Allow the seccomp sandbox to be enabled, even if the suid sandbox has...

sandbox/linux/seccomp/securemem.cc

Index: sandbox/linux/seccomp/securemem.cc
===================================================================
--- sandbox/linux/seccomp/securemem.cc	(revision 31339)
+++ sandbox/linux/seccomp/securemem.cc	(working copy)
@@ -16,23 +16,27 @@
   }
 }
 
-void SecureMem::dieIfParentDied(int parentProc) {
+void SecureMem::dieIfParentDied(int parentMapsFd) {
   // The syscall_mutex_ should not be contended. If it is, we are either
   // experiencing a very unusual load of system calls that the sandbox is not
   // optimized for; or, more likely, the sandboxed process terminated while the
   // trusted process was in the middle of waiting for the mutex. We detect
   // this situation and terminate the trusted process.
-  char proc[80];
-  sprintf(proc, "/proc/self/fd/%d/status", parentProc);
-  struct stat sb;
-  if (stat(proc, &sb)) {
-      Sandbox::die();
+  int alive = !lseek(parentMapsFd, 0, SEEK_SET);
+  if (alive) {
+    char buf;
+    do {
+      alive = read(parentMapsFd, &buf, 1);
+    } while (alive < 0 && errno == EINTR);
   }
+  if (!alive) {
+    Sandbox::die();
+  }
 }
 
-void SecureMem::lockSystemCall(int parentProc, Args* mem) {
+void SecureMem::lockSystemCall(int parentMapsFd, Args* mem) {
   while (!Mutex::lockMutex(&Sandbox::syscall_mutex_, 500)) {
-    dieIfParentDied(parentProc);
+    dieIfParentDied(parentMapsFd);
   }
   asm volatile(
   #if defined(__x86_64__)
@@ -47,7 +51,7 @@
       : "memory");
 }
 
-void SecureMem::sendSystemCallInternal(int fd, bool locked, int parentProc,
+void SecureMem::sendSystemCallInternal(int fd, bool locked, int parentMapsFd,
                                        Args* mem, int syscallNum, void* arg1,
                                        void* arg2, void* arg3, void* arg4,
                                        void* arg5, void* arg6) {
@@ -87,9 +91,9 @@
   if (Sandbox::write(sys, fd, &data, sizeof(data)) != sizeof(data)) {
     Sandbox::die("Failed to send system call");
   }
-  if (parentProc >= 0) {
+  if (parentMapsFd >= 0) {
     while (!Mutex::waitForUnlock(&Sandbox::syscall_mutex_, 500)) {
-      dieIfParentDied(parentProc);
+      dieIfParentDied(parentMapsFd);
     }
   }
 }
Property changes on: sandbox/linux/seccomp/securemem.cc
___________________________________________________________________
Added: svn:eol-style
   + LF