POSIX: CHECK() that file_util::ScopedFD fulfills promise.

base/file_util.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // This file contains utility functions for dealing with the local
 // filesystem.
 
 #ifndef BASE_FILE_UTIL_H_
 #define BASE_FILE_UTIL_H_
 
@@ skipping 398 matching lines @@
 };
 
 // Automatically closes |FILE*|s.
 typedef scoped_ptr<FILE, ScopedFILEClose> ScopedFILE;
 
 #if defined(OS_POSIX)
 // Functor for |ScopedFD| (below).
 struct ScopedFDClose {
   inline void operator()(int* x) const {
     if (x && *x >= 0) {
-      if (IGNORE_EINTR(close(*x)) < 0)
-        DPLOG(ERROR) << "close";
+      // It's important to crash here.
+      // There are security implications to not closing a file descriptor
+      // properly. As file descriptors are "capabilities", keeping them open
+      // would make the current process keep access to a resource. Much of
+      // Chrome relies on being able to "drop" such access.
+      // It's especially problematic on Linux with the setuid sandbox, where
+      // a single open directory would bypass the entire security model.
+      PCHECK(0 == IGNORE_EINTR(close(*x)));
     }
   }
 };
 
 // Automatically closes FDs (note: doesn't store the FD).
 // TODO(viettrungluu): This is a very odd API, since (unlike |FILE*|s, you'll
 // need to store the FD separately and keep its memory alive). This should
 // probably be called |ScopedFDCloser| or something like that.
 typedef scoped_ptr<int, ScopedFDClose> ScopedFD;
+// Let new users use ScopedFDCloser already, while ScopedFD is replaced.
+typedef ScopedFD ScopedFDCloser;
 #endif  // OS_POSIX
 
 #if defined(OS_LINUX)
 // Broad categories of file systems as returned by statfs() on Linux.
 enum FileSystemType {
   FILE_SYSTEM_UNKNOWN,  // statfs failed.
   FILE_SYSTEM_0,        // statfs.f_type == 0 means unknown, may indicate AFS.
   FILE_SYSTEM_ORDINARY,       // on-disk filesystem like ext2
   FILE_SYSTEM_NFS,
   FILE_SYSTEM_SMB,
@@ skipping 33 matching lines @@
 // This function simulates Move(), but unlike Move() it works across volumes.
 // This function is not transactional.
 BASE_EXPORT bool CopyAndDeleteDirectory(const FilePath& from_path,
                                         const FilePath& to_path);
 #endif  // defined(OS_WIN)
 
 }  // namespace internal
 }  // namespace base
 
 #endif  // BASE_FILE_UTIL_H_