OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include <dirent.h> | 5 #include <dirent.h> |
6 #include <fcntl.h> | 6 #include <fcntl.h> |
7 #include <sys/resource.h> | 7 #include <sys/resource.h> |
8 #include <sys/stat.h> | 8 #include <sys/stat.h> |
9 #include <sys/time.h> | 9 #include <sys/time.h> |
10 #include <sys/types.h> | 10 #include <sys/types.h> |
(...skipping 41 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
52 }; | 52 }; |
53 | 53 |
54 void LogSandboxStarted(const std::string& sandbox_name) { | 54 void LogSandboxStarted(const std::string& sandbox_name) { |
55 const base::CommandLine& command_line = | 55 const base::CommandLine& command_line = |
56 *base::CommandLine::ForCurrentProcess(); | 56 *base::CommandLine::ForCurrentProcess(); |
57 const std::string process_type = | 57 const std::string process_type = |
58 command_line.GetSwitchValueASCII(switches::kProcessType); | 58 command_line.GetSwitchValueASCII(switches::kProcessType); |
59 const std::string activated_sandbox = | 59 const std::string activated_sandbox = |
60 "Activated " + sandbox_name + " sandbox for process type: " + | 60 "Activated " + sandbox_name + " sandbox for process type: " + |
61 process_type + "."; | 61 process_type + "."; |
62 VLOG(1) << activated_sandbox; | 62 DVLOG(1) << activated_sandbox; |
63 } | 63 } |
64 | 64 |
65 bool AddResourceLimit(int resource, rlim_t limit) { | 65 bool AddResourceLimit(int resource, rlim_t limit) { |
66 struct rlimit old_rlimit; | 66 struct rlimit old_rlimit; |
67 if (getrlimit(resource, &old_rlimit)) | 67 if (getrlimit(resource, &old_rlimit)) |
68 return false; | 68 return false; |
69 // Make sure we don't raise the existing limit. | 69 // Make sure we don't raise the existing limit. |
70 const struct rlimit new_rlimit = { | 70 const struct rlimit new_rlimit = { |
71 std::min(old_rlimit.rlim_cur, limit), | 71 std::min(old_rlimit.rlim_cur, limit), |
72 std::min(old_rlimit.rlim_max, limit) | 72 std::min(old_rlimit.rlim_max, limit) |
(...skipping 73 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
146 base::debug::EnableInProcessStackDumpingForSandbox(); | 146 base::debug::EnableInProcessStackDumpingForSandbox(); |
147 | 147 |
148 // Open proc_fd_ only in Debug mode so that forgetting to close it doesn't | 148 // Open proc_fd_ only in Debug mode so that forgetting to close it doesn't |
149 // produce a sandbox escape in Release mode. | 149 // produce a sandbox escape in Release mode. |
150 proc_fd_ = open("/proc", O_DIRECTORY | O_RDONLY | O_CLOEXEC); | 150 proc_fd_ = open("/proc", O_DIRECTORY | O_RDONLY | O_CLOEXEC); |
151 CHECK_GE(proc_fd_, 0); | 151 CHECK_GE(proc_fd_, 0); |
152 #endif // !defined(NDEBUG) | 152 #endif // !defined(NDEBUG) |
153 // We "pre-warm" the code that detects supports for seccomp BPF. | 153 // We "pre-warm" the code that detects supports for seccomp BPF. |
154 if (SandboxSeccompBPF::IsSeccompBPFDesired()) { | 154 if (SandboxSeccompBPF::IsSeccompBPFDesired()) { |
155 if (!SandboxSeccompBPF::SupportsSandbox()) { | 155 if (!SandboxSeccompBPF::SupportsSandbox()) { |
156 VLOG(1) << "Lacking support for seccomp-bpf sandbox."; | 156 DVLOG(1) << "Lacking support for seccomp-bpf sandbox."; |
157 } else { | 157 } else { |
158 seccomp_bpf_supported_ = true; | 158 seccomp_bpf_supported_ = true; |
159 } | 159 } |
160 } | 160 } |
161 | 161 |
162 // Yama is a "global", system-level status. We assume it will not regress | 162 // Yama is a "global", system-level status. We assume it will not regress |
163 // after startup. | 163 // after startup. |
164 const int yama_status = Yama::GetStatus(); | 164 const int yama_status = Yama::GetStatus(); |
165 yama_is_enforcing_ = (yama_status & Yama::STATUS_PRESENT) && | 165 yama_is_enforcing_ = (yama_status & Yama::STATUS_PRESENT) && |
166 (yama_status & Yama::STATUS_ENFORCING); | 166 (yama_status & Yama::STATUS_ENFORCING); |
(...skipping 239 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
406 | 406 |
407 void LinuxSandbox::StopThreadAndEnsureNotCounted(base::Thread* thread) const { | 407 void LinuxSandbox::StopThreadAndEnsureNotCounted(base::Thread* thread) const { |
408 DCHECK(thread); | 408 DCHECK(thread); |
409 base::ScopedFD proc_self_task(OpenProcTaskFd(proc_fd_)); | 409 base::ScopedFD proc_self_task(OpenProcTaskFd(proc_fd_)); |
410 PCHECK(proc_self_task.is_valid()); | 410 PCHECK(proc_self_task.is_valid()); |
411 CHECK(sandbox::ThreadHelpers::StopThreadAndWatchProcFS(proc_self_task.get(), | 411 CHECK(sandbox::ThreadHelpers::StopThreadAndWatchProcFS(proc_self_task.get(), |
412 thread)); | 412 thread)); |
413 } | 413 } |
414 | 414 |
415 } // namespace content | 415 } // namespace content |
OLD | NEW |