Index: sandbox/linux/seccomp-bpf/sandbox_bpf.cc |
diff --git a/sandbox/linux/seccomp-bpf/sandbox_bpf.cc b/sandbox/linux/seccomp-bpf/sandbox_bpf.cc |
index d51fa78149c994f92a0894a5a45c8689ae64b760..31975a1b98e33539d60a977cf70e789d09ecd6d5 100644 |
--- a/sandbox/linux/seccomp-bpf/sandbox_bpf.cc |
+++ b/sandbox/linux/seccomp-bpf/sandbox_bpf.cc |
@@ -27,16 +27,18 @@ |
#include "sandbox/linux/bpf_dsl/dump_bpf.h" |
#include "sandbox/linux/bpf_dsl/policy.h" |
#include "sandbox/linux/bpf_dsl/policy_compiler.h" |
+#include "sandbox/linux/bpf_dsl/seccomp_macros.h" |
#include "sandbox/linux/bpf_dsl/syscall_set.h" |
#include "sandbox/linux/seccomp-bpf/die.h" |
#include "sandbox/linux/seccomp-bpf/errorcode.h" |
-#include "sandbox/linux/seccomp-bpf/linux_seccomp.h" |
#include "sandbox/linux/seccomp-bpf/syscall.h" |
#include "sandbox/linux/seccomp-bpf/trap.h" |
#include "sandbox/linux/seccomp-bpf/verifier.h" |
-#include "sandbox/linux/services/linux_syscalls.h" |
+#include "sandbox/linux/services/proc_util.h" |
#include "sandbox/linux/services/syscall_wrappers.h" |
#include "sandbox/linux/services/thread_helpers.h" |
+#include "sandbox/linux/system_headers/linux_seccomp.h" |
+#include "sandbox/linux/system_headers/linux_syscalls.h" |
namespace sandbox { |
@@ -116,13 +118,16 @@ bool SandboxBPF::StartSandbox(SeccompLevel seccomp_level) { |
return false; |
} |
+ if (!proc_task_fd_.is_valid()) { |
+ SetProcTaskFd(ProcUtil::OpenProcSelfTask()); |
+ } |
+ |
const bool supports_tsync = KernelSupportsSeccompTsync(); |
if (seccomp_level == SeccompLevel::SINGLE_THREADED) { |
- if (!IsSingleThreaded(proc_task_fd_.get())) { |
- SANDBOX_DIE("Cannot start sandbox; process is already multi-threaded"); |
- return false; |
- } |
+ // Wait for /proc/self/task/ to update if needed and assert the |
+ // process is single threaded. |
+ ThreadHelpers::AssertSingleThreaded(proc_task_fd_.get()); |
} else if (seccomp_level == SeccompLevel::MULTI_THREADED) { |
if (IsSingleThreaded(proc_task_fd_.get())) { |
SANDBOX_DIE("Cannot start sandbox; " |