Initial implementation of the Mac Bootstrap Sandbox.

sandbox/mac/os_compatibility.cc

+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "sandbox/mac/os_compatibility.h"
+
+#include <servers/bootstrap.h>
+#include <unistd.h>
+
+#include "base/mac/mac_util.h"
+
+namespace sandbox {
+
+namespace {
+
+// Verified from launchd-329.3.3 (10.6.8).
+struct look_up2_request_10_6 {
+  mach_msg_header_t Head;
+  NDR_record_t NDR;
+  name_t servicename;
+  pid_t targetpid;
+  uint64_t flags;
+};
+
+struct look_up2_reply_10_6 {
+  mach_msg_header_t Head;
+  mach_msg_body_t msgh_body;
+  mach_msg_port_descriptor_t service_port;
+};
+
+// Verified from:
+//   launchd-392.39 (10.7.5)
+//   launchd-442.26.2 (10.8.5)
+//   launchd-842.1.4 (10.9.0)
+struct look_up2_request_10_7 {
+  mach_msg_header_t Head;
+  NDR_record_t NDR;
+  name_t servicename;
+  pid_t targetpid;
+  uuid_t instanceid;
+  uint64_t flags;
+};
+
+// look_up2_reply_10_7 is the same as the 10_6 version.
+
+template <typename R>
+const char* LaunchdLookUp2GetRequestName(const mach_msg_header_t* header) {
+  DCHECK_EQ(sizeof(R), header->msgh_size);
+  const R* request = reinterpret_cast<const R*>(header);
+  return request->servicename;

[Mark Mentovai, 2014/05/06 20:51:50]

This is dangerous without a length limitation. 10.9.0
launchd-842.1.4/src/job_types.defs says that this is a 128-char buffer. Here
comes the StringPiece recommendation again.

launchd may be sloppy about this but you don’t have to be.

[Robert Sesek, 2014/05/08 20:58:12]

Good catch. There's even BOOTSTRAP_MAX_NAME_LEN.

+}
+
+template <typename R>
+void LaunchdLookUp2FillReply(mach_msg_header_t* header, mach_port_t port) {
+  R* reply = reinterpret_cast<R*>(header);
+  reply->Head.msgh_size = sizeof(R);
+  reply->Head.msgh_bits =
+      MACH_MSGH_BITS_REMOTE(MACH_MSG_TYPE_MOVE_SEND_ONCE) |
+      MACH_MSGH_BITS_COMPLEX;
+  reply->msgh_body.msgh_descriptor_count = 1;
+  reply->service_port.name = port;
+  reply->service_port.disposition = MACH_MSG_TYPE_PORT_SEND;
+  reply->service_port.type = MACH_MSG_PORT_DESCRIPTOR;
+}
+
+}  // namespace
+
+const LaunchdCompatibilityShim GetLaunchdCompatibilityShim() {
+  LaunchdCompatibilityShim shim = {
+    .msg_id_look_up2 = 404,
+    .msg_id_swap_integer = 416,
+    .look_up2_fill_reply = &LaunchdLookUp2FillReply<look_up2_reply_10_6>
+  };
+
+  if (base::mac::IsOSSnowLeopard()) {
+    shim.look_up2_get_request_name =
+        &LaunchdLookUp2GetRequestName<look_up2_request_10_6>;
+  } else if (base::mac::IsOSLion() ||

[Mark Mentovai, 2014/05/06 20:51:50]

You’ll do better with the OrEarlier/OrLater calls because more of them can be
optimized out. This would be IsOSLionOrLater && IsOSMavericksOrEarlier.

[Robert Sesek, 2014/05/08 20:58:12]

Done.

+             base::mac::IsOSMountainLion() ||
+             base::mac::IsOSMavericks()) {
+    shim.look_up2_get_request_name =
+        &LaunchdLookUp2GetRequestName<look_up2_request_10_7>;
+  } else {
+    LOG(ERROR) << "Unknown OS, using launchd compatibility shim from 10.7.";
+    shim.look_up2_get_request_name =
+        &LaunchdLookUp2GetRequestName<look_up2_request_10_7>;
+  }
+
+  return shim;
+}
+
+}  // namespace sandbox