Mojo EDK: Add safe process connection API

components/arc/arc_session.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "components/arc/arc_session.h"
 
 #include <fcntl.h>
 #include <grp.h>
 #include <poll.h>
 #include <unistd.h>
@@ skipping 15 matching lines @@
 #include "chromeos/dbus/dbus_method_call_status.h"
 #include "chromeos/dbus/dbus_thread_manager.h"
 #include "chromeos/dbus/session_manager_client.h"
 #include "components/arc/arc_bridge_host_impl.h"
 #include "components/arc/arc_features.h"
 #include "components/arc/arc_session_observer.h"
 #include "components/user_manager/user_manager.h"
 #include "mojo/edk/embedder/embedder.h"
 #include "mojo/edk/embedder/named_platform_handle.h"
 #include "mojo/edk/embedder/named_platform_handle_utils.h"
+#include "mojo/edk/embedder/pending_process_connection.h"
 #include "mojo/edk/embedder/platform_channel_pair.h"
 #include "mojo/edk/embedder/platform_channel_utils_posix.h"
 #include "mojo/edk/embedder/platform_handle_vector.h"
 #include "mojo/edk/embedder/scoped_platform_handle.h"
 #include "mojo/public/cpp/bindings/binding.h"
 
 namespace arc {
 
 namespace {
 
@@ skipping 388 matching lines @@
   mojo::edk::ScopedPlatformHandle scoped_fd;
   if (!mojo::edk::ServerAcceptConnection(socket_fd.get(), &scoped_fd,
                                          /* check_peer_user = */ false) ||
       !scoped_fd.is_valid()) {
     return mojo::ScopedMessagePipeHandle();
   }
 
   // Hardcode pid 0 since it is unused in mojo.
   const base::ProcessHandle kUnusedChildProcessHandle = 0;
   mojo::edk::PlatformChannelPair channel_pair;
-  std::string child_token = mojo::edk::GenerateRandomToken();
-  mojo::edk::ChildProcessLaunched(kUnusedChildProcessHandle,
-                                  channel_pair.PassServerHandle(), child_token);
+  mojo::edk::PendingProcessConnection process;
+  process.Connect(kUnusedChildProcessHandle, channel_pair.PassServerHandle());
 
   mojo::edk::ScopedPlatformHandleVectorPtr handles(
       new mojo::edk::PlatformHandleVector{
           channel_pair.PassClientHandle().release()});
 
-  std::string token = mojo::edk::GenerateRandomToken();
+  std::string token;
+  ScopedMessagePipeHandle pipe = process.CreateMessagePipe(&token);
+
   // We need to send the length of the message as a single byte, so make sure it
   // fits.
   DCHECK_LT(token.size(), 256u);
   uint8_t message_length = static_cast<uint8_t>(token.size());
   struct iovec iov[] = {{&message_length, sizeof(message_length)},
                         {const_cast<char*>(token.c_str()), token.size()}};
   ssize_t result = mojo::edk::PlatformChannelSendmsgWithHandles(
       scoped_fd.get(), iov, sizeof(iov) / sizeof(iov[0]), handles->data(),
       handles->size());
   if (result == -1) {
     PLOG(ERROR) << "sendmsg";
     return mojo::ScopedMessagePipeHandle();
   }
 
-  return mojo::edk::CreateParentMessagePipe(token, child_token);
+  return pipe;
 }
 
 void ArcSessionImpl::OnMojoConnected(
     mojo::ScopedMessagePipeHandle server_pipe) {
   DCHECK(thread_checker_.CalledOnValidThread());
 
   if (state_ == State::STOPPED) {
     // This is the case that error is notified via DBus before the
     // OnMojoConnected() callback is invoked. The stopping procedure has
     // been run, so do nothing.
@@ skipping 164 matching lines @@
 
 // static
 std::unique_ptr<ArcSession> ArcSession::Create(
     ArcBridgeService* arc_bridge_service,
     const scoped_refptr<base::TaskRunner>& blocking_task_runner) {
   return base::MakeUnique<ArcSessionImpl>(arc_bridge_service,
                                           blocking_task_runner);
 }
 
 }  // namespace arc