OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "content/renderer/renderer_main_platform_delegate.h" | 5 #include "content/renderer/renderer_main_platform_delegate.h" |
6 | 6 |
7 #include <errno.h> | 7 #include <errno.h> |
8 #include <sys/stat.h> | 8 #include <sys/stat.h> |
9 | 9 |
10 #include "base/command_line.h" | 10 #include "base/command_line.h" |
(...skipping 21 matching lines...) Expand all Loading... |
32 #ifdef ENABLE_VTUNE_JIT_INTERFACE | 32 #ifdef ENABLE_VTUNE_JIT_INTERFACE |
33 const CommandLine& command_line = parameters_.command_line; | 33 const CommandLine& command_line = parameters_.command_line; |
34 if (command_line.HasSwitch(switches::kEnableVtune)) | 34 if (command_line.HasSwitch(switches::kEnableVtune)) |
35 vTune::InitializeVtuneForV8(); | 35 vTune::InitializeVtuneForV8(); |
36 #endif | 36 #endif |
37 } | 37 } |
38 | 38 |
39 void RendererMainPlatformDelegate::PlatformUninitialize() { | 39 void RendererMainPlatformDelegate::PlatformUninitialize() { |
40 } | 40 } |
41 | 41 |
42 bool RendererMainPlatformDelegate::InitSandboxTests(bool no_sandbox) { | |
43 // The sandbox is started in the zygote process: zygote_main_linux.cc | |
44 // http://code.google.com/p/chromium/wiki/LinuxSUIDSandbox | |
45 return true; | |
46 } | |
47 | |
48 bool RendererMainPlatformDelegate::EnableSandbox() { | 42 bool RendererMainPlatformDelegate::EnableSandbox() { |
49 // The setuid sandbox is started in the zygote process: zygote_main_linux.cc | 43 // The setuid sandbox is started in the zygote process: zygote_main_linux.cc |
50 // http://code.google.com/p/chromium/wiki/LinuxSUIDSandbox | 44 // http://code.google.com/p/chromium/wiki/LinuxSUIDSandbox |
51 // | 45 // |
52 // Anything else is started in InitializeSandbox(). | 46 // Anything else is started in InitializeSandbox(). |
53 LinuxSandbox::InitializeSandbox(); | 47 LinuxSandbox::InitializeSandbox(); |
54 return true; | |
55 } | |
56 | |
57 void RendererMainPlatformDelegate::RunSandboxTests(bool no_sandbox) { | |
58 // The LinuxSandbox class requires going through initialization before | |
59 // GetStatus() and others can be used. When we are not launched through the | |
60 // Zygote, this initialization will only happen in the renderer process if | |
61 // EnableSandbox() above is called, which it won't necesserily be. | |
62 // This only happens with flags such as --renderer-cmd-prefix which are | |
63 // for debugging. | |
64 if (no_sandbox) | |
65 return; | |
66 | |
67 // about:sandbox uses a value returned from LinuxSandbox::GetStatus() before | 48 // about:sandbox uses a value returned from LinuxSandbox::GetStatus() before |
68 // any renderer has been started. | 49 // any renderer has been started. |
69 // Here, we test that the status of SeccompBpf in the renderer is consistent | 50 // Here, we test that the status of SeccompBpf in the renderer is consistent |
70 // with what LinuxSandbox::GetStatus() said we would do. | 51 // with what LinuxSandbox::GetStatus() said we would do. |
71 class LinuxSandbox* linux_sandbox = LinuxSandbox::GetInstance(); | 52 class LinuxSandbox* linux_sandbox = LinuxSandbox::GetInstance(); |
72 if (linux_sandbox->GetStatus() & kSandboxLinuxSeccompBPF) { | 53 if (linux_sandbox->GetStatus() & kSandboxLinuxSeccompBPF) { |
73 CHECK(linux_sandbox->seccomp_bpf_started()); | 54 CHECK(linux_sandbox->seccomp_bpf_started()); |
74 } | 55 } |
75 | 56 |
76 // Under the setuid sandbox, we should not be able to open any file via the | 57 // Under the setuid sandbox, we should not be able to open any file via the |
77 // filesystem. | 58 // filesystem. |
78 if (linux_sandbox->GetStatus() & kSandboxLinuxSUID) { | 59 if (linux_sandbox->GetStatus() & kSandboxLinuxSUID) { |
79 CHECK(!base::PathExists(base::FilePath("/proc/cpuinfo"))); | 60 CHECK(!base::PathExists(base::FilePath("/proc/cpuinfo"))); |
80 } | 61 } |
81 | 62 |
82 #if defined(__x86_64__) | 63 #if defined(__x86_64__) |
83 // Limit this test to architectures where seccomp BPF is active in renderers. | 64 // Limit this test to architectures where seccomp BPF is active in renderers. |
84 if (linux_sandbox->seccomp_bpf_started()) { | 65 if (linux_sandbox->seccomp_bpf_started()) { |
85 errno = 0; | 66 errno = 0; |
86 // This should normally return EBADF since the first argument is bogus, | 67 // This should normally return EBADF since the first argument is bogus, |
87 // but we know that under the seccomp-bpf sandbox, this should return EPERM. | 68 // but we know that under the seccomp-bpf sandbox, this should return EPERM. |
88 CHECK_EQ(fchmod(-1, 07777), -1); | 69 CHECK_EQ(fchmod(-1, 07777), -1); |
89 CHECK_EQ(errno, EPERM); | 70 CHECK_EQ(errno, EPERM); |
90 } | 71 } |
91 #endif // __x86_64__ | 72 #endif // __x86_64__ |
| 73 |
| 74 return true; |
92 } | 75 } |
93 | 76 |
94 } // namespace content | 77 } // namespace content |
OLD | NEW |