OLD | NEW |
1 // Copyright 2015 The Chromium Authors. All rights reserved. | 1 // Copyright 2015 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "sandbox/linux/services/namespace_sandbox.h" | 5 #include "sandbox/linux/services/namespace_sandbox.h" |
6 | 6 |
7 #include <sched.h> | 7 #include <sched.h> |
8 #include <stdlib.h> | 8 #include <stdlib.h> |
9 #include <sys/types.h> | 9 #include <sys/types.h> |
10 #include <unistd.h> | 10 #include <unistd.h> |
11 | 11 |
12 #include <string> | 12 #include <string> |
13 #include <utility> | 13 #include <utility> |
| 14 #include <vector> |
14 | 15 |
15 #include "base/command_line.h" | 16 #include "base/command_line.h" |
16 #include "base/environment.h" | 17 #include "base/environment.h" |
17 #include "base/files/scoped_file.h" | 18 #include "base/files/scoped_file.h" |
18 #include "base/logging.h" | 19 #include "base/logging.h" |
19 #include "base/posix/eintr_wrapper.h" | 20 #include "base/posix/eintr_wrapper.h" |
20 #include "base/process/launch.h" | 21 #include "base/process/launch.h" |
21 #include "base/process/process.h" | 22 #include "base/process/process.h" |
22 #include "sandbox/linux/services/namespace_utils.h" | 23 #include "sandbox/linux/services/namespace_utils.h" |
23 | 24 |
(...skipping 28 matching lines...) Expand all Loading... |
52 const char kSandboxUSERNSEnvironmentVarName[] = "SBX_USER_NS"; | 53 const char kSandboxUSERNSEnvironmentVarName[] = "SBX_USER_NS"; |
53 const char kSandboxPIDNSEnvironmentVarName[] = "SBX_PID_NS"; | 54 const char kSandboxPIDNSEnvironmentVarName[] = "SBX_PID_NS"; |
54 const char kSandboxNETNSEnvironmentVarName[] = "SBX_NET_NS"; | 55 const char kSandboxNETNSEnvironmentVarName[] = "SBX_NET_NS"; |
55 | 56 |
56 } // namespace | 57 } // namespace |
57 | 58 |
58 // static | 59 // static |
59 base::Process NamespaceSandbox::LaunchProcess( | 60 base::Process NamespaceSandbox::LaunchProcess( |
60 const base::CommandLine& cmdline, | 61 const base::CommandLine& cmdline, |
61 const base::LaunchOptions& options) { | 62 const base::LaunchOptions& options) { |
| 63 return LaunchProcess(cmdline.argv(), options); |
| 64 } |
| 65 |
| 66 // static |
| 67 base::Process NamespaceSandbox::LaunchProcess( |
| 68 const std::vector<std::string>& argv, |
| 69 const base::LaunchOptions& options) { |
62 int clone_flags = 0; | 70 int clone_flags = 0; |
63 int ns_types[] = {CLONE_NEWUSER, CLONE_NEWPID, CLONE_NEWNET}; | 71 int ns_types[] = {CLONE_NEWUSER, CLONE_NEWPID, CLONE_NEWNET}; |
64 for (const int ns_type : ns_types) { | 72 for (const int ns_type : ns_types) { |
65 if (NamespaceUtils::KernelSupportsUnprivilegedNamespace(ns_type)) { | 73 if (NamespaceUtils::KernelSupportsUnprivilegedNamespace(ns_type)) { |
66 clone_flags |= ns_type; | 74 clone_flags |= ns_type; |
67 } | 75 } |
68 } | 76 } |
69 CHECK(clone_flags & CLONE_NEWUSER); | 77 CHECK(clone_flags & CLONE_NEWUSER); |
70 | 78 |
71 // These fields may not be set by the caller. | 79 // These fields may not be set by the caller. |
(...skipping 12 matching lines...) Expand all Loading... |
84 std::make_pair(CLONE_NEWNET, kSandboxNETNSEnvironmentVarName), | 92 std::make_pair(CLONE_NEWNET, kSandboxNETNSEnvironmentVarName), |
85 }; | 93 }; |
86 | 94 |
87 base::EnvironmentMap* environ = &launch_options.environ; | 95 base::EnvironmentMap* environ = &launch_options.environ; |
88 for (const auto& entry : clone_flag_environ) { | 96 for (const auto& entry : clone_flag_environ) { |
89 const int flag = entry.first; | 97 const int flag = entry.first; |
90 const char* environ_name = entry.second; | 98 const char* environ_name = entry.second; |
91 SetEnvironForNamespaceType(environ, environ_name, clone_flags & flag); | 99 SetEnvironForNamespaceType(environ, environ_name, clone_flags & flag); |
92 } | 100 } |
93 | 101 |
94 return base::LaunchProcess(cmdline, launch_options); | 102 return base::LaunchProcess(argv, launch_options); |
95 } | 103 } |
96 | 104 |
97 // static | 105 // static |
98 bool NamespaceSandbox::InNewUserNamespace() { | 106 bool NamespaceSandbox::InNewUserNamespace() { |
99 return getenv(kSandboxUSERNSEnvironmentVarName) != nullptr; | 107 return getenv(kSandboxUSERNSEnvironmentVarName) != nullptr; |
100 } | 108 } |
101 | 109 |
102 // static | 110 // static |
103 bool NamespaceSandbox::InNewPidNamespace() { | 111 bool NamespaceSandbox::InNewPidNamespace() { |
104 return getenv(kSandboxPIDNSEnvironmentVarName) != nullptr; | 112 return getenv(kSandboxPIDNSEnvironmentVarName) != nullptr; |
105 } | 113 } |
106 | 114 |
107 // static | 115 // static |
108 bool NamespaceSandbox::InNewNetNamespace() { | 116 bool NamespaceSandbox::InNewNetNamespace() { |
109 return getenv(kSandboxNETNSEnvironmentVarName) != nullptr; | 117 return getenv(kSandboxNETNSEnvironmentVarName) != nullptr; |
110 } | 118 } |
111 | 119 |
112 } // namespace sandbox | 120 } // namespace sandbox |
OLD | NEW |