Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(1052)

Side by Side Diff: content/renderer/renderer_main_platform_delegate_linux.cc

Issue 285283003: Remove flag --test-sandbox (Closed) Base URL: https://chromium.googlesource.com/chromium/src.git@master
Patch Set: change requested by resek, thanks Created 6 years, 6 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
OLDNEW
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be 2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file. 3 // found in the LICENSE file.
4 4
5 #include "content/renderer/renderer_main_platform_delegate.h" 5 #include "content/renderer/renderer_main_platform_delegate.h"
6 6
7 #include <errno.h> 7 #include <errno.h>
8 #include <sys/stat.h> 8 #include <sys/stat.h>
9 9
10 #include "base/command_line.h" 10 #include "base/command_line.h"
(...skipping 21 matching lines...) Expand all
32 #ifdef ENABLE_VTUNE_JIT_INTERFACE 32 #ifdef ENABLE_VTUNE_JIT_INTERFACE
33 const CommandLine& command_line = parameters_.command_line; 33 const CommandLine& command_line = parameters_.command_line;
34 if (command_line.HasSwitch(switches::kEnableVtune)) 34 if (command_line.HasSwitch(switches::kEnableVtune))
35 vTune::InitializeVtuneForV8(); 35 vTune::InitializeVtuneForV8();
36 #endif 36 #endif
37 } 37 }
38 38
39 void RendererMainPlatformDelegate::PlatformUninitialize() { 39 void RendererMainPlatformDelegate::PlatformUninitialize() {
40 } 40 }
41 41
42 bool RendererMainPlatformDelegate::InitSandboxTests(bool no_sandbox) {
43 // The sandbox is started in the zygote process: zygote_main_linux.cc
44 // http://code.google.com/p/chromium/wiki/LinuxSUIDSandbox
45 return true;
46 }
47
48 bool RendererMainPlatformDelegate::EnableSandbox() { 42 bool RendererMainPlatformDelegate::EnableSandbox() {
49 // The setuid sandbox is started in the zygote process: zygote_main_linux.cc 43 // The setuid sandbox is started in the zygote process: zygote_main_linux.cc
50 // http://code.google.com/p/chromium/wiki/LinuxSUIDSandbox 44 // http://code.google.com/p/chromium/wiki/LinuxSUIDSandbox
51 // 45 //
52 // Anything else is started in InitializeSandbox(). 46 // Anything else is started in InitializeSandbox().
53 LinuxSandbox::InitializeSandbox(); 47 LinuxSandbox::InitializeSandbox();
54 return true;
55 }
56
57 void RendererMainPlatformDelegate::RunSandboxTests(bool no_sandbox) {
58 // The LinuxSandbox class requires going through initialization before
59 // GetStatus() and others can be used. When we are not launched through the
60 // Zygote, this initialization will only happen in the renderer process if
61 // EnableSandbox() above is called, which it won't necesserily be.
62 // This only happens with flags such as --renderer-cmd-prefix which are
63 // for debugging.
64 if (no_sandbox)
65 return;
66
67 // about:sandbox uses a value returned from LinuxSandbox::GetStatus() before 48 // about:sandbox uses a value returned from LinuxSandbox::GetStatus() before
68 // any renderer has been started. 49 // any renderer has been started.
69 // Here, we test that the status of SeccompBpf in the renderer is consistent 50 // Here, we test that the status of SeccompBpf in the renderer is consistent
70 // with what LinuxSandbox::GetStatus() said we would do. 51 // with what LinuxSandbox::GetStatus() said we would do.
71 class LinuxSandbox* linux_sandbox = LinuxSandbox::GetInstance(); 52 class LinuxSandbox* linux_sandbox = LinuxSandbox::GetInstance();
72 if (linux_sandbox->GetStatus() & kSandboxLinuxSeccompBPF) { 53 if (linux_sandbox->GetStatus() & kSandboxLinuxSeccompBPF) {
73 CHECK(linux_sandbox->seccomp_bpf_started()); 54 CHECK(linux_sandbox->seccomp_bpf_started());
74 } 55 }
75 56
76 // Under the setuid sandbox, we should not be able to open any file via the 57 // Under the setuid sandbox, we should not be able to open any file via the
77 // filesystem. 58 // filesystem.
78 if (linux_sandbox->GetStatus() & kSandboxLinuxSUID) { 59 if (linux_sandbox->GetStatus() & kSandboxLinuxSUID) {
79 CHECK(!base::PathExists(base::FilePath("/proc/cpuinfo"))); 60 CHECK(!base::PathExists(base::FilePath("/proc/cpuinfo")));
80 } 61 }
81 62
82 #if defined(__x86_64__) 63 #if defined(__x86_64__)
83 // Limit this test to architectures where seccomp BPF is active in renderers. 64 // Limit this test to architectures where seccomp BPF is active in renderers.
84 if (linux_sandbox->seccomp_bpf_started()) { 65 if (linux_sandbox->seccomp_bpf_started()) {
85 errno = 0; 66 errno = 0;
86 // This should normally return EBADF since the first argument is bogus, 67 // This should normally return EBADF since the first argument is bogus,
87 // but we know that under the seccomp-bpf sandbox, this should return EPERM. 68 // but we know that under the seccomp-bpf sandbox, this should return EPERM.
88 CHECK_EQ(fchmod(-1, 07777), -1); 69 CHECK_EQ(fchmod(-1, 07777), -1);
89 CHECK_EQ(errno, EPERM); 70 CHECK_EQ(errno, EPERM);
90 } 71 }
91 #endif // __x86_64__ 72 #endif // __x86_64__
73
74 return true;
92 } 75 }
93 76
94 } // namespace content 77 } // namespace content
OLDNEW
« no previous file with comments | « content/renderer/renderer_main_platform_delegate_android.cc ('k') | content/renderer/renderer_main_platform_delegate_mac.mm » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698