| OLD | NEW |
| 1 // Copyright 2014 The Chromium Authors. All rights reserved. | 1 // Copyright 2014 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #ifndef SANDBOX_LINUX_SERVICES_PROC_UTIL_H_ | 5 #ifndef SANDBOX_LINUX_SERVICES_PROC_UTIL_H_ |
| 6 #define SANDBOX_LINUX_SERVICES_PROC_UTIL_H_ | 6 #define SANDBOX_LINUX_SERVICES_PROC_UTIL_H_ |
| 7 | 7 |
| 8 #include "base/files/scoped_file.h" | 8 #include "base/files/scoped_file.h" |
| 9 #include "base/macros.h" | 9 #include "base/macros.h" |
| 10 #include "sandbox/sandbox_export.h" | 10 #include "sandbox/sandbox_export.h" |
| 11 | 11 |
| 12 namespace sandbox { | 12 namespace sandbox { |
| 13 | 13 |
| 14 class SANDBOX_EXPORT ProcUtil { | 14 class SANDBOX_EXPORT ProcUtil { |
| 15 public: | 15 public: |
| 16 // Returns the number of file descriptors in the current process's FD | 16 // Returns the number of file descriptors in the current process's FD |
| 17 // table, excluding |proc_fd|, which should be a file descriptor for | 17 // table, excluding |proc_fd|, which should be a file descriptor for |
| 18 // /proc. | 18 // /proc/. |
| 19 static int CountOpenFds(int proc_fd); | 19 static int CountOpenFds(int proc_fd); |
| 20 | 20 |
| 21 // Checks whether the current process has any directory file descriptor open. | 21 // Checks whether the current process has any directory file descriptor open. |
| 22 // Directory file descriptors are "capabilities" that would let a process use | 22 // Directory file descriptors are "capabilities" that would let a process use |
| 23 // system calls such as openat() to bypass restrictions such as | 23 // system calls such as openat() to bypass restrictions such as |
| 24 // DropFileSystemAccess(). | 24 // DropFileSystemAccess(). |
| 25 // Sometimes it's useful to call HasOpenDirectory() after file system access | 25 // Sometimes it's useful to call HasOpenDirectory() after file system access |
| 26 // has been dropped. In this case, |proc_fd| should be a file descriptor to | 26 // has been dropped. In this case, |proc_fd| should be a file descriptor to |
| 27 // /proc. The file descriptor in |proc_fd| will be ignored by | 27 // /proc/. The file descriptor in |proc_fd| will be ignored by |
| 28 // HasOpenDirectory() and remains owned by the caller. It is very important | 28 // HasOpenDirectory() and remains owned by the caller. It is very important |
| 29 // for the caller to close it. | 29 // for the caller to close it. |
| 30 // If /proc is available, |proc_fd| can be passed as -1. | 30 static bool HasOpenDirectory(int proc_fd) WARN_UNUSED_RESULT; |
| 31 // If |proc_fd| is -1 and /proc is not available, this function will return | 31 static bool HasOpenDirectory() WARN_UNUSED_RESULT; |
| 32 // false. | |
| 33 static bool HasOpenDirectory(int proc_fd); | |
| 34 | 32 |
| 35 // Open /proc/self/task/ or crash if it cannot. | 33 // Open /proc/ or crash if not possible. |
| 36 static base::ScopedFD OpenProcSelfTask(); | 34 static base::ScopedFD OpenProc(); |
| 37 | 35 |
| 38 private: | 36 private: |
| 39 DISALLOW_IMPLICIT_CONSTRUCTORS(ProcUtil); | 37 DISALLOW_IMPLICIT_CONSTRUCTORS(ProcUtil); |
| 40 }; | 38 }; |
| 41 | 39 |
| 42 } // namespace sandbox | 40 } // namespace sandbox |
| 43 | 41 |
| 44 #endif // SANDBOX_LINUX_SERVICES_PROC_UTIL_H_ | 42 #endif // SANDBOX_LINUX_SERVICES_PROC_UTIL_H_ |
| OLD | NEW |