OLD | NEW |
1 // Copyright 2014 The Chromium Authors. All rights reserved. | 1 // Copyright 2014 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #ifndef SANDBOX_LINUX_SERVICES_PROC_UTIL_H_ | 5 #ifndef SANDBOX_LINUX_SERVICES_PROC_UTIL_H_ |
6 #define SANDBOX_LINUX_SERVICES_PROC_UTIL_H_ | 6 #define SANDBOX_LINUX_SERVICES_PROC_UTIL_H_ |
7 | 7 |
| 8 #include "base/files/scoped_file.h" |
8 #include "base/macros.h" | 9 #include "base/macros.h" |
9 #include "sandbox/sandbox_export.h" | 10 #include "sandbox/sandbox_export.h" |
10 | 11 |
11 namespace sandbox { | 12 namespace sandbox { |
12 | 13 |
13 class SANDBOX_EXPORT ProcUtil { | 14 class SANDBOX_EXPORT ProcUtil { |
14 public: | 15 public: |
15 // Returns the number of file descriptors in the current process's FD | 16 // Returns the number of file descriptors in the current process's FD |
16 // table, excluding |proc_fd|, which should be a file descriptor for | 17 // table, excluding |proc_fd|, which should be a file descriptor for |
17 // /proc. | 18 // /proc. |
18 static int CountOpenFds(int proc_fd); | 19 static int CountOpenFds(int proc_fd); |
19 | 20 |
20 // Checks whether the current process has any directory file descriptor open. | 21 // Checks whether the current process has any directory file descriptor open. |
21 // Directory file descriptors are "capabilities" that would let a process use | 22 // Directory file descriptors are "capabilities" that would let a process use |
22 // system calls such as openat() to bypass restrictions such as | 23 // system calls such as openat() to bypass restrictions such as |
23 // DropFileSystemAccess(). | 24 // DropFileSystemAccess(). |
24 // Sometimes it's useful to call HasOpenDirectory() after file system access | 25 // Sometimes it's useful to call HasOpenDirectory() after file system access |
25 // has been dropped. In this case, |proc_fd| should be a file descriptor to | 26 // has been dropped. In this case, |proc_fd| should be a file descriptor to |
26 // /proc. The file descriptor in |proc_fd| will be ignored by | 27 // /proc. The file descriptor in |proc_fd| will be ignored by |
27 // HasOpenDirectory() and remains owned by the caller. It is very important | 28 // HasOpenDirectory() and remains owned by the caller. It is very important |
28 // for the caller to close it. | 29 // for the caller to close it. |
29 // If /proc is available, |proc_fd| can be passed as -1. | 30 // If /proc is available, |proc_fd| can be passed as -1. |
30 // If |proc_fd| is -1 and /proc is not available, this function will return | 31 // If |proc_fd| is -1 and /proc is not available, this function will return |
31 // false. | 32 // false. |
32 static bool HasOpenDirectory(int proc_fd); | 33 static bool HasOpenDirectory(int proc_fd); |
33 | 34 |
| 35 // Open /proc/self/task/ or crash if it cannot. |
| 36 static base::ScopedFD OpenProcSelfTask(); |
| 37 |
34 private: | 38 private: |
35 DISALLOW_IMPLICIT_CONSTRUCTORS(ProcUtil); | 39 DISALLOW_IMPLICIT_CONSTRUCTORS(ProcUtil); |
36 }; | 40 }; |
37 | 41 |
38 } // namespace sandbox | 42 } // namespace sandbox |
39 | 43 |
40 #endif // SANDBOX_LINUX_SERVICES_PROC_UTIL_H_ | 44 #endif // SANDBOX_LINUX_SERVICES_PROC_UTIL_H_ |
OLD | NEW |