| OLD | NEW |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "base/memory/shared_memory.h" | 5 #include "base/memory/shared_memory.h" |
| 6 | 6 |
| 7 #include <errno.h> | 7 #include <errno.h> |
| 8 #include <fcntl.h> | 8 #include <fcntl.h> |
| 9 #include <sys/mman.h> | 9 #include <sys/mman.h> |
| 10 #include <sys/stat.h> | 10 #include <sys/stat.h> |
| (...skipping 118 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 129 // the temporary files we create will just go into the buffer cache | 129 // the temporary files we create will just go into the buffer cache |
| 130 // and be deleted before they ever make it out to disk. | 130 // and be deleted before they ever make it out to disk. |
| 131 base::ThreadRestrictions::ScopedAllowIO allow_io; | 131 base::ThreadRestrictions::ScopedAllowIO allow_io; |
| 132 | 132 |
| 133 ScopedFILE fp; | 133 ScopedFILE fp; |
| 134 bool fix_size = true; | 134 bool fix_size = true; |
| 135 int readonly_fd_storage = -1; | 135 int readonly_fd_storage = -1; |
| 136 ScopedFD readonly_fd(&readonly_fd_storage); | 136 ScopedFD readonly_fd(&readonly_fd_storage); |
| 137 | 137 |
| 138 FilePath path; | 138 FilePath path; |
| 139 if (options.name == NULL || options.name->empty()) { | 139 if (options.name_deprecated == NULL || options.name_deprecated->empty()) { |
| 140 // It doesn't make sense to have a open-existing private piece of shmem | 140 // It doesn't make sense to have a open-existing private piece of shmem |
| 141 DCHECK(!options.open_existing); | 141 DCHECK(!options.open_existing_deprecated); |
| 142 // Q: Why not use the shm_open() etc. APIs? | 142 // Q: Why not use the shm_open() etc. APIs? |
| 143 // A: Because they're limited to 4mb on OS X. FFFFFFFUUUUUUUUUUU | 143 // A: Because they're limited to 4mb on OS X. FFFFFFFUUUUUUUUUUU |
| 144 fp.reset(base::CreateAndOpenTemporaryShmemFile(&path, options.executable)); | 144 fp.reset(base::CreateAndOpenTemporaryShmemFile(&path, options.executable)); |
| 145 | 145 |
| 146 if (fp) { | 146 if (fp) { |
| 147 // Also open as readonly so that we can ShareReadOnlyToProcess. | 147 // Also open as readonly so that we can ShareReadOnlyToProcess. |
| 148 *readonly_fd = HANDLE_EINTR(open(path.value().c_str(), O_RDONLY)); | 148 *readonly_fd = HANDLE_EINTR(open(path.value().c_str(), O_RDONLY)); |
| 149 if (*readonly_fd < 0) { | 149 if (*readonly_fd < 0) { |
| 150 DPLOG(ERROR) << "open(\"" << path.value() << "\", O_RDONLY) failed"; | 150 DPLOG(ERROR) << "open(\"" << path.value() << "\", O_RDONLY) failed"; |
| 151 fp.reset(); | 151 fp.reset(); |
| 152 } | 152 } |
| 153 // Deleting the file prevents anyone else from mapping it in (making it | 153 // Deleting the file prevents anyone else from mapping it in (making it |
| 154 // private), and prevents the need for cleanup (once the last fd is | 154 // private), and prevents the need for cleanup (once the last fd is |
| 155 // closed, it is truly freed). | 155 // closed, it is truly freed). |
| 156 if (unlink(path.value().c_str())) | 156 if (unlink(path.value().c_str())) |
| 157 PLOG(WARNING) << "unlink"; | 157 PLOG(WARNING) << "unlink"; |
| 158 } | 158 } |
| 159 } else { | 159 } else { |
| 160 if (!FilePathForMemoryName(*options.name, &path)) | 160 if (!FilePathForMemoryName(*options.name_deprecated, &path)) |
| 161 return false; | 161 return false; |
| 162 | 162 |
| 163 // Make sure that the file is opened without any permission | 163 // Make sure that the file is opened without any permission |
| 164 // to other users on the system. | 164 // to other users on the system. |
| 165 const mode_t kOwnerOnly = S_IRUSR | S_IWUSR; | 165 const mode_t kOwnerOnly = S_IRUSR | S_IWUSR; |
| 166 | 166 |
| 167 // First, try to create the file. | 167 // First, try to create the file. |
| 168 int fd = HANDLE_EINTR( | 168 int fd = HANDLE_EINTR( |
| 169 open(path.value().c_str(), O_RDWR | O_CREAT | O_EXCL, kOwnerOnly)); | 169 open(path.value().c_str(), O_RDWR | O_CREAT | O_EXCL, kOwnerOnly)); |
| 170 if (fd == -1 && options.open_existing) { | 170 if (fd == -1 && options.open_existing_deprecated) { |
| 171 // If this doesn't work, try and open an existing file in append mode. | 171 // If this doesn't work, try and open an existing file in append mode. |
| 172 // Opening an existing file in a world writable directory has two main | 172 // Opening an existing file in a world writable directory has two main |
| 173 // security implications: | 173 // security implications: |
| 174 // - Attackers could plant a file under their control, so ownership of | 174 // - Attackers could plant a file under their control, so ownership of |
| 175 // the file is checked below. | 175 // the file is checked below. |
| 176 // - Attackers could plant a symbolic link so that an unexpected file | 176 // - Attackers could plant a symbolic link so that an unexpected file |
| 177 // is opened, so O_NOFOLLOW is passed to open(). | 177 // is opened, so O_NOFOLLOW is passed to open(). |
| 178 fd = HANDLE_EINTR( | 178 fd = HANDLE_EINTR( |
| 179 open(path.value().c_str(), O_RDWR | O_APPEND | O_NOFOLLOW)); | 179 open(path.value().c_str(), O_RDWR | O_APPEND | O_NOFOLLOW)); |
| 180 | 180 |
| (...skipping 278 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 459 new_handle->fd = new_fd; | 459 new_handle->fd = new_fd; |
| 460 new_handle->auto_close = true; | 460 new_handle->auto_close = true; |
| 461 | 461 |
| 462 if (close_self) | 462 if (close_self) |
| 463 Close(); | 463 Close(); |
| 464 | 464 |
| 465 return true; | 465 return true; |
| 466 } | 466 } |
| 467 | 467 |
| 468 } // namespace base | 468 } // namespace base |
| OLD | NEW |