OLD | NEW |
---|---|
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "sandbox/linux/services/broker_process.h" | 5 #include "sandbox/linux/services/broker_process.h" |
6 | 6 |
7 #include <fcntl.h> | 7 #include <fcntl.h> |
8 #include <sys/socket.h> | 8 #include <sys/socket.h> |
9 #include <sys/stat.h> | 9 #include <sys/stat.h> |
10 #include <sys/syscall.h> | 10 #include <sys/syscall.h> |
11 #include <sys/types.h> | 11 #include <sys/types.h> |
12 #include <unistd.h> | 12 #include <unistd.h> |
13 | 13 |
14 #include <algorithm> | 14 #include <algorithm> |
15 #include <string> | 15 #include <string> |
16 #include <vector> | 16 #include <vector> |
17 | 17 |
18 #include "base/basictypes.h" | 18 #include "base/basictypes.h" |
19 #include "base/callback.h" | |
19 #include "base/compiler_specific.h" | 20 #include "base/compiler_specific.h" |
20 #include "base/logging.h" | 21 #include "base/logging.h" |
21 #include "base/pickle.h" | 22 #include "base/pickle.h" |
22 #include "base/posix/eintr_wrapper.h" | 23 #include "base/posix/eintr_wrapper.h" |
23 #include "base/posix/unix_domain_socket_linux.h" | 24 #include "base/posix/unix_domain_socket_linux.h" |
24 #include "base/process/process_metrics.h" | 25 #include "base/process/process_metrics.h" |
25 #include "build/build_config.h" | 26 #include "build/build_config.h" |
26 #include "sandbox/linux/services/linux_syscalls.h" | 27 #include "sandbox/linux/services/linux_syscalls.h" |
27 | 28 |
28 #if defined(OS_ANDROID) && !defined(MSG_CMSG_CLOEXEC) | 29 #if defined(OS_ANDROID) && !defined(MSG_CMSG_CLOEXEC) |
(...skipping 100 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
129 allowed_w_files_(allowed_w_files), | 130 allowed_w_files_(allowed_w_files), |
130 ipc_socketpair_(-1) { | 131 ipc_socketpair_(-1) { |
131 } | 132 } |
132 | 133 |
133 BrokerProcess::~BrokerProcess() { | 134 BrokerProcess::~BrokerProcess() { |
134 if (initialized_ && ipc_socketpair_ != -1) { | 135 if (initialized_ && ipc_socketpair_ != -1) { |
135 close(ipc_socketpair_); | 136 close(ipc_socketpair_); |
136 } | 137 } |
137 } | 138 } |
138 | 139 |
139 bool BrokerProcess::Init(bool (*sandbox_callback)(void)) { | 140 bool BrokerProcess::Init( |
141 const base::Callback<bool(void)>& broker_process_init_callback) { | |
140 CHECK(!initialized_); | 142 CHECK(!initialized_); |
141 int socket_pair[2]; | 143 int socket_pair[2]; |
142 // Use SOCK_SEQPACKET, because we need to preserve message boundaries | 144 // Use SOCK_SEQPACKET, because we need to preserve message boundaries |
143 // but we also want to be notified (recvmsg should return and not block) | 145 // but we also want to be notified (recvmsg should return and not block) |
144 // when the connection has been broken (one of the processes died). | 146 // when the connection has been broken (one of the processes died). |
145 if (socketpair(AF_UNIX, SOCK_SEQPACKET, 0, socket_pair)) { | 147 if (socketpair(AF_UNIX, SOCK_SEQPACKET, 0, socket_pair)) { |
146 LOG(ERROR) << "Failed to create socketpair"; | 148 LOG(ERROR) << "Failed to create socketpair"; |
147 return false; | 149 return false; |
148 } | 150 } |
149 | 151 |
(...skipping 16 matching lines...) Expand all Loading... | |
166 initialized_ = true; | 168 initialized_ = true; |
167 return true; | 169 return true; |
168 } else { | 170 } else { |
169 // We are the broker. | 171 // We are the broker. |
170 close(socket_pair[1]); | 172 close(socket_pair[1]); |
171 // We should only be able to read from this IPC channel. We will send our | 173 // We should only be able to read from this IPC channel. We will send our |
172 // replies on a new file descriptor attached to the requests. | 174 // replies on a new file descriptor attached to the requests. |
173 shutdown(socket_pair[0], SHUT_WR); | 175 shutdown(socket_pair[0], SHUT_WR); |
174 ipc_socketpair_ = socket_pair[0]; | 176 ipc_socketpair_ = socket_pair[0]; |
175 is_child_ = true; | 177 is_child_ = true; |
176 // Enable the sandbox if provided. | 178 // Enable the sandbox if provided. |
jln (very slow on Chromium)
2014/02/20 23:38:52
Change the comment (or just remove it).
dshwang
2014/02/21 07:03:13
it's mistake. done.
| |
177 if (sandbox_callback) { | 179 CHECK(broker_process_init_callback.Run()); |
178 CHECK(sandbox_callback()); | |
179 } | |
180 initialized_ = true; | 180 initialized_ = true; |
181 for (;;) { | 181 for (;;) { |
182 HandleRequest(); | 182 HandleRequest(); |
183 } | 183 } |
184 _exit(1); | 184 _exit(1); |
185 } | 185 } |
186 NOTREACHED(); | 186 NOTREACHED(); |
187 } | 187 } |
188 | 188 |
189 int BrokerProcess::Access(const char* pathname, int mode) const { | 189 int BrokerProcess::Access(const char* pathname, int mode) const { |
(...skipping 321 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
511 GetFileNameInWhitelist(allowed_w_files_, requested_filename, | 511 GetFileNameInWhitelist(allowed_w_files_, requested_filename, |
512 file_to_open); | 512 file_to_open); |
513 return allowed_for_read_and_write; | 513 return allowed_for_read_and_write; |
514 } | 514 } |
515 default: | 515 default: |
516 return false; | 516 return false; |
517 } | 517 } |
518 } | 518 } |
519 | 519 |
520 } // namespace sandbox. | 520 } // namespace sandbox. |
OLD | NEW |