namespace | 653 } // namespace |
| OLD | NEW |