Chromium Code Reviews| OLD | NEW |
|---|---|
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include <dirent.h> | 5 #include <dirent.h> |
| 6 #include <fcntl.h> | 6 #include <fcntl.h> |
| 7 #include <sys/resource.h> | 7 #include <sys/resource.h> |
| 8 #include <sys/stat.h> | 8 #include <sys/stat.h> |
| 9 #include <sys/time.h> | 9 #include <sys/time.h> |
| 10 #include <sys/types.h> | 10 #include <sys/types.h> |
| (...skipping 16 matching lines...) Expand all Loading... | |
| 27 #include "build/build_config.h" | 27 #include "build/build_config.h" |
| 28 #include "content/common/sandbox_linux/sandbox_linux.h" | 28 #include "content/common/sandbox_linux/sandbox_linux.h" |
| 29 #include "content/common/sandbox_linux/sandbox_seccomp_bpf_linux.h" | 29 #include "content/common/sandbox_linux/sandbox_seccomp_bpf_linux.h" |
| 30 #include "content/public/common/content_switches.h" | 30 #include "content/public/common/content_switches.h" |
| 31 #include "content/public/common/sandbox_linux.h" | 31 #include "content/public/common/sandbox_linux.h" |
| 32 #include "sandbox/linux/services/credentials.h" | 32 #include "sandbox/linux/services/credentials.h" |
| 33 #include "sandbox/linux/services/thread_helpers.h" | 33 #include "sandbox/linux/services/thread_helpers.h" |
| 34 #include "sandbox/linux/services/yama.h" | 34 #include "sandbox/linux/services/yama.h" |
| 35 #include "sandbox/linux/suid/client/setuid_sandbox_client.h" | 35 #include "sandbox/linux/suid/client/setuid_sandbox_client.h" |
| 36 | 36 |
| 37 #if (defined(ADDRESS_SANITIZER) || defined(MEMORY_SANITIZER) || \ | |
| 38 defined(LEAK_SANITIZER)) | |
| 39 #include <sanitizer/common_interface_defs.h> | |
| 40 #endif | |
| 41 | |
| 37 using sandbox::Yama; | 42 using sandbox::Yama; |
| 38 | 43 |
| 39 namespace { | 44 namespace { |
| 40 | 45 |
| 41 struct FDCloser { | 46 struct FDCloser { |
| 42 inline void operator()(int* fd) const { | 47 inline void operator()(int* fd) const { |
| 43 DCHECK(fd); | 48 DCHECK(fd); |
| 44 PCHECK(0 == IGNORE_EINTR(close(*fd))); | 49 PCHECK(0 == IGNORE_EINTR(close(*fd))); |
| 45 *fd = -1; | 50 *fd = -1; |
| 46 } | 51 } |
| (...skipping 70 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
| 117 | 122 |
| 118 LinuxSandbox::~LinuxSandbox() { | 123 LinuxSandbox::~LinuxSandbox() { |
| 119 } | 124 } |
| 120 | 125 |
| 121 LinuxSandbox* LinuxSandbox::GetInstance() { | 126 LinuxSandbox* LinuxSandbox::GetInstance() { |
| 122 LinuxSandbox* instance = Singleton<LinuxSandbox>::get(); | 127 LinuxSandbox* instance = Singleton<LinuxSandbox>::get(); |
| 123 CHECK(instance); | 128 CHECK(instance); |
| 124 return instance; | 129 return instance; |
| 125 } | 130 } |
| 126 | 131 |
| 127 #if (defined(ADDRESS_SANITIZER) || defined(MEMORY_SANITIZER) || \ | |
| 128 defined(LEAK_SANITIZER)) && defined(OS_LINUX) | |
| 129 // Sanitizer API call to notify the tool the sandbox is going to be turned on. | |
| 130 extern "C" void __sanitizer_sandbox_on_notify(void *reserved); | |
| 131 #endif | |
| 132 | |
| 133 void LinuxSandbox::PreinitializeSandbox() { | 132 void LinuxSandbox::PreinitializeSandbox() { |
| 134 CHECK(!pre_initialized_); | 133 CHECK(!pre_initialized_); |
| 135 seccomp_bpf_supported_ = false; | 134 seccomp_bpf_supported_ = false; |
| 136 #if (defined(ADDRESS_SANITIZER) || defined(MEMORY_SANITIZER) || \ | 135 #if (defined(ADDRESS_SANITIZER) || defined(MEMORY_SANITIZER) || \ |
| 137 defined(LEAK_SANITIZER)) && defined(OS_LINUX) | 136 defined(LEAK_SANITIZER)) && defined(OS_LINUX) |
| 138 // Sanitizers need to open some resources before the sandbox is enabled. | 137 // Sanitizers need to open some resources before the sandbox is enabled. |
| 139 // This should not fork, not launch threads, not open a directory. | 138 // This should not fork, not launch threads, not open a directory. |
| 140 __sanitizer_sandbox_on_notify(/*reserved*/ NULL); | 139 __sanitizer_sandbox_on_notify(/*reserved*/ NULL); |
|
jln (very slow on Chromium)
2014/05/23 23:38:38
should that comment ("/* reserved */") be changed?
earthdok
2014/05/26 11:58:05
Done.
| |
| 141 #endif | 140 #endif |
| 142 | 141 |
| 143 #if !defined(NDEBUG) | 142 #if !defined(NDEBUG) |
| 144 // The in-process stack dumping needs to open /proc/self/maps and cache | 143 // The in-process stack dumping needs to open /proc/self/maps and cache |
| 145 // its contents before the sandbox is enabled. It also pre-opens the | 144 // its contents before the sandbox is enabled. It also pre-opens the |
| 146 // object files that are already loaded in the process address space. | 145 // object files that are already loaded in the process address space. |
| 147 base::debug::EnableInProcessStackDumpingForSandbox(); | 146 base::debug::EnableInProcessStackDumpingForSandbox(); |
| 148 | 147 |
| 149 // Open proc_fd_ only in Debug mode so that forgetting to close it doesn't | 148 // Open proc_fd_ only in Debug mode so that forgetting to close it doesn't |
| 150 // produce a sandbox escape in Release mode. | 149 // produce a sandbox escape in Release mode. |
| (...skipping 253 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
| 404 | 403 |
| 405 void LinuxSandbox::StopThreadAndEnsureNotCounted(base::Thread* thread) const { | 404 void LinuxSandbox::StopThreadAndEnsureNotCounted(base::Thread* thread) const { |
| 406 DCHECK(thread); | 405 DCHECK(thread); |
| 407 base::ScopedFD proc_self_task(OpenProcTaskFd(proc_fd_)); | 406 base::ScopedFD proc_self_task(OpenProcTaskFd(proc_fd_)); |
| 408 PCHECK(proc_self_task.is_valid()); | 407 PCHECK(proc_self_task.is_valid()); |
| 409 CHECK(sandbox::ThreadHelpers::StopThreadAndWatchProcFS(proc_self_task.get(), | 408 CHECK(sandbox::ThreadHelpers::StopThreadAndWatchProcFS(proc_self_task.get(), |
| 410 thread)); | 409 thread)); |
| 411 } | 410 } |
| 412 | 411 |
| 413 } // namespace content | 412 } // namespace content |
| OLD | NEW |