Chromium Code Reviews| OLD | NEW |
|---|---|
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include <dirent.h> | 5 #include <dirent.h> |
| 6 #include <fcntl.h> | 6 #include <fcntl.h> |
| 7 #include <sys/resource.h> | 7 #include <sys/resource.h> |
| 8 #include <sys/stat.h> | 8 #include <sys/stat.h> |
| 9 #include <sys/time.h> | 9 #include <sys/time.h> |
| 10 #include <sys/types.h> | 10 #include <sys/types.h> |
| (...skipping 135 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
| 146 base::debug::EnableInProcessStackDumpingForSandbox(); | 146 base::debug::EnableInProcessStackDumpingForSandbox(); |
| 147 | 147 |
| 148 // Open proc_fd_ only in Debug mode so that forgetting to close it doesn't | 148 // Open proc_fd_ only in Debug mode so that forgetting to close it doesn't |
| 149 // produce a sandbox escape in Release mode. | 149 // produce a sandbox escape in Release mode. |
| 150 proc_fd_ = open("/proc", O_DIRECTORY | O_RDONLY | O_CLOEXEC); | 150 proc_fd_ = open("/proc", O_DIRECTORY | O_RDONLY | O_CLOEXEC); |
| 151 CHECK_GE(proc_fd_, 0); | 151 CHECK_GE(proc_fd_, 0); |
| 152 #endif // !defined(NDEBUG) | 152 #endif // !defined(NDEBUG) |
| 153 // We "pre-warm" the code that detects supports for seccomp BPF. | 153 // We "pre-warm" the code that detects supports for seccomp BPF. |
| 154 if (SandboxSeccompBPF::IsSeccompBPFDesired()) { | 154 if (SandboxSeccompBPF::IsSeccompBPFDesired()) { |
| 155 if (!SandboxSeccompBPF::SupportsSandbox()) { | 155 if (!SandboxSeccompBPF::SupportsSandbox()) { |
| 156 VLOG(1) << "Lacking support for seccomp-bpf sandbox."; | 156 DVLOG(1) << "Lacking support for seccomp-bpf sandbox."; |
|
jln (very slow on Chromium)
2014/11/21 02:07:15
I would rather not have this change either.
Both
| |
| 157 } else { | 157 } else { |
| 158 seccomp_bpf_supported_ = true; | 158 seccomp_bpf_supported_ = true; |
| 159 } | 159 } |
| 160 } | 160 } |
| 161 | 161 |
| 162 // Yama is a "global", system-level status. We assume it will not regress | 162 // Yama is a "global", system-level status. We assume it will not regress |
| 163 // after startup. | 163 // after startup. |
| 164 const int yama_status = Yama::GetStatus(); | 164 const int yama_status = Yama::GetStatus(); |
| 165 yama_is_enforcing_ = (yama_status & Yama::STATUS_PRESENT) && | 165 yama_is_enforcing_ = (yama_status & Yama::STATUS_PRESENT) && |
| 166 (yama_status & Yama::STATUS_ENFORCING); | 166 (yama_status & Yama::STATUS_ENFORCING); |
| (...skipping 239 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
| 406 | 406 |
| 407 void LinuxSandbox::StopThreadAndEnsureNotCounted(base::Thread* thread) const { | 407 void LinuxSandbox::StopThreadAndEnsureNotCounted(base::Thread* thread) const { |
| 408 DCHECK(thread); | 408 DCHECK(thread); |
| 409 base::ScopedFD proc_self_task(OpenProcTaskFd(proc_fd_)); | 409 base::ScopedFD proc_self_task(OpenProcTaskFd(proc_fd_)); |
| 410 PCHECK(proc_self_task.is_valid()); | 410 PCHECK(proc_self_task.is_valid()); |
| 411 CHECK(sandbox::ThreadHelpers::StopThreadAndWatchProcFS(proc_self_task.get(), | 411 CHECK(sandbox::ThreadHelpers::StopThreadAndWatchProcFS(proc_self_task.get(), |
| 412 thread)); | 412 thread)); |
| 413 } | 413 } |
| 414 | 414 |
| 415 } // namespace content | 415 } // namespace content |
| OLD | NEW |