Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(302)

Side by Side Diff: content/common/sandbox_linux/sandbox_linux.cc

Issue 456513002: Add base:: qualification to some CommandLine references in content. (Closed) Base URL: svn://svn.chromium.org/chrome/trunk/src
Patch Set: imerge Created 6 years, 4 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch | Annotate | Revision Log
OLDNEW
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be 2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file. 3 // found in the LICENSE file.
4 4
5 #include <dirent.h> 5 #include <dirent.h>
6 #include <fcntl.h> 6 #include <fcntl.h>
7 #include <sys/resource.h> 7 #include <sys/resource.h>
8 #include <sys/stat.h> 8 #include <sys/stat.h>
9 #include <sys/time.h> 9 #include <sys/time.h>
10 #include <sys/types.h> 10 #include <sys/types.h>
(...skipping 34 matching lines...) Expand 10 before | Expand all | Expand 10 after
45 45
46 struct FDCloser { 46 struct FDCloser {
47 inline void operator()(int* fd) const { 47 inline void operator()(int* fd) const {
48 DCHECK(fd); 48 DCHECK(fd);
49 PCHECK(0 == IGNORE_EINTR(close(*fd))); 49 PCHECK(0 == IGNORE_EINTR(close(*fd)));
50 *fd = -1; 50 *fd = -1;
51 } 51 }
52 }; 52 };
53 53
54 void LogSandboxStarted(const std::string& sandbox_name) { 54 void LogSandboxStarted(const std::string& sandbox_name) {
55 const CommandLine& command_line = *CommandLine::ForCurrentProcess(); 55 const base::CommandLine& command_line =
56 *base::CommandLine::ForCurrentProcess();
56 const std::string process_type = 57 const std::string process_type =
57 command_line.GetSwitchValueASCII(switches::kProcessType); 58 command_line.GetSwitchValueASCII(switches::kProcessType);
58 const std::string activated_sandbox = 59 const std::string activated_sandbox =
59 "Activated " + sandbox_name + " sandbox for process type: " + 60 "Activated " + sandbox_name + " sandbox for process type: " +
60 process_type + "."; 61 process_type + ".";
61 VLOG(1) << activated_sandbox; 62 VLOG(1) << activated_sandbox;
62 } 63 }
63 64
64 #if !defined(ADDRESS_SANITIZER) && !defined(MEMORY_SANITIZER) 65 #if !defined(ADDRESS_SANITIZER) && !defined(MEMORY_SANITIZER)
65 bool AddResourceLimit(int resource, rlim_t limit) { 66 bool AddResourceLimit(int resource, rlim_t limit) {
(...skipping 187 matching lines...) Expand 10 before | Expand all | Expand 10 after
253 if (seccomp_bpf_supported()) 254 if (seccomp_bpf_supported())
254 seccomp_bpf_started_ = SandboxSeccompBPF::StartSandbox(process_type); 255 seccomp_bpf_started_ = SandboxSeccompBPF::StartSandbox(process_type);
255 256
256 if (seccomp_bpf_started_) 257 if (seccomp_bpf_started_)
257 LogSandboxStarted("seccomp-bpf"); 258 LogSandboxStarted("seccomp-bpf");
258 259
259 return seccomp_bpf_started_; 260 return seccomp_bpf_started_;
260 } 261 }
261 262
262 bool LinuxSandbox::InitializeSandboxImpl() { 263 bool LinuxSandbox::InitializeSandboxImpl() {
263 CommandLine* command_line = CommandLine::ForCurrentProcess(); 264 base::CommandLine* command_line = base::CommandLine::ForCurrentProcess();
264 const std::string process_type = 265 const std::string process_type =
265 command_line->GetSwitchValueASCII(switches::kProcessType); 266 command_line->GetSwitchValueASCII(switches::kProcessType);
266 267
267 // We need to make absolutely sure that our sandbox is "sealed" before 268 // We need to make absolutely sure that our sandbox is "sealed" before
268 // returning. 269 // returning.
269 // Unretained() since the current object is a Singleton. 270 // Unretained() since the current object is a Singleton.
270 base::ScopedClosureRunner sandbox_sealer( 271 base::ScopedClosureRunner sandbox_sealer(
271 base::Bind(&LinuxSandbox::SealSandbox, base::Unretained(this))); 272 base::Bind(&LinuxSandbox::SealSandbox, base::Unretained(this)));
272 // Make sure that this function enables sandboxes as promised by GetStatus(). 273 // Make sure that this function enables sandboxes as promised by GetStatus().
273 // Unretained() since the current object is a Singleton. 274 // Unretained() since the current object is a Singleton.
(...skipping 54 matching lines...) Expand 10 before | Expand all | Expand 10 after
328 } 329 }
329 330
330 bool LinuxSandbox::seccomp_bpf_supported() const { 331 bool LinuxSandbox::seccomp_bpf_supported() const {
331 CHECK(pre_initialized_); 332 CHECK(pre_initialized_);
332 return seccomp_bpf_supported_; 333 return seccomp_bpf_supported_;
333 } 334 }
334 335
335 bool LinuxSandbox::LimitAddressSpace(const std::string& process_type) { 336 bool LinuxSandbox::LimitAddressSpace(const std::string& process_type) {
336 (void) process_type; 337 (void) process_type;
337 #if !defined(ADDRESS_SANITIZER) && !defined(MEMORY_SANITIZER) 338 #if !defined(ADDRESS_SANITIZER) && !defined(MEMORY_SANITIZER)
338 CommandLine* command_line = CommandLine::ForCurrentProcess(); 339 base::CommandLine* command_line = base::CommandLine::ForCurrentProcess();
339 if (command_line->HasSwitch(switches::kNoSandbox)) { 340 if (command_line->HasSwitch(switches::kNoSandbox)) {
340 return false; 341 return false;
341 } 342 }
342 343
343 // Limit the address space to 4GB. 344 // Limit the address space to 4GB.
344 // This is in the hope of making some kernel exploits more complex and less 345 // This is in the hope of making some kernel exploits more complex and less
345 // reliable. It also limits sprays a little on 64-bit. 346 // reliable. It also limits sprays a little on 64-bit.
346 rlim_t address_space_limit = std::numeric_limits<uint32_t>::max(); 347 rlim_t address_space_limit = std::numeric_limits<uint32_t>::max();
347 #if defined(__LP64__) 348 #if defined(__LP64__)
348 // On 64 bits, V8 and possibly others will reserve massive memory ranges and 349 // On 64 bits, V8 and possibly others will reserve massive memory ranges and
(...skipping 57 matching lines...) Expand 10 before | Expand all | Expand 10 after
406 407
407 void LinuxSandbox::StopThreadAndEnsureNotCounted(base::Thread* thread) const { 408 void LinuxSandbox::StopThreadAndEnsureNotCounted(base::Thread* thread) const {
408 DCHECK(thread); 409 DCHECK(thread);
409 base::ScopedFD proc_self_task(OpenProcTaskFd(proc_fd_)); 410 base::ScopedFD proc_self_task(OpenProcTaskFd(proc_fd_));
410 PCHECK(proc_self_task.is_valid()); 411 PCHECK(proc_self_task.is_valid());
411 CHECK(sandbox::ThreadHelpers::StopThreadAndWatchProcFS(proc_self_task.get(), 412 CHECK(sandbox::ThreadHelpers::StopThreadAndWatchProcFS(proc_self_task.get(),
412 thread)); 413 thread));
413 } 414 }
414 415
415 } // namespace content 416 } // namespace content
OLDNEW
« no previous file with comments | « content/common/sandbox_linux/bpf_gpu_policy_linux.cc ('k') | content/common/sandbox_linux/sandbox_seccomp_bpf_linux.cc » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698