OLD | NEW |
---|---|
(Empty) | |
1 // Copyright 2014 The Chromium Authors. All rights reserved. | |
2 // Use of this source code is governed by a BSD-style license that can be | |
3 // found in the LICENSE file. | |
4 | |
5 #include "base/containers/hash_tables.h" | |
6 #include "base/files/file.h" | |
7 #include "base/lazy_instance.h" | |
8 #include "base/logging.h" | |
9 #include "base/posix/eintr_wrapper.h" | |
10 #include "base/synchronization/lock.h" | |
11 | |
12 // These hooks provided for base::File perform additional sanity checks when | |
13 // files are closed. | |
14 // | |
15 // Background: | |
16 // 1. The browser process crashes if a call to close() provided by the C | |
17 // library (i.e. close(3)) fails. This is done for security purposes. See | |
18 // base/files/scoped_file.cc. When a crash like this happens, there is not | |
19 // enough context in the minidump to triage the problem. | |
20 // 2. base::File provides a good abstraction to prevent closing incorrect | |
21 // file descriptors or double-closing. Closing non-owned file descriptors | |
22 // would more likely happen from outside base::File and base::ScopedFD. | |
23 // | |
24 // These hooks intercept base::File operations to 'protect' file handles / | |
25 // descriptors from accidental close(3) by other portions of the code being | |
26 // linked into the browser. Also, this file provides an interceptor for the | |
27 // close(3) itself, and requires to be linked with cooperation of | |
28 // --Wl,--wrap=close (i.e. linker wrapping). | |
29 // | |
30 // Wrapping close(3) on all libraries can lead to confusion, particularly for | |
31 // the libraries that do not use ::base (I am also looking at you, | |
32 // crazy_linker). Instead two hooks are added to base::File, which are | |
gavinp
2014/11/04 15:02:02
Nit: one space after .
pasko
2014/11/04 17:48:06
Done.
| |
33 // implemented as no-op by default. This file should be linked into the chrome | |
gavinp
2014/11/04 15:02:02
Nit: capitalise Chrome.
pasko
2014/11/04 17:48:06
Done.
| |
34 // native binary(-ies) for a whitelist of targets where "file descriptor | |
35 // protection" is useful. | |
36 | |
37 // With compilers other than GCC the wrapper is trivial. This is to avoid | |
Fabrice (no longer in Chrome)
2014/11/04 15:37:21
Nit: GCC and Clang
pasko
2014/11/04 17:48:06
Done.
| |
38 // overexercising mechanisms for overriding weak symbols. | |
39 #if !defined(COMPILER_GCC) | |
40 extern "C" { | |
41 | |
42 int __real_close(int fd); | |
43 | |
44 BASE_EXPORT int __wrap_close(int fd) { | |
45 return __real_close(fd); | |
46 } | |
47 | |
48 } // extern "C" | |
49 | |
50 #else // defined(COMPILER_GCC) | |
51 | |
52 namespace { | |
53 | |
54 // Protects the |g_protected_fd_set|. | |
55 base::LazyInstance<base::Lock>::Leaky g_lock = | |
56 LAZY_INSTANCE_INITIALIZER; | |
gavinp
2014/11/04 15:02:02
Nit: can this go up on the previous line?
pasko
2014/11/04 17:48:06
Done.
| |
57 | |
58 // Holds the set of all 'protected' file descriptors. | |
59 typedef base::hash_set<int> IntSet; | |
gavinp
2014/11/04 15:02:01
Do we need this typedef? It's only used once, so i
pasko
2014/11/04 17:48:06
Done.
| |
60 base::LazyInstance<IntSet>::Leaky g_protected_fd_set = | |
61 LAZY_INSTANCE_INITIALIZER; | |
62 | |
63 bool IsFileDescriptorProtected(int fd) { | |
64 base::AutoLock lock(*g_lock.Pointer()); | |
65 return g_protected_fd_set.Get().count(fd) != 0; | |
66 } | |
67 | |
68 } // namespace | |
69 | |
70 namespace base { | |
71 | |
72 BASE_EXPORT void ProtectFileDescriptor(int fd) { | |
73 base::AutoLock lock(g_lock.Get()); | |
gavinp
2014/11/04 15:02:02
Sad about the lock.
pasko
2014/11/04 17:48:06
Acknowledged. Agreed. Let's get drunk.
| |
74 g_protected_fd_set.Get().insert(fd); | |
gavinp
2014/11/04 15:02:01
Is double protecting also a crash?
pasko
2014/11/04 17:48:06
Yes. Thanks. Done.
| |
75 } | |
76 | |
77 BASE_EXPORT void UnprotectFileDescriptor(int fd) { | |
78 base::AutoLock lock(*g_lock.Pointer()); | |
79 g_protected_fd_set.Get().erase(fd); | |
gavinp
2014/11/04 15:02:02
Is double erasing also a crash?
pasko
2014/11/04 17:48:06
Yes! Done.
| |
80 } | |
81 | |
82 } // namespace base | |
83 | |
84 extern "C" { | |
85 | |
86 int __real_close(int fd); | |
87 | |
88 BASE_EXPORT int __wrap_close(int fd) { | |
89 // It is important to crash here and provide a minidump with necessary context | |
gavinp
2014/11/04 15:02:01
This comment could be a bit more explanatory. Ther
pasko
2014/11/04 17:48:06
Sorry, it was indeed a bit too short. Rephrased cl
| |
90 // about the call to close() that was done outside base::File, but on a FD | |
91 // belonging to a base::File. | |
92 CHECK(!IsFileDescriptorProtected(fd)) << "fd: " << fd; | |
93 PCHECK(0 == IGNORE_EINTR(__real_close(fd))); | |
gavinp
2014/11/04 15:02:01
PCHECK_EQ?
I believe close can fail with EBADF (l
pasko
2014/11/04 17:48:06
I blindly copied what's in base/files/scoped_file.
| |
94 return 0; | |
95 } | |
96 | |
97 } // extern "C" | |
98 | |
99 #endif // defined(COMPILER_GCC) | |
OLD | NEW |