Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(145)

Side by Side Diff: content/common/sandbox_linux/sandbox_linux.cc

Issue 727443002: [content/common] Convert VLOGs to DVLOGs (Closed) Base URL: https://chromium.googlesource.com/chromium/src.git@master
Patch Set: Created 6 years, 1 month ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
OLDNEW
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be 2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file. 3 // found in the LICENSE file.
4 4
5 #include <dirent.h> 5 #include <dirent.h>
6 #include <fcntl.h> 6 #include <fcntl.h>
7 #include <sys/resource.h> 7 #include <sys/resource.h>
8 #include <sys/stat.h> 8 #include <sys/stat.h>
9 #include <sys/time.h> 9 #include <sys/time.h>
10 #include <sys/types.h> 10 #include <sys/types.h>
(...skipping 41 matching lines...) Expand 10 before | Expand all | Expand 10 after
52 }; 52 };
53 53
54 void LogSandboxStarted(const std::string& sandbox_name) { 54 void LogSandboxStarted(const std::string& sandbox_name) {
55 const base::CommandLine& command_line = 55 const base::CommandLine& command_line =
56 *base::CommandLine::ForCurrentProcess(); 56 *base::CommandLine::ForCurrentProcess();
57 const std::string process_type = 57 const std::string process_type =
58 command_line.GetSwitchValueASCII(switches::kProcessType); 58 command_line.GetSwitchValueASCII(switches::kProcessType);
59 const std::string activated_sandbox = 59 const std::string activated_sandbox =
60 "Activated " + sandbox_name + " sandbox for process type: " + 60 "Activated " + sandbox_name + " sandbox for process type: " +
61 process_type + "."; 61 process_type + ".";
62 VLOG(1) << activated_sandbox; 62 DVLOG(1) << activated_sandbox;
63 } 63 }
64 64
65 bool AddResourceLimit(int resource, rlim_t limit) { 65 bool AddResourceLimit(int resource, rlim_t limit) {
66 struct rlimit old_rlimit; 66 struct rlimit old_rlimit;
67 if (getrlimit(resource, &old_rlimit)) 67 if (getrlimit(resource, &old_rlimit))
68 return false; 68 return false;
69 // Make sure we don't raise the existing limit. 69 // Make sure we don't raise the existing limit.
70 const struct rlimit new_rlimit = { 70 const struct rlimit new_rlimit = {
71 std::min(old_rlimit.rlim_cur, limit), 71 std::min(old_rlimit.rlim_cur, limit),
72 std::min(old_rlimit.rlim_max, limit) 72 std::min(old_rlimit.rlim_max, limit)
(...skipping 73 matching lines...) Expand 10 before | Expand all | Expand 10 after
146 base::debug::EnableInProcessStackDumpingForSandbox(); 146 base::debug::EnableInProcessStackDumpingForSandbox();
147 147
148 // Open proc_fd_ only in Debug mode so that forgetting to close it doesn't 148 // Open proc_fd_ only in Debug mode so that forgetting to close it doesn't
149 // produce a sandbox escape in Release mode. 149 // produce a sandbox escape in Release mode.
150 proc_fd_ = open("/proc", O_DIRECTORY | O_RDONLY | O_CLOEXEC); 150 proc_fd_ = open("/proc", O_DIRECTORY | O_RDONLY | O_CLOEXEC);
151 CHECK_GE(proc_fd_, 0); 151 CHECK_GE(proc_fd_, 0);
152 #endif // !defined(NDEBUG) 152 #endif // !defined(NDEBUG)
153 // We "pre-warm" the code that detects supports for seccomp BPF. 153 // We "pre-warm" the code that detects supports for seccomp BPF.
154 if (SandboxSeccompBPF::IsSeccompBPFDesired()) { 154 if (SandboxSeccompBPF::IsSeccompBPFDesired()) {
155 if (!SandboxSeccompBPF::SupportsSandbox()) { 155 if (!SandboxSeccompBPF::SupportsSandbox()) {
156 VLOG(1) << "Lacking support for seccomp-bpf sandbox."; 156 DVLOG(1) << "Lacking support for seccomp-bpf sandbox.";
157 } else { 157 } else {
158 seccomp_bpf_supported_ = true; 158 seccomp_bpf_supported_ = true;
159 } 159 }
160 } 160 }
161 161
162 // Yama is a "global", system-level status. We assume it will not regress 162 // Yama is a "global", system-level status. We assume it will not regress
163 // after startup. 163 // after startup.
164 const int yama_status = Yama::GetStatus(); 164 const int yama_status = Yama::GetStatus();
165 yama_is_enforcing_ = (yama_status & Yama::STATUS_PRESENT) && 165 yama_is_enforcing_ = (yama_status & Yama::STATUS_PRESENT) &&
166 (yama_status & Yama::STATUS_ENFORCING); 166 (yama_status & Yama::STATUS_ENFORCING);
(...skipping 239 matching lines...) Expand 10 before | Expand all | Expand 10 after
406 406
407 void LinuxSandbox::StopThreadAndEnsureNotCounted(base::Thread* thread) const { 407 void LinuxSandbox::StopThreadAndEnsureNotCounted(base::Thread* thread) const {
408 DCHECK(thread); 408 DCHECK(thread);
409 base::ScopedFD proc_self_task(OpenProcTaskFd(proc_fd_)); 409 base::ScopedFD proc_self_task(OpenProcTaskFd(proc_fd_));
410 PCHECK(proc_self_task.is_valid()); 410 PCHECK(proc_self_task.is_valid());
411 CHECK(sandbox::ThreadHelpers::StopThreadAndWatchProcFS(proc_self_task.get(), 411 CHECK(sandbox::ThreadHelpers::StopThreadAndWatchProcFS(proc_self_task.get(),
412 thread)); 412 thread));
413 } 413 }
414 414
415 } // namespace content 415 } // namespace content
OLDNEW

Powered by Google App Engine
This is Rietveld 408576698