OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include <dirent.h> | 5 #include <dirent.h> |
6 #include <fcntl.h> | 6 #include <fcntl.h> |
7 #include <sys/resource.h> | 7 #include <sys/resource.h> |
8 #include <sys/stat.h> | 8 #include <sys/stat.h> |
9 #include <sys/time.h> | 9 #include <sys/time.h> |
10 #include <sys/types.h> | 10 #include <sys/types.h> |
(...skipping 16 matching lines...) Expand all Loading... |
27 #include "build/build_config.h" | 27 #include "build/build_config.h" |
28 #include "content/common/sandbox_linux/sandbox_linux.h" | 28 #include "content/common/sandbox_linux/sandbox_linux.h" |
29 #include "content/common/sandbox_linux/sandbox_seccomp_bpf_linux.h" | 29 #include "content/common/sandbox_linux/sandbox_seccomp_bpf_linux.h" |
30 #include "content/public/common/content_switches.h" | 30 #include "content/public/common/content_switches.h" |
31 #include "content/public/common/sandbox_linux.h" | 31 #include "content/public/common/sandbox_linux.h" |
32 #include "sandbox/linux/services/credentials.h" | 32 #include "sandbox/linux/services/credentials.h" |
33 #include "sandbox/linux/services/thread_helpers.h" | 33 #include "sandbox/linux/services/thread_helpers.h" |
34 #include "sandbox/linux/services/yama.h" | 34 #include "sandbox/linux/services/yama.h" |
35 #include "sandbox/linux/suid/client/setuid_sandbox_client.h" | 35 #include "sandbox/linux/suid/client/setuid_sandbox_client.h" |
36 | 36 |
| 37 #if (defined(ADDRESS_SANITIZER) || defined(MEMORY_SANITIZER) || \ |
| 38 defined(LEAK_SANITIZER)) |
| 39 #include <sanitizer/common_interface_defs.h> |
| 40 #endif |
| 41 |
37 using sandbox::Yama; | 42 using sandbox::Yama; |
38 | 43 |
39 namespace { | 44 namespace { |
40 | 45 |
41 struct FDCloser { | 46 struct FDCloser { |
42 inline void operator()(int* fd) const { | 47 inline void operator()(int* fd) const { |
43 DCHECK(fd); | 48 DCHECK(fd); |
44 PCHECK(0 == IGNORE_EINTR(close(*fd))); | 49 PCHECK(0 == IGNORE_EINTR(close(*fd))); |
45 *fd = -1; | 50 *fd = -1; |
46 } | 51 } |
(...skipping 70 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
117 | 122 |
118 LinuxSandbox::~LinuxSandbox() { | 123 LinuxSandbox::~LinuxSandbox() { |
119 } | 124 } |
120 | 125 |
121 LinuxSandbox* LinuxSandbox::GetInstance() { | 126 LinuxSandbox* LinuxSandbox::GetInstance() { |
122 LinuxSandbox* instance = Singleton<LinuxSandbox>::get(); | 127 LinuxSandbox* instance = Singleton<LinuxSandbox>::get(); |
123 CHECK(instance); | 128 CHECK(instance); |
124 return instance; | 129 return instance; |
125 } | 130 } |
126 | 131 |
127 #if (defined(ADDRESS_SANITIZER) || defined(MEMORY_SANITIZER) || \ | |
128 defined(LEAK_SANITIZER)) && defined(OS_LINUX) | |
129 // Sanitizer API call to notify the tool the sandbox is going to be turned on. | |
130 extern "C" void __sanitizer_sandbox_on_notify(void *reserved); | |
131 #endif | |
132 | |
133 void LinuxSandbox::PreinitializeSandbox() { | 132 void LinuxSandbox::PreinitializeSandbox() { |
134 CHECK(!pre_initialized_); | 133 CHECK(!pre_initialized_); |
135 seccomp_bpf_supported_ = false; | 134 seccomp_bpf_supported_ = false; |
136 #if (defined(ADDRESS_SANITIZER) || defined(MEMORY_SANITIZER) || \ | 135 #if (defined(ADDRESS_SANITIZER) || defined(MEMORY_SANITIZER) || \ |
137 defined(LEAK_SANITIZER)) && defined(OS_LINUX) | 136 defined(LEAK_SANITIZER)) && defined(OS_LINUX) |
138 // Sanitizers need to open some resources before the sandbox is enabled. | 137 // Sanitizers need to open some resources before the sandbox is enabled. |
139 // This should not fork, not launch threads, not open a directory. | 138 // This should not fork, not launch threads, not open a directory. |
140 __sanitizer_sandbox_on_notify(/*reserved*/ NULL); | 139 __sanitizer_sandbox_on_notify(/*args*/ NULL); |
141 #endif | 140 #endif |
142 | 141 |
143 #if !defined(NDEBUG) | 142 #if !defined(NDEBUG) |
144 // The in-process stack dumping needs to open /proc/self/maps and cache | 143 // The in-process stack dumping needs to open /proc/self/maps and cache |
145 // its contents before the sandbox is enabled. It also pre-opens the | 144 // its contents before the sandbox is enabled. It also pre-opens the |
146 // object files that are already loaded in the process address space. | 145 // object files that are already loaded in the process address space. |
147 base::debug::EnableInProcessStackDumpingForSandbox(); | 146 base::debug::EnableInProcessStackDumpingForSandbox(); |
148 | 147 |
149 // Open proc_fd_ only in Debug mode so that forgetting to close it doesn't | 148 // Open proc_fd_ only in Debug mode so that forgetting to close it doesn't |
150 // produce a sandbox escape in Release mode. | 149 // produce a sandbox escape in Release mode. |
(...skipping 253 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
404 | 403 |
405 void LinuxSandbox::StopThreadAndEnsureNotCounted(base::Thread* thread) const { | 404 void LinuxSandbox::StopThreadAndEnsureNotCounted(base::Thread* thread) const { |
406 DCHECK(thread); | 405 DCHECK(thread); |
407 base::ScopedFD proc_self_task(OpenProcTaskFd(proc_fd_)); | 406 base::ScopedFD proc_self_task(OpenProcTaskFd(proc_fd_)); |
408 PCHECK(proc_self_task.is_valid()); | 407 PCHECK(proc_self_task.is_valid()); |
409 CHECK(sandbox::ThreadHelpers::StopThreadAndWatchProcFS(proc_self_task.get(), | 408 CHECK(sandbox::ThreadHelpers::StopThreadAndWatchProcFS(proc_self_task.get(), |
410 thread)); | 409 thread)); |
411 } | 410 } |
412 | 411 |
413 } // namespace content | 412 } // namespace content |
OLD | NEW |