Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(292)

Side by Side Diff: sandbox/linux/suid/client/setuid_sandbox_client.cc

Issue 10818015: Setuid sandbox client class readability meta-CL (Closed) Base URL: svn://svn.chromium.org/chrome/trunk/src
Patch Set: Address first comments. Upload two more files. Created 8 years, 4 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch | Annotate | Revision Log
OLDNEW
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be 2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file. 3 // found in the LICENSE file.
4 4
5 #include <sys/types.h> 5 #include <sys/types.h>
6 #include <sys/wait.h> 6 #include <sys/wait.h>
7 #include <unistd.h> 7 #include <unistd.h>
8 8
9 #include "base/eintr_wrapper.h" 9 #include "base/eintr_wrapper.h"
10 #include "base/environment.h" 10 #include "base/environment.h"
(...skipping 10 matching lines...) Expand all
21 // Set an environment variable that reflects the API version we expect from the 21 // Set an environment variable that reflects the API version we expect from the
22 // setuid sandbox. Old versions of the sandbox will ignore this. 22 // setuid sandbox. Old versions of the sandbox will ignore this.
23 void SetSandboxAPIEnvironmentVariable(base::Environment* env) { 23 void SetSandboxAPIEnvironmentVariable(base::Environment* env) {
24 env->SetVar(sandbox::kSandboxEnvironmentApiRequest, 24 env->SetVar(sandbox::kSandboxEnvironmentApiRequest,
25 base::IntToString(sandbox::kSUIDSandboxApiNumber)); 25 base::IntToString(sandbox::kSUIDSandboxApiNumber));
26 } 26 }
27 27
28 // Wrapper around a shared C function. 28 // Wrapper around a shared C function.
29 // Returns the "saved" environment variable name corresponding to |envvar| 29 // Returns the "saved" environment variable name corresponding to |envvar|
30 // in a new string or NULL. 30 // in a new string or NULL.
31 std::string* CreateSavedVariableName(const char* envvar) { 31 std::string* CreateSavedVariableName(const char* env_var) {
32 char* const saved_env_var = SandboxSavedEnvironmentVariable(envvar); 32 char* const saved_env_var = SandboxSavedEnvironmentVariable(env_var);
33 if (!saved_env_var) 33 if (!saved_env_var)
34 return NULL; 34 return NULL;
35 std::string* saved_env_var_copy = new std::string(saved_env_var); 35 std::string* saved_env_var_copy = new std::string(saved_env_var);
36 // SandboxSavedEnvironmentVariable is the C function that we wrap and uses 36 // SandboxSavedEnvironmentVariable is the C function that we wrap and uses
37 // malloc() to allocate memory. 37 // malloc() to allocate memory.
38 free(saved_env_var); 38 free(saved_env_var);
39 return saved_env_var_copy; 39 return saved_env_var_copy;
40 } 40 }
41 41
42 // The ELF loader will clear many environment variables so we save them to 42 // The ELF loader will clear many environment variables so we save them to
43 // different names here so that the SUID sandbox can resolve them for the 43 // different names here so that the SUID sandbox can resolve them for the
44 // renderer. 44 // renderer.
45 void SaveSUIDUnsafeEnvironmentVariables(base::Environment* env) { 45 void SaveSUIDUnsafeEnvironmentVariables(base::Environment* env) {
46 for (unsigned i = 0; kSUIDUnsafeEnvironmentVariables[i]; ++i) { 46 for (unsigned i = 0; kSUIDUnsafeEnvironmentVariables[i]; ++i) {
47 const char* const env_var = kSUIDUnsafeEnvironmentVariables[i]; 47 const char* env_var = kSUIDUnsafeEnvironmentVariables[i];
48 // Get the saved environment variable corresponding to envvar. 48 // Get the saved environment variable corresponding to envvar.
49 scoped_ptr<std::string> saved_env_var(CreateSavedVariableName(env_var)); 49 scoped_ptr<std::string> saved_env_var(CreateSavedVariableName(env_var));
50 if (saved_env_var == NULL) 50 if (saved_env_var == NULL)
51 continue; 51 continue;
52 52
53 std::string value; 53 std::string value;
54 if (env->GetVar(env_var, &value)) 54 if (env->GetVar(env_var, &value))
55 env->SetVar(saved_env_var->c_str(), value); 55 env->SetVar(saved_env_var->c_str(), value);
56 else 56 else
57 env->UnSetVar(saved_env_var->c_str()); 57 env->UnSetVar(saved_env_var->c_str());
(...skipping 48 matching lines...) Expand 10 before | Expand all | Expand 10 after
106 SetuidSandboxClient::SetuidSandboxClient() 106 SetuidSandboxClient::SetuidSandboxClient()
107 : env_(NULL), 107 : env_(NULL),
108 sandboxed_(false) { 108 sandboxed_(false) {
109 } 109 }
110 110
111 SetuidSandboxClient::~SetuidSandboxClient() { 111 SetuidSandboxClient::~SetuidSandboxClient() {
112 delete env_; 112 delete env_;
113 } 113 }
114 114
115 bool SetuidSandboxClient::ChrootMe() { 115 bool SetuidSandboxClient::ChrootMe() {
116 int fd = GetIPCDescriptor(env_); 116 int ipc_fd = GetIPCDescriptor(env_);
117 117
118 if (fd < 0) { 118 if (ipc_fd < 0) {
119 LOG(ERROR) << "Failed to obtain the sandbox IPC descriptor"; 119 LOG(ERROR) << "Failed to obtain the sandbox IPC descriptor";
120 return false; 120 return false;
121 } 121 }
122 122
123 if (HANDLE_EINTR(write(fd, &kMsgChrootMe, 1)) != 1) { 123 if (HANDLE_EINTR(write(ipc_fd, &kMsgChrootMe, 1)) != 1) {
124 PLOG(ERROR) << "Failed to write to chroot pipe"; 124 PLOG(ERROR) << "Failed to write to chroot pipe";
125 return false; 125 return false;
126 } 126 }
127 127
128 // We need to reap the chroot helper process in any event. 128 // We need to reap the chroot helper process in any event.
129 pid_t helper_pid = GetHelperPID(env_); 129 pid_t helper_pid = GetHelperPID(env_);
130 // If helper_pid is -1 we wait for any child. 130 // If helper_pid is -1 we wait for any child.
131 if (waitpid(helper_pid, NULL, 0) < 0) { 131 if (waitpid(helper_pid, NULL, 0) < 0) {
132 PLOG(ERROR) << "Failed to wait for setuid helper to die"; 132 PLOG(ERROR) << "Failed to wait for setuid helper to die";
133 return false; 133 return false;
134 } 134 }
135 135
136 char reply; 136 char reply;
137 if (HANDLE_EINTR(read(fd, &reply, 1)) != 1) { 137 if (HANDLE_EINTR(read(ipc_fd, &reply, 1)) != 1) {
138 PLOG(ERROR) << "Failed to read from chroot pipe"; 138 PLOG(ERROR) << "Failed to read from chroot pipe";
139 return false; 139 return false;
140 } 140 }
141 141
142 if (reply != kMsgChrootSuccessful) { 142 if (reply != kMsgChrootSuccessful) {
143 LOG(ERROR) << "Error code reply from chroot helper"; 143 LOG(ERROR) << "Error code reply from chroot helper";
144 return false; 144 return false;
145 } 145 }
146 146
147 // We now consider ourselves "fully sandboxed" as far as the 147 // We now consider ourselves "fully sandboxed" as far as the
(...skipping 21 matching lines...) Expand all
169 bool SetuidSandboxClient::IsSandboxed() const { 169 bool SetuidSandboxClient::IsSandboxed() const {
170 return sandboxed_; 170 return sandboxed_;
171 } 171 }
172 172
173 void SetuidSandboxClient::SetupLaunchEnvironment() { 173 void SetuidSandboxClient::SetupLaunchEnvironment() {
174 SaveSUIDUnsafeEnvironmentVariables(env_); 174 SaveSUIDUnsafeEnvironmentVariables(env_);
175 SetSandboxAPIEnvironmentVariable(env_); 175 SetSandboxAPIEnvironmentVariable(env_);
176 } 176 }
177 177
178 } // namespace sandbox 178 } // namespace sandbox
179
OLDNEW
« no previous file with comments | « sandbox/linux/suid/client/setuid_sandbox_client.h ('k') | sandbox/linux/suid/client/setuid_sandbox_client_unittest.cc » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698