| OLD | NEW |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "sandbox/linux/syscall_broker/broker_process.h" | 5 #include "sandbox/linux/syscall_broker/broker_process.h" |
| 6 | 6 |
| 7 #include <fcntl.h> | 7 #include <fcntl.h> |
| 8 #include <signal.h> | 8 #include <signal.h> |
| 9 #include <sys/socket.h> | 9 #include <sys/socket.h> |
| 10 #include <sys/stat.h> | 10 #include <sys/stat.h> |
| (...skipping 10 matching lines...) Expand all Loading... |
| 21 #include "base/logging.h" | 21 #include "base/logging.h" |
| 22 #include "base/memory/scoped_ptr.h" | 22 #include "base/memory/scoped_ptr.h" |
| 23 #include "base/posix/eintr_wrapper.h" | 23 #include "base/posix/eintr_wrapper.h" |
| 24 #include "base/process/process_metrics.h" | 24 #include "base/process/process_metrics.h" |
| 25 #include "build/build_config.h" | 25 #include "build/build_config.h" |
| 26 #include "sandbox/linux/syscall_broker/broker_client.h" | 26 #include "sandbox/linux/syscall_broker/broker_client.h" |
| 27 #include "sandbox/linux/syscall_broker/broker_host.h" | 27 #include "sandbox/linux/syscall_broker/broker_host.h" |
| 28 | 28 |
| 29 namespace sandbox { | 29 namespace sandbox { |
| 30 | 30 |
| 31 namespace syscall_broker { |
| 32 |
| 31 BrokerProcess::BrokerProcess(int denied_errno, | 33 BrokerProcess::BrokerProcess(int denied_errno, |
| 32 const std::vector<std::string>& allowed_r_files, | 34 const std::vector<std::string>& allowed_r_files, |
| 33 const std::vector<std::string>& allowed_w_files, | 35 const std::vector<std::string>& allowed_w_files, |
| 34 bool fast_check_in_client, | 36 bool fast_check_in_client, |
| 35 bool quiet_failures_for_tests) | 37 bool quiet_failures_for_tests) |
| 36 : initialized_(false), | 38 : initialized_(false), |
| 37 is_child_(false), | 39 is_child_(false), |
| 38 fast_check_in_client_(fast_check_in_client), | 40 fast_check_in_client_(fast_check_in_client), |
| 39 quiet_failures_for_tests_(quiet_failures_for_tests), | 41 quiet_failures_for_tests_(quiet_failures_for_tests), |
| 40 broker_pid_(-1), | 42 broker_pid_(-1), |
| (...skipping 37 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 78 } | 80 } |
| 79 if (child_pid) { | 81 if (child_pid) { |
| 80 // We are the parent and we have just forked our broker process. | 82 // We are the parent and we have just forked our broker process. |
| 81 close(socket_pair[0]); | 83 close(socket_pair[0]); |
| 82 // We should only be able to write to the IPC channel. We'll always send | 84 // We should only be able to write to the IPC channel. We'll always send |
| 83 // a new file descriptor to receive the reply on. | 85 // a new file descriptor to receive the reply on. |
| 84 shutdown(socket_pair[1], SHUT_RD); | 86 shutdown(socket_pair[1], SHUT_RD); |
| 85 ipc_socketpair_ = socket_pair[1]; | 87 ipc_socketpair_ = socket_pair[1]; |
| 86 is_child_ = false; | 88 is_child_ = false; |
| 87 broker_pid_ = child_pid; | 89 broker_pid_ = child_pid; |
| 88 broker_client_.reset( | 90 broker_client_.reset(new BrokerClient(policy_, ipc_socketpair_, |
| 89 new syscall_broker::BrokerClient(policy_, | 91 fast_check_in_client_, |
| 90 ipc_socketpair_, | 92 quiet_failures_for_tests_)); |
| 91 fast_check_in_client_, | |
| 92 quiet_failures_for_tests_)); | |
| 93 initialized_ = true; | 93 initialized_ = true; |
| 94 return true; | 94 return true; |
| 95 } else { | 95 } else { |
| 96 // We are the broker. | 96 // We are the broker. |
| 97 close(socket_pair[1]); | 97 close(socket_pair[1]); |
| 98 // We should only be able to read from this IPC channel. We will send our | 98 // We should only be able to read from this IPC channel. We will send our |
| 99 // replies on a new file descriptor attached to the requests. | 99 // replies on a new file descriptor attached to the requests. |
| 100 shutdown(socket_pair[0], SHUT_WR); | 100 shutdown(socket_pair[0], SHUT_WR); |
| 101 ipc_socketpair_ = socket_pair[0]; | 101 ipc_socketpair_ = socket_pair[0]; |
| 102 is_child_ = true; | 102 is_child_ = true; |
| 103 CHECK(broker_process_init_callback.Run()); | 103 CHECK(broker_process_init_callback.Run()); |
| 104 syscall_broker::BrokerHost broker_host(policy_, ipc_socketpair_); | 104 BrokerHost broker_host(policy_, ipc_socketpair_); |
| 105 initialized_ = true; | 105 initialized_ = true; |
| 106 for (;;) { | 106 for (;;) { |
| 107 broker_host.HandleRequest(); | 107 switch (broker_host.HandleRequest()) { |
| 108 case BrokerHost::RequestStatus::LOST_CLIENT: |
| 109 break; |
| 110 case BrokerHost::RequestStatus::SUCCESS: |
| 111 case BrokerHost::RequestStatus::FAILURE: |
| 112 continue; |
| 113 } |
| 108 } | 114 } |
| 109 _exit(1); | 115 _exit(1); |
| 110 } | 116 } |
| 111 NOTREACHED(); | 117 NOTREACHED(); |
| 112 } | 118 } |
| 113 | 119 |
| 114 int BrokerProcess::Access(const char* pathname, int mode) const { | 120 int BrokerProcess::Access(const char* pathname, int mode) const { |
| 115 RAW_CHECK(initialized_); | 121 RAW_CHECK(initialized_); |
| 116 return broker_client_->Access(pathname, mode); | 122 return broker_client_->Access(pathname, mode); |
| 117 } | 123 } |
| 118 | 124 |
| 119 int BrokerProcess::Open(const char* pathname, int flags) const { | 125 int BrokerProcess::Open(const char* pathname, int flags) const { |
| 120 RAW_CHECK(initialized_); | 126 RAW_CHECK(initialized_); |
| 121 return broker_client_->Open(pathname, flags); | 127 return broker_client_->Open(pathname, flags); |
| 122 } | 128 } |
| 123 | 129 |
| 130 } // namespace syscall_broker |
| 131 |
| 124 } // namespace sandbox. | 132 } // namespace sandbox. |
| OLD | NEW |