Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(179)

Side by Side Diff: sandbox/linux/suid/client/setuid_sandbox_host.cc

Issue 2094913002: Make base::Environment::Create() return unique_ptrs. (Closed) Base URL: https://chromium.googlesource.com/chromium/src.git@master
Patch Set: nit, rebase Created 4 years, 5 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
OLDNEW
1 // Copyright 2015 The Chromium Authors. All rights reserved. 1 // Copyright 2015 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be 2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file. 3 // found in the LICENSE file.
4 4
5 #include "sandbox/linux/suid/client/setuid_sandbox_host.h" 5 #include "sandbox/linux/suid/client/setuid_sandbox_host.h"
6 6
7 #include <fcntl.h> 7 #include <fcntl.h>
8 #include <stddef.h> 8 #include <stddef.h>
9 #include <stdlib.h> 9 #include <stdlib.h>
10 #include <sys/stat.h> 10 #include <sys/stat.h>
(...skipping 11 matching lines...) Expand all
22 #include "base/logging.h" 22 #include "base/logging.h"
23 #include "base/macros.h" 23 #include "base/macros.h"
24 #include "base/path_service.h" 24 #include "base/path_service.h"
25 #include "base/posix/eintr_wrapper.h" 25 #include "base/posix/eintr_wrapper.h"
26 #include "base/process/launch.h" 26 #include "base/process/launch.h"
27 #include "base/process/process_metrics.h" 27 #include "base/process/process_metrics.h"
28 #include "base/strings/string_number_conversions.h" 28 #include "base/strings/string_number_conversions.h"
29 #include "sandbox/linux/suid/common/sandbox.h" 29 #include "sandbox/linux/suid/common/sandbox.h"
30 #include "sandbox/linux/suid/common/suid_unsafe_environment_variables.h" 30 #include "sandbox/linux/suid/common/suid_unsafe_environment_variables.h"
31 31
32 namespace sandbox {
33
32 namespace { 34 namespace {
33 35
34 // Set an environment variable that reflects the API version we expect from the 36 // Set an environment variable that reflects the API version we expect from the
35 // setuid sandbox. Old versions of the sandbox will ignore this. 37 // setuid sandbox. Old versions of the sandbox will ignore this.
36 void SetSandboxAPIEnvironmentVariable(base::Environment* env) { 38 void SetSandboxAPIEnvironmentVariable(base::Environment* env) {
37 env->SetVar(sandbox::kSandboxEnvironmentApiRequest, 39 env->SetVar(kSandboxEnvironmentApiRequest,
38 base::IntToString(sandbox::kSUIDSandboxApiNumber)); 40 base::IntToString(kSUIDSandboxApiNumber));
39 } 41 }
40 42
41 // Unset environment variables that are expected to be set by the setuid 43 // Unset environment variables that are expected to be set by the setuid
42 // sandbox. This is to allow nesting of one instance of the SUID sandbox 44 // sandbox. This is to allow nesting of one instance of the SUID sandbox
43 // inside another. 45 // inside another.
44 void UnsetExpectedEnvironmentVariables(base::EnvironmentMap* env_map) { 46 void UnsetExpectedEnvironmentVariables(base::EnvironmentMap* env_map) {
45 DCHECK(env_map); 47 DCHECK(env_map);
46 const base::NativeEnvironmentString environment_vars[] = { 48 const base::NativeEnvironmentString environment_vars[] = {
47 sandbox::kSandboxDescriptorEnvironmentVarName, 49 kSandboxDescriptorEnvironmentVarName, kSandboxHelperPidEnvironmentVarName,
48 sandbox::kSandboxHelperPidEnvironmentVarName, 50 kSandboxEnvironmentApiProvides, kSandboxPIDNSEnvironmentVarName,
49 sandbox::kSandboxEnvironmentApiProvides, 51 kSandboxNETNSEnvironmentVarName,
50 sandbox::kSandboxPIDNSEnvironmentVarName,
51 sandbox::kSandboxNETNSEnvironmentVarName,
52 }; 52 };
53 53
54 for (size_t i = 0; i < arraysize(environment_vars); ++i) { 54 for (size_t i = 0; i < arraysize(environment_vars); ++i) {
55 // Setting values in EnvironmentMap to an empty-string will make 55 // Setting values in EnvironmentMap to an empty-string will make
56 // sure that they get unset from the environment via AlterEnvironment(). 56 // sure that they get unset from the environment via AlterEnvironment().
57 (*env_map)[environment_vars[i]] = base::NativeEnvironmentString(); 57 (*env_map)[environment_vars[i]] = base::NativeEnvironmentString();
58 } 58 }
59 } 59 }
60 60
61 // Wrapper around a shared C function. 61 // Wrapper around a shared C function.
62 // Returns the "saved" environment variable name corresponding to |envvar| 62 // Returns the "saved" environment variable name corresponding to |envvar|
63 // in a new string or NULL. 63 // in a new string or NULL.
64 std::string* CreateSavedVariableName(const char* env_var) { 64 std::string* CreateSavedVariableName(const char* env_var) {
65 char* const saved_env_var = SandboxSavedEnvironmentVariable(env_var); 65 char* const saved_env_var = SandboxSavedEnvironmentVariable(env_var);
66 if (!saved_env_var) 66 if (!saved_env_var)
67 return NULL; 67 return nullptr;
68 std::string* saved_env_var_copy = new std::string(saved_env_var); 68 std::string* saved_env_var_copy = new std::string(saved_env_var);
69 // SandboxSavedEnvironmentVariable is the C function that we wrap and uses 69 // SandboxSavedEnvironmentVariable is the C function that we wrap and uses
70 // malloc() to allocate memory. 70 // malloc() to allocate memory.
71 free(saved_env_var); 71 free(saved_env_var);
72 return saved_env_var_copy; 72 return saved_env_var_copy;
73 } 73 }
74 74
75 // The ELF loader will clear many environment variables so we save them to 75 // The ELF loader will clear many environment variables so we save them to
76 // different names here so that the SUID sandbox can resolve them for the 76 // different names here so that the SUID sandbox can resolve them for the
77 // renderer. 77 // renderer.
78 void SaveSUIDUnsafeEnvironmentVariables(base::Environment* env) { 78 void SaveSUIDUnsafeEnvironmentVariables(base::Environment* env) {
79 for (unsigned i = 0; kSUIDUnsafeEnvironmentVariables[i]; ++i) { 79 for (unsigned i = 0; kSUIDUnsafeEnvironmentVariables[i]; ++i) {
80 const char* env_var = kSUIDUnsafeEnvironmentVariables[i]; 80 const char* env_var = kSUIDUnsafeEnvironmentVariables[i];
81 // Get the saved environment variable corresponding to envvar. 81 // Get the saved environment variable corresponding to envvar.
82 std::unique_ptr<std::string> saved_env_var( 82 std::unique_ptr<std::string> saved_env_var(
83 CreateSavedVariableName(env_var)); 83 CreateSavedVariableName(env_var));
84 if (saved_env_var == NULL) 84 if (!saved_env_var)
85 continue; 85 continue;
86 86
87 std::string value; 87 std::string value;
88 if (env->GetVar(env_var, &value)) 88 if (env->GetVar(env_var, &value))
89 env->SetVar(saved_env_var->c_str(), value); 89 env->SetVar(saved_env_var->c_str(), value);
90 else 90 else
91 env->UnSetVar(saved_env_var->c_str()); 91 env->UnSetVar(saved_env_var->c_str());
92 } 92 }
93 } 93 }
94 94
95 const char* GetDevelSandboxPath() { 95 const char* GetDevelSandboxPath() {
96 return getenv("CHROME_DEVEL_SANDBOX"); 96 return getenv("CHROME_DEVEL_SANDBOX");
97 } 97 }
98 98
99 } // namespace 99 } // namespace
100 100
101 namespace sandbox {
102
103 SetuidSandboxHost* SetuidSandboxHost::Create() { 101 SetuidSandboxHost* SetuidSandboxHost::Create() {
104 base::Environment* environment(base::Environment::Create()); 102 return new SetuidSandboxHost(base::Environment::Create());
105 CHECK(environment);
106 return new SetuidSandboxHost(environment);
107 } 103 }
108 104
109 SetuidSandboxHost::SetuidSandboxHost(base::Environment* env) : env_(env) { 105 SetuidSandboxHost::SetuidSandboxHost(std::unique_ptr<base::Environment> env)
106 : env_(std::move(env)) {
107 DCHECK(env_);
110 } 108 }
111 109
112 SetuidSandboxHost::~SetuidSandboxHost() { 110 SetuidSandboxHost::~SetuidSandboxHost() {
113 } 111 }
114 112
115 // Check if CHROME_DEVEL_SANDBOX is set but empty. This currently disables 113 // Check if CHROME_DEVEL_SANDBOX is set but empty. This currently disables
116 // the setuid sandbox. TODO(jln): fix this (crbug.com/245376). 114 // the setuid sandbox. TODO(jln): fix this (crbug.com/245376).
117 bool SetuidSandboxHost::IsDisabledViaEnvironment() { 115 bool SetuidSandboxHost::IsDisabledViaEnvironment() {
118 const char* devel_sandbox_path = GetDevelSandboxPath(); 116 const char* devel_sandbox_path = GetDevelSandboxPath();
119 if (devel_sandbox_path && '\0' == *devel_sandbox_path) { 117 return devel_sandbox_path && (*devel_sandbox_path == '\0');
120 return true;
121 }
122 return false;
123 } 118 }
124 119
125 base::FilePath SetuidSandboxHost::GetSandboxBinaryPath() { 120 base::FilePath SetuidSandboxHost::GetSandboxBinaryPath() {
126 base::FilePath sandbox_binary; 121 base::FilePath sandbox_binary;
127 base::FilePath exe_dir; 122 base::FilePath exe_dir;
128 if (PathService::Get(base::DIR_EXE, &exe_dir)) { 123 if (PathService::Get(base::DIR_EXE, &exe_dir)) {
129 base::FilePath sandbox_candidate = exe_dir.AppendASCII("chrome-sandbox"); 124 base::FilePath sandbox_candidate = exe_dir.AppendASCII("chrome-sandbox");
130 if (base::PathExists(sandbox_candidate)) 125 if (base::PathExists(sandbox_candidate))
131 sandbox_binary = sandbox_candidate; 126 sandbox_binary = sandbox_candidate;
132 } 127 }
(...skipping 57 matching lines...) Expand 10 before | Expand all | Expand 10 after
190 // kZygoteIdFd. Fixing this requires a sandbox API change. :( 185 // kZygoteIdFd. Fixing this requires a sandbox API change. :(
191 fds_to_remap->push_back(std::make_pair(dummy_fd->get(), kZygoteIdFd)); 186 fds_to_remap->push_back(std::make_pair(dummy_fd->get(), kZygoteIdFd));
192 } 187 }
193 188
194 void SetuidSandboxHost::SetupLaunchEnvironment() { 189 void SetuidSandboxHost::SetupLaunchEnvironment() {
195 SaveSUIDUnsafeEnvironmentVariables(env_.get()); 190 SaveSUIDUnsafeEnvironmentVariables(env_.get());
196 SetSandboxAPIEnvironmentVariable(env_.get()); 191 SetSandboxAPIEnvironmentVariable(env_.get());
197 } 192 }
198 193
199 } // namespace sandbox 194 } // namespace sandbox
OLDNEW
« no previous file with comments | « sandbox/linux/suid/client/setuid_sandbox_host.h ('k') | sandbox/win/src/address_sanitizer_test.cc » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698