| OLD | NEW |
| 1 // Copyright 2013 The Chromium Authors. All rights reserved. | 1 // Copyright 2013 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 // A mini-zygote specifically for Native Client. | 5 // A mini-zygote specifically for Native Client. |
| 6 | 6 |
| 7 #include "components/nacl/loader/nacl_helper_linux.h" | 7 #include "components/nacl/loader/nacl_helper_linux.h" |
| 8 | 8 |
| 9 #include <errno.h> | 9 #include <errno.h> |
| 10 #include <fcntl.h> | 10 #include <fcntl.h> |
| (...skipping 15 matching lines...) Expand all Loading... |
| 26 #include "base/memory/scoped_ptr.h" | 26 #include "base/memory/scoped_ptr.h" |
| 27 #include "base/memory/scoped_vector.h" | 27 #include "base/memory/scoped_vector.h" |
| 28 #include "base/message_loop/message_loop.h" | 28 #include "base/message_loop/message_loop.h" |
| 29 #include "base/posix/eintr_wrapper.h" | 29 #include "base/posix/eintr_wrapper.h" |
| 30 #include "base/posix/global_descriptors.h" | 30 #include "base/posix/global_descriptors.h" |
| 31 #include "base/posix/unix_domain_socket_linux.h" | 31 #include "base/posix/unix_domain_socket_linux.h" |
| 32 #include "base/process/kill.h" | 32 #include "base/process/kill.h" |
| 33 #include "base/process/process_handle.h" | 33 #include "base/process/process_handle.h" |
| 34 #include "base/rand_util.h" | 34 #include "base/rand_util.h" |
| 35 #include "components/nacl/common/nacl_switches.h" | 35 #include "components/nacl/common/nacl_switches.h" |
| 36 #include "components/nacl/loader/listener_delegate.h" |
| 36 #include "components/nacl/loader/nacl_listener.h" | 37 #include "components/nacl/loader/nacl_listener.h" |
| 37 #include "components/nacl/loader/nonsfi/irt_exception_handling.h" | 38 #include "components/nacl/loader/nonsfi/irt_exception_handling.h" |
| 39 #include "components/nacl/loader/nonsfi_listener_delegate.h" |
| 38 #include "components/nacl/loader/sandbox_linux/nacl_sandbox_linux.h" | 40 #include "components/nacl/loader/sandbox_linux/nacl_sandbox_linux.h" |
| 41 #include "components/nacl/loader/sfi_listener_delegate.h" |
| 39 #include "content/public/common/child_process_sandbox_support_linux.h" | 42 #include "content/public/common/child_process_sandbox_support_linux.h" |
| 40 #include "content/public/common/content_descriptors.h" | 43 #include "content/public/common/content_descriptors.h" |
| 41 #include "content/public/common/zygote_fork_delegate_linux.h" | 44 #include "content/public/common/zygote_fork_delegate_linux.h" |
| 42 #include "crypto/nss_util.h" | 45 #include "crypto/nss_util.h" |
| 43 #include "ipc/ipc_descriptors.h" | 46 #include "ipc/ipc_descriptors.h" |
| 44 #include "ipc/ipc_switches.h" | 47 #include "ipc/ipc_switches.h" |
| 45 #include "sandbox/linux/services/libc_urandom_override.h" | 48 #include "sandbox/linux/services/libc_urandom_override.h" |
| 46 | 49 |
| 47 namespace { | 50 namespace { |
| 48 | 51 |
| (...skipping 50 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 99 // Finish layer-1 sandbox initialization and initialize the layer-2 sandbox. | 102 // Finish layer-1 sandbox initialization and initialize the layer-2 sandbox. |
| 100 CHECK(!nacl_sandbox->HasOpenDirectory()); | 103 CHECK(!nacl_sandbox->HasOpenDirectory()); |
| 101 nacl_sandbox->InitializeLayerTwoSandbox(uses_nonsfi_mode); | 104 nacl_sandbox->InitializeLayerTwoSandbox(uses_nonsfi_mode); |
| 102 nacl_sandbox->SealLayerOneSandbox(); | 105 nacl_sandbox->SealLayerOneSandbox(); |
| 103 nacl_sandbox->CheckSandboxingStateWithPolicy(); | 106 nacl_sandbox->CheckSandboxingStateWithPolicy(); |
| 104 | 107 |
| 105 base::GlobalDescriptors::GetInstance()->Set(kPrimaryIPCChannel, | 108 base::GlobalDescriptors::GetInstance()->Set(kPrimaryIPCChannel, |
| 106 browser_fd.release()); | 109 browser_fd.release()); |
| 107 | 110 |
| 108 base::MessageLoopForIO main_message_loop; | 111 base::MessageLoopForIO main_message_loop; |
| 109 NaClListener listener; | 112 |
| 110 listener.set_uses_nonsfi_mode(uses_nonsfi_mode); | 113 scoped_ptr<nacl::ListenerDelegate> delegate; |
| 111 listener.set_prereserved_sandbox_size(system_info.prereserved_sandbox_size); | 114 if (uses_nonsfi_mode) { |
| 112 listener.set_number_of_cores(system_info.number_of_cores); | 115 delegate.reset(new nacl::NonSfiListenerDelegate); |
| 116 } else { |
| 117 nacl::SfiListenerDelegate* sfi_delegate = new nacl::SfiListenerDelegate; |
| 118 sfi_delegate->set_prereserved_sandbox_size( |
| 119 system_info.prereserved_sandbox_size); |
| 120 sfi_delegate->set_number_of_cores(system_info.number_of_cores); |
| 121 delegate.reset(sfi_delegate); |
| 122 } |
| 123 NaClListener listener(delegate.Pass()); |
| 113 listener.Listen(); | 124 listener.Listen(); |
| 114 _exit(0); | 125 _exit(0); |
| 115 } | 126 } |
| 116 | 127 |
| 117 // Start the NaCl loader in a child created by the NaCl loader Zygote. | 128 // Start the NaCl loader in a child created by the NaCl loader Zygote. |
| 118 void ChildNaClLoaderInit(ScopedVector<base::ScopedFD> child_fds, | 129 void ChildNaClLoaderInit(ScopedVector<base::ScopedFD> child_fds, |
| 119 const NaClLoaderSystemInfo& system_info, | 130 const NaClLoaderSystemInfo& system_info, |
| 120 bool uses_nonsfi_mode, | 131 bool uses_nonsfi_mode, |
| 121 nacl::NaClSandbox* nacl_sandbox, | 132 nacl::NaClSandbox* nacl_sandbox, |
| 122 const std::string& channel_id) { | 133 const std::string& channel_id) { |
| (...skipping 315 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 438 // Now handle requests from the Zygote. | 449 // Now handle requests from the Zygote. |
| 439 while (true) { | 450 while (true) { |
| 440 bool request_handled = HandleZygoteRequest( | 451 bool request_handled = HandleZygoteRequest( |
| 441 kNaClZygoteDescriptor, system_info, nacl_sandbox.get()); | 452 kNaClZygoteDescriptor, system_info, nacl_sandbox.get()); |
| 442 // Do not turn this into a CHECK() without thinking about robustness | 453 // Do not turn this into a CHECK() without thinking about robustness |
| 443 // against malicious IPC requests. | 454 // against malicious IPC requests. |
| 444 DCHECK(request_handled); | 455 DCHECK(request_handled); |
| 445 } | 456 } |
| 446 NOTREACHED(); | 457 NOTREACHED(); |
| 447 } | 458 } |
| OLD | NEW |