OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 // http://code.google.com/p/chromium/wiki/LinuxSUIDSandbox | 5 // https://chromium.googlesource.com/chromium/src/+/master/docs/linux_suid_sandb
ox.md |
6 | 6 |
7 #include "sandbox/linux/suid/common/sandbox.h" | 7 #include "sandbox/linux/suid/common/sandbox.h" |
8 | 8 |
9 #define _GNU_SOURCE | 9 #define _GNU_SOURCE |
10 #include <asm/unistd.h> | 10 #include <asm/unistd.h> |
11 #include <errno.h> | 11 #include <errno.h> |
12 #include <fcntl.h> | 12 #include <fcntl.h> |
13 #include <limits.h> | 13 #include <limits.h> |
14 #include <sched.h> | 14 #include <sched.h> |
15 #include <signal.h> | 15 #include <signal.h> |
(...skipping 377 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
393 api_number = long_api_number; | 393 api_number = long_api_number; |
394 } | 394 } |
395 | 395 |
396 // Warn only for now. | 396 // Warn only for now. |
397 if (api_number != kSUIDSandboxApiNumber) { | 397 if (api_number != kSUIDSandboxApiNumber) { |
398 fprintf( | 398 fprintf( |
399 stderr, | 399 stderr, |
400 "The setuid sandbox provides API version %d, " | 400 "The setuid sandbox provides API version %d, " |
401 "but you need %d\n" | 401 "but you need %d\n" |
402 "Please read " | 402 "Please read " |
403 "https://code.google.com/p/chromium/wiki/LinuxSUIDSandboxDevelopment." | 403 "https://chromium.googlesource.com/chromium/src/+/master/docs/linux_suid
_sandbox_development.md." |
404 "\n\n", | 404 "\n\n", |
405 kSUIDSandboxApiNumber, | 405 kSUIDSandboxApiNumber, |
406 api_number); | 406 api_number); |
407 } | 407 } |
408 | 408 |
409 // Export our version so that the sandboxed process can verify it did not | 409 // Export our version so that the sandboxed process can verify it did not |
410 // use an old sandbox. | 410 // use an old sandbox. |
411 char version_string[64]; | 411 char version_string[64]; |
412 snprintf(version_string, sizeof(version_string), "%d", kSUIDSandboxApiNumber); | 412 snprintf(version_string, sizeof(version_string), "%d", kSUIDSandboxApiNumber); |
413 if (setenv(kSandboxEnvironmentApiProvides, version_string, 1)) { | 413 if (setenv(kSandboxEnvironmentApiProvides, version_string, 1)) { |
(...skipping 59 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
473 if (!DropRoot()) | 473 if (!DropRoot()) |
474 return 1; | 474 return 1; |
475 if (!SetupChildEnvironment()) | 475 if (!SetupChildEnvironment()) |
476 return 1; | 476 return 1; |
477 | 477 |
478 execv(argv[1], &argv[1]); | 478 execv(argv[1], &argv[1]); |
479 FatalError("execv failed"); | 479 FatalError("execv failed"); |
480 | 480 |
481 return 1; | 481 return 1; |
482 } | 482 } |
OLD | NEW |