OLD | NEW |
---|---|
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include <dirent.h> | 5 #include <dirent.h> |
6 #include <fcntl.h> | 6 #include <fcntl.h> |
7 #include <sys/resource.h> | 7 #include <sys/resource.h> |
8 #include <sys/stat.h> | 8 #include <sys/stat.h> |
9 #include <sys/time.h> | 9 #include <sys/time.h> |
10 #include <sys/types.h> | 10 #include <sys/types.h> |
(...skipping 135 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
146 base::debug::EnableInProcessStackDumpingForSandbox(); | 146 base::debug::EnableInProcessStackDumpingForSandbox(); |
147 | 147 |
148 // Open proc_fd_ only in Debug mode so that forgetting to close it doesn't | 148 // Open proc_fd_ only in Debug mode so that forgetting to close it doesn't |
149 // produce a sandbox escape in Release mode. | 149 // produce a sandbox escape in Release mode. |
150 proc_fd_ = open("/proc", O_DIRECTORY | O_RDONLY | O_CLOEXEC); | 150 proc_fd_ = open("/proc", O_DIRECTORY | O_RDONLY | O_CLOEXEC); |
151 CHECK_GE(proc_fd_, 0); | 151 CHECK_GE(proc_fd_, 0); |
152 #endif // !defined(NDEBUG) | 152 #endif // !defined(NDEBUG) |
153 // We "pre-warm" the code that detects supports for seccomp BPF. | 153 // We "pre-warm" the code that detects supports for seccomp BPF. |
154 if (SandboxSeccompBPF::IsSeccompBPFDesired()) { | 154 if (SandboxSeccompBPF::IsSeccompBPFDesired()) { |
155 if (!SandboxSeccompBPF::SupportsSandbox()) { | 155 if (!SandboxSeccompBPF::SupportsSandbox()) { |
156 VLOG(1) << "Lacking support for seccomp-bpf sandbox."; | 156 DVLOG(1) << "Lacking support for seccomp-bpf sandbox."; |
jln (very slow on Chromium)
2014/11/21 02:07:15
I would rather not have this change either.
Both
| |
157 } else { | 157 } else { |
158 seccomp_bpf_supported_ = true; | 158 seccomp_bpf_supported_ = true; |
159 } | 159 } |
160 } | 160 } |
161 | 161 |
162 // Yama is a "global", system-level status. We assume it will not regress | 162 // Yama is a "global", system-level status. We assume it will not regress |
163 // after startup. | 163 // after startup. |
164 const int yama_status = Yama::GetStatus(); | 164 const int yama_status = Yama::GetStatus(); |
165 yama_is_enforcing_ = (yama_status & Yama::STATUS_PRESENT) && | 165 yama_is_enforcing_ = (yama_status & Yama::STATUS_PRESENT) && |
166 (yama_status & Yama::STATUS_ENFORCING); | 166 (yama_status & Yama::STATUS_ENFORCING); |
(...skipping 239 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
406 | 406 |
407 void LinuxSandbox::StopThreadAndEnsureNotCounted(base::Thread* thread) const { | 407 void LinuxSandbox::StopThreadAndEnsureNotCounted(base::Thread* thread) const { |
408 DCHECK(thread); | 408 DCHECK(thread); |
409 base::ScopedFD proc_self_task(OpenProcTaskFd(proc_fd_)); | 409 base::ScopedFD proc_self_task(OpenProcTaskFd(proc_fd_)); |
410 PCHECK(proc_self_task.is_valid()); | 410 PCHECK(proc_self_task.is_valid()); |
411 CHECK(sandbox::ThreadHelpers::StopThreadAndWatchProcFS(proc_self_task.get(), | 411 CHECK(sandbox::ThreadHelpers::StopThreadAndWatchProcFS(proc_self_task.get(), |
412 thread)); | 412 thread)); |
413 } | 413 } |
414 | 414 |
415 } // namespace content | 415 } // namespace content |
OLD | NEW |