| OLD | NEW |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "content/browser/zygote_host/zygote_host_impl_linux.h" | 5 #include "content/browser/zygote_host/zygote_host_impl_linux.h" |
| 6 | 6 |
| 7 #include <errno.h> | 7 #include <errno.h> |
| 8 #include <string.h> | 8 #include <string.h> |
| 9 #include <sys/socket.h> | 9 #include <sys/socket.h> |
| 10 #include <sys/stat.h> | 10 #include <sys/stat.h> |
| (...skipping 142 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 153 | 153 |
| 154 const bool using_namespace_sandbox = ShouldUseNamespaceSandbox(); | 154 const bool using_namespace_sandbox = ShouldUseNamespaceSandbox(); |
| 155 // A non empty sandbox_cmd means we want a SUID sandbox. | 155 // A non empty sandbox_cmd means we want a SUID sandbox. |
| 156 const bool using_suid_sandbox = | 156 const bool using_suid_sandbox = |
| 157 !sandbox_cmd.empty() && !using_namespace_sandbox; | 157 !sandbox_cmd.empty() && !using_namespace_sandbox; |
| 158 | 158 |
| 159 // Use the SUID sandbox for adjusting OOM scores when we are using the setuid | 159 // Use the SUID sandbox for adjusting OOM scores when we are using the setuid |
| 160 // or namespace sandbox. This is needed beacuse the processes are | 160 // or namespace sandbox. This is needed beacuse the processes are |
| 161 // non-dumpable, so /proc/pid/oom_score_adj can only be written by root. | 161 // non-dumpable, so /proc/pid/oom_score_adj can only be written by root. |
| 162 use_suid_sandbox_for_adj_oom_score_ = | 162 use_suid_sandbox_for_adj_oom_score_ = |
| 163 using_namespace_sandbox || using_suid_sandbox; | 163 !sandbox_binary_.empty() && |
| 164 (using_namespace_sandbox || using_suid_sandbox); |
| 164 | 165 |
| 165 // Start up the sandbox host process and get the file descriptor for the | 166 // Start up the sandbox host process and get the file descriptor for the |
| 166 // renderers to talk to it. | 167 // renderers to talk to it. |
| 167 const int sfd = RenderSandboxHostLinux::GetInstance()->GetRendererSocket(); | 168 const int sfd = RenderSandboxHostLinux::GetInstance()->GetRendererSocket(); |
| 168 fds_to_map.push_back(std::make_pair(sfd, GetSandboxFD())); | 169 fds_to_map.push_back(std::make_pair(sfd, GetSandboxFD())); |
| 169 | 170 |
| 170 base::ScopedFD dummy_fd; | 171 base::ScopedFD dummy_fd; |
| 171 if (using_suid_sandbox) { | 172 if (using_suid_sandbox) { |
| 172 scoped_ptr<sandbox::SetuidSandboxHost> sandbox_host( | 173 scoped_ptr<sandbox::SetuidSandboxHost> sandbox_host( |
| 173 sandbox::SetuidSandboxHost::Create()); | 174 sandbox::SetuidSandboxHost::Create()); |
| (...skipping 421 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 595 } | 596 } |
| 596 | 597 |
| 597 if (!sandbox::Credentials::CanCreateProcessInNewUserNS()) { | 598 if (!sandbox::Credentials::CanCreateProcessInNewUserNS()) { |
| 598 return false; | 599 return false; |
| 599 } | 600 } |
| 600 | 601 |
| 601 return true; | 602 return true; |
| 602 } | 603 } |
| 603 | 604 |
| 604 } // namespace content | 605 } // namespace content |
| OLD | NEW |