POSIX: CHECK() that file_util::ScopedFD fulfills promise.

base/file_util.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // This file contains utility functions for dealing with the local
 // filesystem.
 
 #ifndef BASE_FILE_UTIL_H_
 #define BASE_FILE_UTIL_H_
 
@@ skipping 398 matching lines @@
 };
 
 // Automatically closes |FILE*|s.
 typedef scoped_ptr<FILE, ScopedFILEClose> ScopedFILE;
 
 #if defined(OS_POSIX)
 // Functor for |ScopedFD| (below).
 struct ScopedFDClose {
   inline void operator()(int* x) const {
     if (x && *x >= 0) {
-      if (IGNORE_EINTR(close(*x)) < 0)
-        DPLOG(ERROR) << "close";
+      // There are security implications to not closing a file descriptor

[willchan no longer on Chromium, 2014/02/28 01:48:48]

If it's not private and doesn't take forever to explain, can you update this and
the CL description to explain the security implications? They're not obvious to
me (but I trust you).

[jln (very slow on Chromium), 2014/02/28 02:01:21]

Done.

We often have schemes such as: 1. open privileged resources 2. Enable sandbox 3.
Drop access to privilege resources.
(3) failing can be very problematic, especially for directory fd and the setuid
sandbox (since openat(dir_fd, ...) can bypass a chroot).

A lot of the code in sandbox/ is paranoid and redefines its own *Closer because
base/ is not reliable. It looks like patching base is the right thing to do
instead.

+      // properly. It's important to crash here.
+      PCHECK(0 == IGNORE_EINTR(close(*x)));
     }
   }
 };
 
 // Automatically closes FDs (note: doesn't store the FD).
 // TODO(viettrungluu): This is a very odd API, since (unlike |FILE*|s, you'll
 // need to store the FD separately and keep its memory alive). This should
 // probably be called |ScopedFDCloser| or something like that.
 typedef scoped_ptr<int, ScopedFDClose> ScopedFD;
+// Let new users use ScopedFDCloser already, while ScopedFD is replaced.
+typedef ScopedFD ScopedFDCloser;
 #endif  // OS_POSIX
 
 #if defined(OS_LINUX)
 // Broad categories of file systems as returned by statfs() on Linux.
 enum FileSystemType {
   FILE_SYSTEM_UNKNOWN,  // statfs failed.
   FILE_SYSTEM_0,        // statfs.f_type == 0 means unknown, may indicate AFS.
   FILE_SYSTEM_ORDINARY,       // on-disk filesystem like ext2
   FILE_SYSTEM_NFS,
   FILE_SYSTEM_SMB,
@@ skipping 33 matching lines @@
 // This function simulates Move(), but unlike Move() it works across volumes.
 // This function is not transactional.
 BASE_EXPORT bool CopyAndDeleteDirectory(const FilePath& from_path,
                                         const FilePath& to_path);
 #endif  // defined(OS_WIN)
 
 }  // namespace internal
 }  // namespace base
 
 #endif  // BASE_FILE_UTIL_H_