Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(87)

Unified Diff: mojo/runner/child_process.cc

Issue 1274743004: Sandbox html_viewer on Linux. (Closed) Base URL: https://chromium.googlesource.com/chromium/src.git@master
Patch Set: Style stuff. Created 5 years, 4 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
Index: mojo/runner/child_process.cc
diff --git a/mojo/runner/child_process.cc b/mojo/runner/child_process.cc
index 996693429741919218ca8bca0c617128ff14e4f7..39c740a1981f04d5cef86b969f3cf5bf88fd543b 100644
--- a/mojo/runner/child_process.cc
+++ b/mojo/runner/child_process.cc
@@ -310,7 +310,13 @@ int ChildProcessMain() {
if (sandbox_warm)
sandbox_warm();
+ // TODO(erg,jln): Allowing access to all of /dev/shm/ makes it easy to
+ // spy on other shared memory using processes. This is a temporary hack
+ // so that we have some sandbox until we have proper shared memory
+ // support integrated into mojo.
std::vector<BrokerFilePermission> permissions;
+ permissions.push_back(
+ BrokerFilePermission::ReadWriteCreateUnlinkRecursive("/dev/shm/"));
sandbox.reset(new mandoline::LinuxSandbox(permissions));
sandbox->Warmup();
sandbox->EngageNamespaceSandbox();
« no previous file with comments | « mandoline/services/core_services/core_services_application_delegate.cc ('k') | mojo/runner/linux_sandbox.cc » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698