| OLD | NEW |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "content/renderer/renderer_main_platform_delegate.h" | 5 #include "content/renderer/renderer_main_platform_delegate.h" |
| 6 | 6 |
| 7 #include <errno.h> | 7 #include <errno.h> |
| 8 #include <sys/stat.h> | 8 #include <sys/stat.h> |
| 9 | 9 |
| 10 #include "base/command_line.h" | 10 #include "base/command_line.h" |
| (...skipping 21 matching lines...) Expand all Loading... |
| 32 #ifdef ENABLE_VTUNE_JIT_INTERFACE | 32 #ifdef ENABLE_VTUNE_JIT_INTERFACE |
| 33 const CommandLine& command_line = parameters_.command_line; | 33 const CommandLine& command_line = parameters_.command_line; |
| 34 if (command_line.HasSwitch(switches::kEnableVtune)) | 34 if (command_line.HasSwitch(switches::kEnableVtune)) |
| 35 vTune::InitializeVtuneForV8(); | 35 vTune::InitializeVtuneForV8(); |
| 36 #endif | 36 #endif |
| 37 } | 37 } |
| 38 | 38 |
| 39 void RendererMainPlatformDelegate::PlatformUninitialize() { | 39 void RendererMainPlatformDelegate::PlatformUninitialize() { |
| 40 } | 40 } |
| 41 | 41 |
| 42 bool RendererMainPlatformDelegate::InitSandboxTests(bool no_sandbox) { | |
| 43 // The sandbox is started in the zygote process: zygote_main_linux.cc | |
| 44 // http://code.google.com/p/chromium/wiki/LinuxSUIDSandbox | |
| 45 return true; | |
| 46 } | |
| 47 | |
| 48 bool RendererMainPlatformDelegate::EnableSandbox() { | 42 bool RendererMainPlatformDelegate::EnableSandbox() { |
| 49 // The setuid sandbox is started in the zygote process: zygote_main_linux.cc | 43 // The setuid sandbox is started in the zygote process: zygote_main_linux.cc |
| 50 // http://code.google.com/p/chromium/wiki/LinuxSUIDSandbox | 44 // http://code.google.com/p/chromium/wiki/LinuxSUIDSandbox |
| 51 // | 45 // |
| 52 // Anything else is started in InitializeSandbox(). | 46 // Anything else is started in InitializeSandbox(). |
| 53 LinuxSandbox::InitializeSandbox(); | 47 LinuxSandbox::InitializeSandbox(); |
| 54 return true; | |
| 55 } | |
| 56 | |
| 57 void RendererMainPlatformDelegate::RunSandboxTests(bool no_sandbox) { | |
| 58 // The LinuxSandbox class requires going through initialization before | |
| 59 // GetStatus() and others can be used. When we are not launched through the | |
| 60 // Zygote, this initialization will only happen in the renderer process if | |
| 61 // EnableSandbox() above is called, which it won't necesserily be. | |
| 62 // This only happens with flags such as --renderer-cmd-prefix which are | |
| 63 // for debugging. | |
| 64 if (no_sandbox) | |
| 65 return; | |
| 66 | |
| 67 // about:sandbox uses a value returned from LinuxSandbox::GetStatus() before | 48 // about:sandbox uses a value returned from LinuxSandbox::GetStatus() before |
| 68 // any renderer has been started. | 49 // any renderer has been started. |
| 69 // Here, we test that the status of SeccompBpf in the renderer is consistent | 50 // Here, we test that the status of SeccompBpf in the renderer is consistent |
| 70 // with what LinuxSandbox::GetStatus() said we would do. | 51 // with what LinuxSandbox::GetStatus() said we would do. |
| 71 class LinuxSandbox* linux_sandbox = LinuxSandbox::GetInstance(); | 52 class LinuxSandbox* linux_sandbox = LinuxSandbox::GetInstance(); |
| 72 if (linux_sandbox->GetStatus() & kSandboxLinuxSeccompBPF) { | 53 if (linux_sandbox->GetStatus() & kSandboxLinuxSeccompBPF) { |
| 73 CHECK(linux_sandbox->seccomp_bpf_started()); | 54 CHECK(linux_sandbox->seccomp_bpf_started()); |
| 74 } | 55 } |
| 75 | 56 |
| 76 // Under the setuid sandbox, we should not be able to open any file via the | 57 // Under the setuid sandbox, we should not be able to open any file via the |
| 77 // filesystem. | 58 // filesystem. |
| 78 if (linux_sandbox->GetStatus() & kSandboxLinuxSUID) { | 59 if (linux_sandbox->GetStatus() & kSandboxLinuxSUID) { |
| 79 CHECK(!base::PathExists(base::FilePath("/proc/cpuinfo"))); | 60 CHECK(!base::PathExists(base::FilePath("/proc/cpuinfo"))); |
| 80 } | 61 } |
| 81 | 62 |
| 82 #if defined(__x86_64__) | 63 #if defined(__x86_64__) |
| 83 // Limit this test to architectures where seccomp BPF is active in renderers. | 64 // Limit this test to architectures where seccomp BPF is active in renderers. |
| 84 if (linux_sandbox->seccomp_bpf_started()) { | 65 if (linux_sandbox->seccomp_bpf_started()) { |
| 85 errno = 0; | 66 errno = 0; |
| 86 // This should normally return EBADF since the first argument is bogus, | 67 // This should normally return EBADF since the first argument is bogus, |
| 87 // but we know that under the seccomp-bpf sandbox, this should return EPERM. | 68 // but we know that under the seccomp-bpf sandbox, this should return EPERM. |
| 88 CHECK_EQ(fchmod(-1, 07777), -1); | 69 CHECK_EQ(fchmod(-1, 07777), -1); |
| 89 CHECK_EQ(errno, EPERM); | 70 CHECK_EQ(errno, EPERM); |
| 90 } | 71 } |
| 91 #endif // __x86_64__ | 72 #endif // __x86_64__ |
| 73 |
| 74 return true; |
| 92 } | 75 } |
| 93 | 76 |
| 94 } // namespace content | 77 } // namespace content |
| OLD | NEW |