Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(380)

Unified Diff: components/nacl/loader/sandbox_linux/nacl_sandbox_linux.cc

Issue 1158793003: Enable one PID namespace per process for NaCl processes. (Closed) Base URL: https://chromium.googlesource.com/chromium/src.git@master
Patch Set: Respond to comments. Created 5 years, 7 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
Index: components/nacl/loader/sandbox_linux/nacl_sandbox_linux.cc
diff --git a/components/nacl/loader/sandbox_linux/nacl_sandbox_linux.cc b/components/nacl/loader/sandbox_linux/nacl_sandbox_linux.cc
index 869658f9f8b4eddec6efdd545b89c966626b0440..4ff1d4c076dcf71f5f7df6013fcc1c9452407843 100644
--- a/components/nacl/loader/sandbox_linux/nacl_sandbox_linux.cc
+++ b/components/nacl/loader/sandbox_linux/nacl_sandbox_linux.cc
@@ -139,10 +139,14 @@ void NaClSandbox::InitializeLayerOneSandbox() {
layer_one_enabled_ = true;
} else if (sandbox::NamespaceSandbox::InNewUserNamespace()) {
CHECK(sandbox::Credentials::MoveToNewUserNS());
- // This relies on SealLayerOneSandbox() to be called later since this
- // class is keeping a file descriptor to /proc/.
CHECK(sandbox::Credentials::DropFileSystemAccess(proc_fd_.get()));
- CHECK(sandbox::Credentials::DropAllCapabilities(proc_fd_.get()));
+
+ // We do not drop CAP_SYS_ADMIN because we need it to place each child
+ // process in its own PID namespace later on.
+ std::vector<sandbox::Credentials::Capability> caps;
+ caps.push_back(sandbox::Credentials::Capability::SYS_ADMIN);
+ CHECK(sandbox::Credentials::SetCapabilities(proc_fd_.get(), caps));
+
CHECK(IsSandboxed());
layer_one_enabled_ = true;
}

Powered by Google App Engine
This is Rietveld 408576698