Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(329)

Side by Side Diff: sandbox/linux/seccomp-bpf/sandbox_bpf.cc

Issue 11612010: Revert 173536 (Closed) Base URL: svn://svn.chromium.org/chrome/branches/1312/src/
Patch Set: Created 8 years ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch | Annotate | Revision Log
« no previous file with comments | « no previous file | no next file » | no next file with comments »
Toggle Intra-line Diffs ('i') | Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
OLDNEW
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be 2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file. 3 // found in the LICENSE file.
4 4
5 #ifndef SECCOMP_BPF_STANDALONE
6 #include "base/logging.h"
7 #include "base/posix/eintr_wrapper.h"
8 #endif
9
10 #include "sandbox/linux/seccomp-bpf/codegen.h" 5 #include "sandbox/linux/seccomp-bpf/codegen.h"
11 #include "sandbox/linux/seccomp-bpf/sandbox_bpf.h" 6 #include "sandbox/linux/seccomp-bpf/sandbox_bpf.h"
12 #include "sandbox/linux/seccomp-bpf/syscall_iterator.h" 7 #include "sandbox/linux/seccomp-bpf/syscall_iterator.h"
13 #include "sandbox/linux/seccomp-bpf/verifier.h" 8 #include "sandbox/linux/seccomp-bpf/verifier.h"
14 9
15 namespace { 10 namespace {
16 11
17 void WriteFailedStderrSetupMessage(int out_fd) { 12 void WriteFailedStderrSetupMessage(int out_fd) {
18 const char* error_string = strerror(errno); 13 const char* error_string = strerror(errno);
19 static const char msg[] = "You have reproduced a puzzling issue.\n" 14 static const char msg[] = "Failed to set up stderr: ";
20 "Please, report to crbug.com/152530!\n"
21 "Failed to set up stderr: ";
22 if (HANDLE_EINTR(write(out_fd, msg, sizeof(msg)-1)) > 0 && error_string && 15 if (HANDLE_EINTR(write(out_fd, msg, sizeof(msg)-1)) > 0 && error_string &&
23 HANDLE_EINTR(write(out_fd, error_string, strlen(error_string))) > 0 && 16 HANDLE_EINTR(write(out_fd, error_string, strlen(error_string))) > 0 &&
24 HANDLE_EINTR(write(out_fd, "\n", 1))) { 17 HANDLE_EINTR(write(out_fd, "\n", 1))) {
25 } 18 }
26 } 19 }
27 20
28 } // namespace 21 } // namespace
29 22
30 // The kernel gives us a sandbox, we turn it into a playground :-) 23 // The kernel gives us a sandbox, we turn it into a playground :-)
31 // This is version 2 of the playground; version 1 was built on top of 24 // This is version 2 of the playground; version 1 was built on top of
(...skipping 75 matching lines...) Expand 10 before | Expand all | Expand 10 after
107 sigprocmask(SIG_SETMASK, &oldMask, NULL); // OK, if it fails 100 sigprocmask(SIG_SETMASK, &oldMask, NULL); // OK, if it fails
108 SANDBOX_DIE("fork() failed unexpectedly"); 101 SANDBOX_DIE("fork() failed unexpectedly");
109 } 102 }
110 103
111 // In the child process 104 // In the child process
112 if (!pid) { 105 if (!pid) {
113 // Test a very simple sandbox policy to verify that we can 106 // Test a very simple sandbox policy to verify that we can
114 // successfully turn on sandboxing. 107 // successfully turn on sandboxing.
115 Die::EnableSimpleExit(); 108 Die::EnableSimpleExit();
116 109
117 errno = 0;
118 if (HANDLE_EINTR(close(fds[0]))) { 110 if (HANDLE_EINTR(close(fds[0]))) {
119 // This call to close() has been failing in strange ways. See
120 // crbug.com/152530. So we only fail in debug mode now.
121 #if !defined(NDEBUG)
122 WriteFailedStderrSetupMessage(fds[1]); 111 WriteFailedStderrSetupMessage(fds[1]);
123 SANDBOX_DIE(NULL); 112 SANDBOX_DIE(NULL);
124 #endif
125 } 113 }
126 if (HANDLE_EINTR(dup2(fds[1], 2)) != 2) { 114 if (HANDLE_EINTR(dup2(fds[1], 2)) != 2) {
127 // Stderr could very well be a file descriptor to .xsession-errors, or 115 // Stderr could very well be a file descriptor to .xsession-errors, or
128 // another file, which could be backed by a file system that could cause 116 // another file, which could be backed by a file system that could cause
129 // dup2 to fail while trying to close stderr. It's important that we do 117 // dup2 to fail while trying to close stderr. It's important that we do
130 // not fail on trying to close stderr. 118 // not fail on trying to close stderr.
131 // If dup2 fails here, we will continue normally, this means that our 119 // If dup2 fails here, we will continue normally, this means that our
132 // parent won't cause a fatal failure if something writes to stderr in 120 // parent won't cause a fatal failure if something writes to stderr in
133 // this child. 121 // this child.
134 #if !defined(NDEBUG) 122 }
135 // In DEBUG builds, we still want to get a report. 123 if (HANDLE_EINTR(close(fds[1]))) {
136 WriteFailedStderrSetupMessage(fds[1]); 124 WriteFailedStderrSetupMessage(fds[1]);
137 SANDBOX_DIE(NULL); 125 SANDBOX_DIE(NULL);
138 #endif
139 }
140 if (HANDLE_EINTR(close(fds[1]))) {
141 // This call to close() has been failing in strange ways. See
142 // crbug.com/152530. So we only fail in debug mode now.
143 #if !defined(NDEBUG)
144 WriteFailedStderrSetupMessage(fds[1]);
145 SANDBOX_DIE(NULL);
146 #endif
147 } 126 }
148 127
149 evaluators_.clear(); 128 evaluators_.clear();
150 setSandboxPolicy(syscallEvaluator, NULL); 129 setSandboxPolicy(syscallEvaluator, NULL);
151 setProcFd(proc_fd); 130 setProcFd(proc_fd);
152 131
153 // By passing "quiet=true" to "startSandboxInternal()" we suppress 132 // By passing "quiet=true" to "startSandboxInternal()" we suppress
154 // messages for expected and benign failures (e.g. if the current 133 // messages for expected and benign failures (e.g. if the current
155 // kernel lacks support for BPF filters). 134 // kernel lacks support for BPF filters).
156 startSandboxInternal(true); 135 startSandboxInternal(true);
(...skipping 508 matching lines...) Expand 10 before | Expand all | Expand 10 after
665 Sandbox::SandboxStatus Sandbox::status_ = STATUS_UNKNOWN; 644 Sandbox::SandboxStatus Sandbox::status_ = STATUS_UNKNOWN;
666 int Sandbox::proc_fd_ = -1; 645 int Sandbox::proc_fd_ = -1;
667 Sandbox::Evaluators Sandbox::evaluators_; 646 Sandbox::Evaluators Sandbox::evaluators_;
668 Sandbox::ErrMap Sandbox::errMap_; 647 Sandbox::ErrMap Sandbox::errMap_;
669 Sandbox::Traps *Sandbox::traps_ = NULL; 648 Sandbox::Traps *Sandbox::traps_ = NULL;
670 Sandbox::TrapIds Sandbox::trapIds_; 649 Sandbox::TrapIds Sandbox::trapIds_;
671 ErrorCode *Sandbox::trapArray_ = NULL; 650 ErrorCode *Sandbox::trapArray_ = NULL;
672 size_t Sandbox::trapArraySize_ = 0; 651 size_t Sandbox::trapArraySize_ = 0;
673 652
674 } // namespace 653 } // namespace
OLDNEW
« no previous file with comments | « no previous file | no next file » | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698