| OLD | NEW |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 // http://code.google.com/p/chromium/wiki/LinuxSUIDSandbox | 5 // https://chromium.googlesource.com/chromium/src/+/master/docs/linux_suid_sandb
ox.md |
| 6 | 6 |
| 7 #include "sandbox/linux/suid/common/sandbox.h" | 7 #include "sandbox/linux/suid/common/sandbox.h" |
| 8 | 8 |
| 9 #define _GNU_SOURCE | 9 #define _GNU_SOURCE |
| 10 #include <asm/unistd.h> | 10 #include <asm/unistd.h> |
| 11 #include <errno.h> | 11 #include <errno.h> |
| 12 #include <fcntl.h> | 12 #include <fcntl.h> |
| 13 #include <limits.h> | 13 #include <limits.h> |
| 14 #include <sched.h> | 14 #include <sched.h> |
| 15 #include <signal.h> | 15 #include <signal.h> |
| (...skipping 377 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 393 api_number = long_api_number; | 393 api_number = long_api_number; |
| 394 } | 394 } |
| 395 | 395 |
| 396 // Warn only for now. | 396 // Warn only for now. |
| 397 if (api_number != kSUIDSandboxApiNumber) { | 397 if (api_number != kSUIDSandboxApiNumber) { |
| 398 fprintf( | 398 fprintf( |
| 399 stderr, | 399 stderr, |
| 400 "The setuid sandbox provides API version %d, " | 400 "The setuid sandbox provides API version %d, " |
| 401 "but you need %d\n" | 401 "but you need %d\n" |
| 402 "Please read " | 402 "Please read " |
| 403 "https://code.google.com/p/chromium/wiki/LinuxSUIDSandboxDevelopment." | 403 "https://chromium.googlesource.com/chromium/src/+/master/docs/linux_suid
_sandbox_development.md." |
| 404 "\n\n", | 404 "\n\n", |
| 405 kSUIDSandboxApiNumber, | 405 kSUIDSandboxApiNumber, |
| 406 api_number); | 406 api_number); |
| 407 } | 407 } |
| 408 | 408 |
| 409 // Export our version so that the sandboxed process can verify it did not | 409 // Export our version so that the sandboxed process can verify it did not |
| 410 // use an old sandbox. | 410 // use an old sandbox. |
| 411 char version_string[64]; | 411 char version_string[64]; |
| 412 snprintf(version_string, sizeof(version_string), "%d", kSUIDSandboxApiNumber); | 412 snprintf(version_string, sizeof(version_string), "%d", kSUIDSandboxApiNumber); |
| 413 if (setenv(kSandboxEnvironmentApiProvides, version_string, 1)) { | 413 if (setenv(kSandboxEnvironmentApiProvides, version_string, 1)) { |
| (...skipping 59 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 473 if (!DropRoot()) | 473 if (!DropRoot()) |
| 474 return 1; | 474 return 1; |
| 475 if (!SetupChildEnvironment()) | 475 if (!SetupChildEnvironment()) |
| 476 return 1; | 476 return 1; |
| 477 | 477 |
| 478 execv(argv[1], &argv[1]); | 478 execv(argv[1], &argv[1]); |
| 479 FatalError("execv failed"); | 479 FatalError("execv failed"); |
| 480 | 480 |
| 481 return 1; | 481 return 1; |
| 482 } | 482 } |
| OLD | NEW |