| Index: base/file_util.h
|
| diff --git a/base/file_util.h b/base/file_util.h
|
| index b86d8cb74640e8df6db328cf74942d6c520da43c..431569aafa475ba17588e32f18b686697c48488a 100644
|
| --- a/base/file_util.h
|
| +++ b/base/file_util.h
|
| @@ -426,6 +426,32 @@
|
| // Automatically closes |FILE*|s.
|
| typedef scoped_ptr<FILE, ScopedFILEClose> ScopedFILE;
|
|
|
| +#if defined(OS_POSIX)
|
| +// Functor for |ScopedFD| (below).
|
| +struct ScopedFDClose {
|
| + inline void operator()(int* x) const {
|
| + if (x && *x >= 0) {
|
| + // It's important to crash here.
|
| + // There are security implications to not closing a file descriptor
|
| + // properly. As file descriptors are "capabilities", keeping them open
|
| + // would make the current process keep access to a resource. Much of
|
| + // Chrome relies on being able to "drop" such access.
|
| + // It's especially problematic on Linux with the setuid sandbox, where
|
| + // a single open directory would bypass the entire security model.
|
| + PCHECK(0 == IGNORE_EINTR(close(*x)));
|
| + }
|
| + }
|
| +};
|
| +
|
| +// Automatically closes FDs (note: doesn't store the FD).
|
| +// TODO(viettrungluu): This is a very odd API, since (unlike |FILE*|s, you'll
|
| +// need to store the FD separately and keep its memory alive). This should
|
| +// probably be called |ScopedFDCloser| or something like that.
|
| +typedef scoped_ptr<int, ScopedFDClose> ScopedFD;
|
| +// Let new users use ScopedFDCloser already, while ScopedFD is replaced.
|
| +typedef ScopedFD ScopedFDCloser;
|
| +#endif // OS_POSIX
|
| +
|
| } // namespace file_util
|
|
|
| // Internal --------------------------------------------------------------------
|
|
|