Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(322)

Side by Side Diff: sandbox/linux/services/namespace_utils.cc

Issue 881733002: Add namespace sandbox class. (Closed) Base URL: https://chromium.googlesource.com/chromium/src.git@master
Patch Set: Last round of comments. Created 5 years, 10 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
OLDNEW
1 // Copyright 2015 The Chromium Authors. All rights reserved. 1 // Copyright 2015 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be 2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file. 3 // found in the LICENSE file.
4 4
5 #include "sandbox/linux/services/namespace_utils.h" 5 #include "sandbox/linux/services/namespace_utils.h"
6 6
7 #include <fcntl.h> 7 #include <fcntl.h>
8 #include <sched.h> 8 #include <sched.h>
9 #include <sys/types.h> 9 #include <sys/types.h>
10 #include <sys/stat.h> 10 #include <sys/stat.h>
11 #include <unistd.h> 11 #include <unistd.h>
12 12
13 #include <string> 13 #include <string>
14 14
15 #include "base/files/file_path.h" 15 #include "base/files/file_path.h"
16 #include "base/files/file_util.h" 16 #include "base/files/file_util.h"
17 #include "base/files/scoped_file.h" 17 #include "base/files/scoped_file.h"
18 #include "base/logging.h" 18 #include "base/logging.h"
19 #include "base/posix/eintr_wrapper.h" 19 #include "base/posix/eintr_wrapper.h"
20 #include "base/process/launch.h" 20 #include "base/process/launch.h"
21 #include "base/strings/stringprintf.h" 21 #include "base/strings/safe_sprintf.h"
22 #include "base/third_party/valgrind/valgrind.h" 22 #include "base/third_party/valgrind/valgrind.h"
23 23
24 namespace sandbox { 24 namespace sandbox {
25 25
26 namespace { 26 namespace {
27 bool IsRunningOnValgrind() { 27 bool IsRunningOnValgrind() {
28 return RUNNING_ON_VALGRIND; 28 return RUNNING_ON_VALGRIND;
29 } 29 }
30 } // namespace 30 } // namespace
31 31
32 // static 32 // static
33 bool NamespaceUtils::WriteToIdMapFile(const char* map_file, generic_id_t id) { 33 bool NamespaceUtils::WriteToIdMapFile(const char* map_file, generic_id_t id) {
34 base::ScopedFD fd(HANDLE_EINTR(open(map_file, O_WRONLY))); 34 // This function needs to be async-signal-safe, as it may be called in between
35 if (!fd.is_valid()) { 35 // fork and exec.
36
37 int fd = HANDLE_EINTR(open(map_file, O_WRONLY));
38 if (fd == -1) {
36 return false; 39 return false;
37 } 40 }
38 41
39 const generic_id_t inside_id = id; 42 const generic_id_t inside_id = id;
40 const generic_id_t outside_id = id; 43 const generic_id_t outside_id = id;
41 const std::string mapping = 44
42 base::StringPrintf("%d %d 1\n", inside_id, outside_id); 45 char mapping[64];
43 const size_t len = mapping.size(); 46 ssize_t len =
44 const ssize_t rc = HANDLE_EINTR(write(fd.get(), mapping.c_str(), len)); 47 base::strings::SafeSPrintf(mapping, "%d %d 1\n", inside_id, outside_id);
45 return rc == static_cast<ssize_t>(len); 48 const ssize_t rc = HANDLE_EINTR(write(fd, mapping, len));
49 RAW_CHECK(IGNORE_EINTR(close(fd)) == 0);
50 return rc == len;
46 } 51 }
47 52
48 // static 53 // static
49 bool NamespaceUtils::KernelSupportsUnprivilegedNamespace(int type) { 54 bool NamespaceUtils::KernelSupportsUnprivilegedNamespace(int type) {
50 // Valgrind will let clone(2) pass-through, but doesn't support unshare(), 55 // Valgrind will let clone(2) pass-through, but doesn't support unshare(),
51 // so always consider namespaces unsupported there. 56 // so always consider namespaces unsupported there.
52 if (IsRunningOnValgrind()) { 57 if (IsRunningOnValgrind()) {
53 return false; 58 return false;
54 } 59 }
55 60
(...skipping 25 matching lines...) Expand all
81 break; 86 break;
82 default: 87 default:
83 NOTREACHED(); 88 NOTREACHED();
84 return false; 89 return false;
85 } 90 }
86 91
87 return base::PathExists(base::FilePath(path)); 92 return base::PathExists(base::FilePath(path));
88 } 93 }
89 94
90 } // namespace sandbox 95 } // namespace sandbox
OLDNEW
« no previous file with comments | « sandbox/linux/services/namespace_utils.h ('k') | sandbox/linux/services/namespace_utils_unittest.cc » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698