OLD | NEW |
1 // Copyright 2013 The Chromium Authors. All rights reserved. | 1 // Copyright 2013 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 // A mini-zygote specifically for Native Client. | 5 // A mini-zygote specifically for Native Client. |
6 | 6 |
7 #include "components/nacl/loader/nacl_helper_linux.h" | 7 #include "components/nacl/loader/nacl_helper_linux.h" |
8 | 8 |
9 #include <errno.h> | 9 #include <errno.h> |
10 #include <fcntl.h> | 10 #include <fcntl.h> |
(...skipping 17 matching lines...) Expand all Loading... |
28 #include "base/message_loop/message_loop.h" | 28 #include "base/message_loop/message_loop.h" |
29 #include "base/posix/eintr_wrapper.h" | 29 #include "base/posix/eintr_wrapper.h" |
30 #include "base/posix/global_descriptors.h" | 30 #include "base/posix/global_descriptors.h" |
31 #include "base/posix/unix_domain_socket_linux.h" | 31 #include "base/posix/unix_domain_socket_linux.h" |
32 #include "base/process/kill.h" | 32 #include "base/process/kill.h" |
33 #include "base/process/process_handle.h" | 33 #include "base/process/process_handle.h" |
34 #include "base/rand_util.h" | 34 #include "base/rand_util.h" |
35 #include "components/nacl/common/nacl_switches.h" | 35 #include "components/nacl/common/nacl_switches.h" |
36 #include "components/nacl/loader/nacl_listener.h" | 36 #include "components/nacl/loader/nacl_listener.h" |
37 #include "components/nacl/loader/nonsfi/irt_exception_handling.h" | 37 #include "components/nacl/loader/nonsfi/irt_exception_handling.h" |
| 38 #include "components/nacl/loader/nonsfi/nonsfi_listener.h" |
38 #include "components/nacl/loader/sandbox_linux/nacl_sandbox_linux.h" | 39 #include "components/nacl/loader/sandbox_linux/nacl_sandbox_linux.h" |
39 #include "content/public/common/child_process_sandbox_support_linux.h" | 40 #include "content/public/common/child_process_sandbox_support_linux.h" |
40 #include "content/public/common/content_descriptors.h" | 41 #include "content/public/common/content_descriptors.h" |
41 #include "content/public/common/zygote_fork_delegate_linux.h" | 42 #include "content/public/common/zygote_fork_delegate_linux.h" |
42 #include "crypto/nss_util.h" | 43 #include "crypto/nss_util.h" |
43 #include "ipc/ipc_descriptors.h" | 44 #include "ipc/ipc_descriptors.h" |
44 #include "ipc/ipc_switches.h" | 45 #include "ipc/ipc_switches.h" |
45 #include "sandbox/linux/services/libc_urandom_override.h" | 46 #include "sandbox/linux/services/libc_urandom_override.h" |
46 | 47 |
47 namespace { | 48 namespace { |
(...skipping 51 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
99 // Finish layer-1 sandbox initialization and initialize the layer-2 sandbox. | 100 // Finish layer-1 sandbox initialization and initialize the layer-2 sandbox. |
100 CHECK(!nacl_sandbox->HasOpenDirectory()); | 101 CHECK(!nacl_sandbox->HasOpenDirectory()); |
101 nacl_sandbox->InitializeLayerTwoSandbox(uses_nonsfi_mode); | 102 nacl_sandbox->InitializeLayerTwoSandbox(uses_nonsfi_mode); |
102 nacl_sandbox->SealLayerOneSandbox(); | 103 nacl_sandbox->SealLayerOneSandbox(); |
103 nacl_sandbox->CheckSandboxingStateWithPolicy(); | 104 nacl_sandbox->CheckSandboxingStateWithPolicy(); |
104 | 105 |
105 base::GlobalDescriptors::GetInstance()->Set(kPrimaryIPCChannel, | 106 base::GlobalDescriptors::GetInstance()->Set(kPrimaryIPCChannel, |
106 browser_fd.release()); | 107 browser_fd.release()); |
107 | 108 |
108 base::MessageLoopForIO main_message_loop; | 109 base::MessageLoopForIO main_message_loop; |
109 NaClListener listener; | 110 if (uses_nonsfi_mode) { |
110 listener.set_uses_nonsfi_mode(uses_nonsfi_mode); | 111 nacl::nonsfi::NonSfiListener listener; |
111 listener.set_prereserved_sandbox_size(system_info.prereserved_sandbox_size); | 112 listener.Listen(); |
112 listener.set_number_of_cores(system_info.number_of_cores); | 113 } else { |
113 listener.Listen(); | 114 NaClListener listener; |
| 115 listener.set_prereserved_sandbox_size(system_info.prereserved_sandbox_size); |
| 116 listener.set_number_of_cores(system_info.number_of_cores); |
| 117 listener.Listen(); |
| 118 } |
114 _exit(0); | 119 _exit(0); |
115 } | 120 } |
116 | 121 |
117 // Start the NaCl loader in a child created by the NaCl loader Zygote. | 122 // Start the NaCl loader in a child created by the NaCl loader Zygote. |
118 void ChildNaClLoaderInit(ScopedVector<base::ScopedFD> child_fds, | 123 void ChildNaClLoaderInit(ScopedVector<base::ScopedFD> child_fds, |
119 const NaClLoaderSystemInfo& system_info, | 124 const NaClLoaderSystemInfo& system_info, |
120 bool uses_nonsfi_mode, | 125 bool uses_nonsfi_mode, |
121 nacl::NaClSandbox* nacl_sandbox, | 126 nacl::NaClSandbox* nacl_sandbox, |
122 const std::string& channel_id) { | 127 const std::string& channel_id) { |
123 DCHECK(child_fds.size() > | 128 DCHECK(child_fds.size() > |
(...skipping 314 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
438 // Now handle requests from the Zygote. | 443 // Now handle requests from the Zygote. |
439 while (true) { | 444 while (true) { |
440 bool request_handled = HandleZygoteRequest( | 445 bool request_handled = HandleZygoteRequest( |
441 kNaClZygoteDescriptor, system_info, nacl_sandbox.get()); | 446 kNaClZygoteDescriptor, system_info, nacl_sandbox.get()); |
442 // Do not turn this into a CHECK() without thinking about robustness | 447 // Do not turn this into a CHECK() without thinking about robustness |
443 // against malicious IPC requests. | 448 // against malicious IPC requests. |
444 DCHECK(request_handled); | 449 DCHECK(request_handled); |
445 } | 450 } |
446 NOTREACHED(); | 451 NOTREACHED(); |
447 } | 452 } |
OLD | NEW |