Allow the seccomp sandbox to be enabled, even if the suid sandbox has...

sandbox/linux/seccomp/maps.cc

 #include <errno.h>
 #include <fcntl.h>
 #include <iostream>
 #include <linux/unistd.h>
 #include <signal.h>
 #include <stdarg.h>
 #include <stdlib.h>
 #include <sys/ptrace.h>
 #include <sys/types.h>
 #include <sys/wait.h>
 
 #include "library.h"
 #include "maps.h"
 #include "sandbox_impl.h"
 
 namespace playground {
 
-Maps::Maps(const std::string& maps_file) :
-    maps_file_(maps_file),
+Maps::Maps(int proc_self_maps) :
+    proc_self_maps_(proc_self_maps),
     begin_iter_(this, true, false),
     end_iter_(this, false, true),
     vsyscall_(0) {
-  int fd = open(maps_file.c_str(), O_RDONLY);
   Sandbox::SysCalls sys;
-  if (fd >= 0) {
+  if (proc_self_maps_ >= 0 &&
+      !sys.lseek(proc_self_maps_, 0, SEEK_SET)) {
     char buf[256] = { 0 };
     int len = 0, rc = 1;
     bool long_line = false;
     do {
       if (rc > 0) {
-        rc = Sandbox::read(sys, fd, buf + len, sizeof(buf) - len - 1);
+        rc = Sandbox::read(sys, proc_self_maps_, buf + len,
+                           sizeof(buf) - len - 1);
         if (rc > 0) {
           len += rc;
         }
       }
       char *ptr = buf;
       if (!long_line) {
         long_line = true;
         unsigned long start = strtoul(ptr, &ptr, 16);
         unsigned long stop = strtoul(ptr + 1, &ptr, 16);
         while (*ptr == ' ' || *ptr == '\t') ++ptr;
@@ skipping 46 matching lines @@
       for (;;) {
         if (!*ptr || *ptr++ == '\n') {
           long_line = false;
           memmove(buf, ptr, len - (ptr - buf));
           memset(buf + len - (ptr - buf), 0, ptr - buf);
           len -= (ptr - buf);
           break;
         }
       }
     } while (len || long_line);
-    NOINTR_SYS(close(fd));
   }
 }
 
 Maps::Iterator::Iterator(Maps* maps, bool at_beginning, bool at_end)
     : maps_(maps),
       at_beginning_(at_beginning),
       at_end_(at_end) {
 }
 
 Maps::LibraryMap::iterator& Maps::Iterator::getIterator() const {
@@ skipping 39 matching lines @@
 
 std::string Maps::Iterator::name() const {
   return getIterator()->first;
 }
 
 char* Maps::allocNearAddr(char* addr, size_t size, int prot) const {
   // We try to allocate memory within 1.5GB of a target address. This means,
   // we will be able to perform relative 32bit jumps from the target address.
   size = (size + 4095) & ~4095;
   Sandbox::SysCalls sys;
-  int fd = sys.open(maps_file_.c_str(), O_RDONLY, 0);
-  if (fd < 0) {
+  if (sys.lseek(proc_self_maps_, 0, SEEK_SET)) {
     return NULL;
   }
 
   char buf[256] = { 0 };
   int len = 0, rc = 1;
   bool long_line = false;
   unsigned long gap_start = 0x10000;
   char *new_addr;
   do {
     if (rc > 0) {
       do {
-        rc = Sandbox::read(sys, fd, buf + len, sizeof(buf) - len - 1);
+        rc = Sandbox::read(sys, proc_self_maps_, buf + len,
+                           sizeof(buf) - len - 1);
         if (rc > 0) {
           len += rc;
         }
       } while (rc > 0 && len < (int)sizeof(buf) - 1);
     }
     char *ptr = buf;
     if (!long_line) {
       long_line = true;
       unsigned long start = strtoul(ptr, &ptr, 16);
       unsigned long stop = strtoul(ptr + 1, &ptr, 16);
@@ skipping 24 matching lines @@
         long_line = false;
         memmove(buf, ptr, len - (ptr - buf));
         memset(buf + len - (ptr - buf), 0, ptr - buf);
         len -= (ptr - buf);
         break;
       }
     }
   } while (len || long_line);
   new_addr = NULL;
 done:
-  sys.close(fd);
   return new_addr;
 }
 
 } // namespace