| OLD | NEW |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include <dirent.h> | 5 #include <dirent.h> |
| 6 #include <fcntl.h> | 6 #include <fcntl.h> |
| 7 #include <sys/resource.h> | 7 #include <sys/resource.h> |
| 8 #include <sys/stat.h> | 8 #include <sys/stat.h> |
| 9 #include <sys/time.h> | 9 #include <sys/time.h> |
| 10 #include <sys/types.h> | 10 #include <sys/types.h> |
| (...skipping 41 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 52 }; | 52 }; |
| 53 | 53 |
| 54 void LogSandboxStarted(const std::string& sandbox_name) { | 54 void LogSandboxStarted(const std::string& sandbox_name) { |
| 55 const base::CommandLine& command_line = | 55 const base::CommandLine& command_line = |
| 56 *base::CommandLine::ForCurrentProcess(); | 56 *base::CommandLine::ForCurrentProcess(); |
| 57 const std::string process_type = | 57 const std::string process_type = |
| 58 command_line.GetSwitchValueASCII(switches::kProcessType); | 58 command_line.GetSwitchValueASCII(switches::kProcessType); |
| 59 const std::string activated_sandbox = | 59 const std::string activated_sandbox = |
| 60 "Activated " + sandbox_name + " sandbox for process type: " + | 60 "Activated " + sandbox_name + " sandbox for process type: " + |
| 61 process_type + "."; | 61 process_type + "."; |
| 62 VLOG(1) << activated_sandbox; | 62 DVLOG(1) << activated_sandbox; |
| 63 } | 63 } |
| 64 | 64 |
| 65 bool AddResourceLimit(int resource, rlim_t limit) { | 65 bool AddResourceLimit(int resource, rlim_t limit) { |
| 66 struct rlimit old_rlimit; | 66 struct rlimit old_rlimit; |
| 67 if (getrlimit(resource, &old_rlimit)) | 67 if (getrlimit(resource, &old_rlimit)) |
| 68 return false; | 68 return false; |
| 69 // Make sure we don't raise the existing limit. | 69 // Make sure we don't raise the existing limit. |
| 70 const struct rlimit new_rlimit = { | 70 const struct rlimit new_rlimit = { |
| 71 std::min(old_rlimit.rlim_cur, limit), | 71 std::min(old_rlimit.rlim_cur, limit), |
| 72 std::min(old_rlimit.rlim_max, limit) | 72 std::min(old_rlimit.rlim_max, limit) |
| (...skipping 73 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 146 base::debug::EnableInProcessStackDumpingForSandbox(); | 146 base::debug::EnableInProcessStackDumpingForSandbox(); |
| 147 | 147 |
| 148 // Open proc_fd_ only in Debug mode so that forgetting to close it doesn't | 148 // Open proc_fd_ only in Debug mode so that forgetting to close it doesn't |
| 149 // produce a sandbox escape in Release mode. | 149 // produce a sandbox escape in Release mode. |
| 150 proc_fd_ = open("/proc", O_DIRECTORY | O_RDONLY | O_CLOEXEC); | 150 proc_fd_ = open("/proc", O_DIRECTORY | O_RDONLY | O_CLOEXEC); |
| 151 CHECK_GE(proc_fd_, 0); | 151 CHECK_GE(proc_fd_, 0); |
| 152 #endif // !defined(NDEBUG) | 152 #endif // !defined(NDEBUG) |
| 153 // We "pre-warm" the code that detects supports for seccomp BPF. | 153 // We "pre-warm" the code that detects supports for seccomp BPF. |
| 154 if (SandboxSeccompBPF::IsSeccompBPFDesired()) { | 154 if (SandboxSeccompBPF::IsSeccompBPFDesired()) { |
| 155 if (!SandboxSeccompBPF::SupportsSandbox()) { | 155 if (!SandboxSeccompBPF::SupportsSandbox()) { |
| 156 VLOG(1) << "Lacking support for seccomp-bpf sandbox."; | 156 DVLOG(1) << "Lacking support for seccomp-bpf sandbox."; |
| 157 } else { | 157 } else { |
| 158 seccomp_bpf_supported_ = true; | 158 seccomp_bpf_supported_ = true; |
| 159 } | 159 } |
| 160 } | 160 } |
| 161 | 161 |
| 162 // Yama is a "global", system-level status. We assume it will not regress | 162 // Yama is a "global", system-level status. We assume it will not regress |
| 163 // after startup. | 163 // after startup. |
| 164 const int yama_status = Yama::GetStatus(); | 164 const int yama_status = Yama::GetStatus(); |
| 165 yama_is_enforcing_ = (yama_status & Yama::STATUS_PRESENT) && | 165 yama_is_enforcing_ = (yama_status & Yama::STATUS_PRESENT) && |
| 166 (yama_status & Yama::STATUS_ENFORCING); | 166 (yama_status & Yama::STATUS_ENFORCING); |
| (...skipping 239 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 406 | 406 |
| 407 void LinuxSandbox::StopThreadAndEnsureNotCounted(base::Thread* thread) const { | 407 void LinuxSandbox::StopThreadAndEnsureNotCounted(base::Thread* thread) const { |
| 408 DCHECK(thread); | 408 DCHECK(thread); |
| 409 base::ScopedFD proc_self_task(OpenProcTaskFd(proc_fd_)); | 409 base::ScopedFD proc_self_task(OpenProcTaskFd(proc_fd_)); |
| 410 PCHECK(proc_self_task.is_valid()); | 410 PCHECK(proc_self_task.is_valid()); |
| 411 CHECK(sandbox::ThreadHelpers::StopThreadAndWatchProcFS(proc_self_task.get(), | 411 CHECK(sandbox::ThreadHelpers::StopThreadAndWatchProcFS(proc_self_task.get(), |
| 412 thread)); | 412 thread)); |
| 413 } | 413 } |
| 414 | 414 |
| 415 } // namespace content | 415 } // namespace content |
| OLD | NEW |