| OLD | NEW |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include <dirent.h> | 5 #include <dirent.h> |
| 6 #include <fcntl.h> | 6 #include <fcntl.h> |
| 7 #include <sys/resource.h> | 7 #include <sys/resource.h> |
| 8 #include <sys/stat.h> | 8 #include <sys/stat.h> |
| 9 #include <sys/time.h> | 9 #include <sys/time.h> |
| 10 #include <sys/types.h> | 10 #include <sys/types.h> |
| (...skipping 34 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 45 | 45 |
| 46 struct FDCloser { | 46 struct FDCloser { |
| 47 inline void operator()(int* fd) const { | 47 inline void operator()(int* fd) const { |
| 48 DCHECK(fd); | 48 DCHECK(fd); |
| 49 PCHECK(0 == IGNORE_EINTR(close(*fd))); | 49 PCHECK(0 == IGNORE_EINTR(close(*fd))); |
| 50 *fd = -1; | 50 *fd = -1; |
| 51 } | 51 } |
| 52 }; | 52 }; |
| 53 | 53 |
| 54 void LogSandboxStarted(const std::string& sandbox_name) { | 54 void LogSandboxStarted(const std::string& sandbox_name) { |
| 55 const CommandLine& command_line = *CommandLine::ForCurrentProcess(); | 55 const base::CommandLine& command_line = |
| 56 *base::CommandLine::ForCurrentProcess(); |
| 56 const std::string process_type = | 57 const std::string process_type = |
| 57 command_line.GetSwitchValueASCII(switches::kProcessType); | 58 command_line.GetSwitchValueASCII(switches::kProcessType); |
| 58 const std::string activated_sandbox = | 59 const std::string activated_sandbox = |
| 59 "Activated " + sandbox_name + " sandbox for process type: " + | 60 "Activated " + sandbox_name + " sandbox for process type: " + |
| 60 process_type + "."; | 61 process_type + "."; |
| 61 VLOG(1) << activated_sandbox; | 62 VLOG(1) << activated_sandbox; |
| 62 } | 63 } |
| 63 | 64 |
| 64 #if !defined(ADDRESS_SANITIZER) && !defined(MEMORY_SANITIZER) | 65 #if !defined(ADDRESS_SANITIZER) && !defined(MEMORY_SANITIZER) |
| 65 bool AddResourceLimit(int resource, rlim_t limit) { | 66 bool AddResourceLimit(int resource, rlim_t limit) { |
| (...skipping 187 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 253 if (seccomp_bpf_supported()) | 254 if (seccomp_bpf_supported()) |
| 254 seccomp_bpf_started_ = SandboxSeccompBPF::StartSandbox(process_type); | 255 seccomp_bpf_started_ = SandboxSeccompBPF::StartSandbox(process_type); |
| 255 | 256 |
| 256 if (seccomp_bpf_started_) | 257 if (seccomp_bpf_started_) |
| 257 LogSandboxStarted("seccomp-bpf"); | 258 LogSandboxStarted("seccomp-bpf"); |
| 258 | 259 |
| 259 return seccomp_bpf_started_; | 260 return seccomp_bpf_started_; |
| 260 } | 261 } |
| 261 | 262 |
| 262 bool LinuxSandbox::InitializeSandboxImpl() { | 263 bool LinuxSandbox::InitializeSandboxImpl() { |
| 263 CommandLine* command_line = CommandLine::ForCurrentProcess(); | 264 base::CommandLine* command_line = base::CommandLine::ForCurrentProcess(); |
| 264 const std::string process_type = | 265 const std::string process_type = |
| 265 command_line->GetSwitchValueASCII(switches::kProcessType); | 266 command_line->GetSwitchValueASCII(switches::kProcessType); |
| 266 | 267 |
| 267 // We need to make absolutely sure that our sandbox is "sealed" before | 268 // We need to make absolutely sure that our sandbox is "sealed" before |
| 268 // returning. | 269 // returning. |
| 269 // Unretained() since the current object is a Singleton. | 270 // Unretained() since the current object is a Singleton. |
| 270 base::ScopedClosureRunner sandbox_sealer( | 271 base::ScopedClosureRunner sandbox_sealer( |
| 271 base::Bind(&LinuxSandbox::SealSandbox, base::Unretained(this))); | 272 base::Bind(&LinuxSandbox::SealSandbox, base::Unretained(this))); |
| 272 // Make sure that this function enables sandboxes as promised by GetStatus(). | 273 // Make sure that this function enables sandboxes as promised by GetStatus(). |
| 273 // Unretained() since the current object is a Singleton. | 274 // Unretained() since the current object is a Singleton. |
| (...skipping 54 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 328 } | 329 } |
| 329 | 330 |
| 330 bool LinuxSandbox::seccomp_bpf_supported() const { | 331 bool LinuxSandbox::seccomp_bpf_supported() const { |
| 331 CHECK(pre_initialized_); | 332 CHECK(pre_initialized_); |
| 332 return seccomp_bpf_supported_; | 333 return seccomp_bpf_supported_; |
| 333 } | 334 } |
| 334 | 335 |
| 335 bool LinuxSandbox::LimitAddressSpace(const std::string& process_type) { | 336 bool LinuxSandbox::LimitAddressSpace(const std::string& process_type) { |
| 336 (void) process_type; | 337 (void) process_type; |
| 337 #if !defined(ADDRESS_SANITIZER) && !defined(MEMORY_SANITIZER) | 338 #if !defined(ADDRESS_SANITIZER) && !defined(MEMORY_SANITIZER) |
| 338 CommandLine* command_line = CommandLine::ForCurrentProcess(); | 339 base::CommandLine* command_line = base::CommandLine::ForCurrentProcess(); |
| 339 if (command_line->HasSwitch(switches::kNoSandbox)) { | 340 if (command_line->HasSwitch(switches::kNoSandbox)) { |
| 340 return false; | 341 return false; |
| 341 } | 342 } |
| 342 | 343 |
| 343 // Limit the address space to 4GB. | 344 // Limit the address space to 4GB. |
| 344 // This is in the hope of making some kernel exploits more complex and less | 345 // This is in the hope of making some kernel exploits more complex and less |
| 345 // reliable. It also limits sprays a little on 64-bit. | 346 // reliable. It also limits sprays a little on 64-bit. |
| 346 rlim_t address_space_limit = std::numeric_limits<uint32_t>::max(); | 347 rlim_t address_space_limit = std::numeric_limits<uint32_t>::max(); |
| 347 #if defined(__LP64__) | 348 #if defined(__LP64__) |
| 348 // On 64 bits, V8 and possibly others will reserve massive memory ranges and | 349 // On 64 bits, V8 and possibly others will reserve massive memory ranges and |
| (...skipping 57 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 406 | 407 |
| 407 void LinuxSandbox::StopThreadAndEnsureNotCounted(base::Thread* thread) const { | 408 void LinuxSandbox::StopThreadAndEnsureNotCounted(base::Thread* thread) const { |
| 408 DCHECK(thread); | 409 DCHECK(thread); |
| 409 base::ScopedFD proc_self_task(OpenProcTaskFd(proc_fd_)); | 410 base::ScopedFD proc_self_task(OpenProcTaskFd(proc_fd_)); |
| 410 PCHECK(proc_self_task.is_valid()); | 411 PCHECK(proc_self_task.is_valid()); |
| 411 CHECK(sandbox::ThreadHelpers::StopThreadAndWatchProcFS(proc_self_task.get(), | 412 CHECK(sandbox::ThreadHelpers::StopThreadAndWatchProcFS(proc_self_task.get(), |
| 412 thread)); | 413 thread)); |
| 413 } | 414 } |
| 414 | 415 |
| 415 } // namespace content | 416 } // namespace content |
| OLD | NEW |