Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(398)

Side by Side Diff: base/files/protect_file_posix.cc

Issue 676873004: Intercept file Open/Close (Closed) Base URL: https://chromium.googlesource.com/chromium/src.git@master
Patch Set: disable linker magic for component build Created 6 years, 1 month ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
OLDNEW
(Empty)
1 // Copyright 2014 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
4
5 #include "base/containers/hash_tables.h"
6 #include "base/files/file.h"
7 #include "base/lazy_instance.h"
8 #include "base/logging.h"
9 #include "base/posix/eintr_wrapper.h"
10 #include "base/synchronization/lock.h"
11
12 // These hooks provided for base::File perform additional sanity checks when
13 // files are closed.
14 //
15 // Background:
16 // 1. The browser process crashes if a call to close() provided by the C
17 // library (i.e. close(3)) fails. This is done for security purposes. See
18 // base/files/scoped_file.cc. When a crash like this happens, there is not
19 // enough context in the minidump to triage the problem.
20 // 2. base::File provides a good abstraction to prevent closing incorrect
21 // file descriptors or double-closing. Closing non-owned file descriptors
22 // would more likely happen from outside base::File and base::ScopedFD.
23 //
24 // These hooks intercept base::File operations to 'protect' file handles /
25 // descriptors from accidental close(3) by other portions of the code being
26 // linked into the browser. Also, this file provides an interceptor for the
27 // close(3) itself, and requires to be linked with cooperation of
28 // --Wl,--wrap=close (i.e. linker wrapping).
29 //
30 // Wrapping close(3) on all libraries can lead to confusion, particularly for
31 // the libraries that do not use ::base (I am also looking at you,
32 // crazy_linker). Instead two hooks are added to base::File, which are
gavinp 2014/11/04 15:02:02 Nit: one space after .
pasko 2014/11/04 17:48:06 Done.
33 // implemented as no-op by default. This file should be linked into the chrome
gavinp 2014/11/04 15:02:02 Nit: capitalise Chrome.
pasko 2014/11/04 17:48:06 Done.
34 // native binary(-ies) for a whitelist of targets where "file descriptor
35 // protection" is useful.
36
37 // With compilers other than GCC the wrapper is trivial. This is to avoid
Fabrice (no longer in Chrome) 2014/11/04 15:37:21 Nit: GCC and Clang
pasko 2014/11/04 17:48:06 Done.
38 // overexercising mechanisms for overriding weak symbols.
39 #if !defined(COMPILER_GCC)
40 extern "C" {
41
42 int __real_close(int fd);
43
44 BASE_EXPORT int __wrap_close(int fd) {
45 return __real_close(fd);
46 }
47
48 } // extern "C"
49
50 #else // defined(COMPILER_GCC)
51
52 namespace {
53
54 // Protects the |g_protected_fd_set|.
55 base::LazyInstance<base::Lock>::Leaky g_lock =
56 LAZY_INSTANCE_INITIALIZER;
gavinp 2014/11/04 15:02:02 Nit: can this go up on the previous line?
pasko 2014/11/04 17:48:06 Done.
57
58 // Holds the set of all 'protected' file descriptors.
59 typedef base::hash_set<int> IntSet;
gavinp 2014/11/04 15:02:01 Do we need this typedef? It's only used once, so i
pasko 2014/11/04 17:48:06 Done.
60 base::LazyInstance<IntSet>::Leaky g_protected_fd_set =
61 LAZY_INSTANCE_INITIALIZER;
62
63 bool IsFileDescriptorProtected(int fd) {
64 base::AutoLock lock(*g_lock.Pointer());
65 return g_protected_fd_set.Get().count(fd) != 0;
66 }
67
68 } // namespace
69
70 namespace base {
71
72 BASE_EXPORT void ProtectFileDescriptor(int fd) {
73 base::AutoLock lock(g_lock.Get());
gavinp 2014/11/04 15:02:02 Sad about the lock.
pasko 2014/11/04 17:48:06 Acknowledged. Agreed. Let's get drunk.
74 g_protected_fd_set.Get().insert(fd);
gavinp 2014/11/04 15:02:01 Is double protecting also a crash?
pasko 2014/11/04 17:48:06 Yes. Thanks. Done.
75 }
76
77 BASE_EXPORT void UnprotectFileDescriptor(int fd) {
78 base::AutoLock lock(*g_lock.Pointer());
79 g_protected_fd_set.Get().erase(fd);
gavinp 2014/11/04 15:02:02 Is double erasing also a crash?
pasko 2014/11/04 17:48:06 Yes! Done.
80 }
81
82 } // namespace base
83
84 extern "C" {
85
86 int __real_close(int fd);
87
88 BASE_EXPORT int __wrap_close(int fd) {
89 // It is important to crash here and provide a minidump with necessary context
gavinp 2014/11/04 15:02:01 This comment could be a bit more explanatory. Ther
pasko 2014/11/04 17:48:06 Sorry, it was indeed a bit too short. Rephrased cl
90 // about the call to close() that was done outside base::File, but on a FD
91 // belonging to a base::File.
92 CHECK(!IsFileDescriptorProtected(fd)) << "fd: " << fd;
93 PCHECK(0 == IGNORE_EINTR(__real_close(fd)));
gavinp 2014/11/04 15:02:01 PCHECK_EQ? I believe close can fail with EBADF (l
pasko 2014/11/04 17:48:06 I blindly copied what's in base/files/scoped_file.
94 return 0;
95 }
96
97 } // extern "C"
98
99 #endif // defined(COMPILER_GCC)
OLDNEW

Powered by Google App Engine
This is Rietveld 408576698