POSIX: CHECK() that file_util::ScopedFD fulfills promise.

base/file_util.h

Index: base/file_util.h
diff --git a/base/file_util.h b/base/file_util.h
index 4af6c97ad6257832f258f515de729f7f5efffc30..574c329bc1b98369a2bb862343f36a92a7bf6c54 100644
--- a/base/file_util.h
+++ b/base/file_util.h
@@ -416,8 +416,9 @@ typedef scoped_ptr<FILE, ScopedFILEClose> ScopedFILE;
 struct ScopedFDClose {
   inline void operator()(int* x) const {
     if (x && *x >= 0) {
-      if (IGNORE_EINTR(close(*x)) < 0)
-        DPLOG(ERROR) << "close";
+      // There are security implications to not closing a file descriptor

[willchan no longer on Chromium, 2014/02/28 01:48:48]

If it's not private and doesn't take forever to explain, can you update this and
the CL description to explain the security implications? They're not obvious to
me (but I trust you).

[jln (very slow on Chromium), 2014/02/28 02:01:21]

Done.

We often have schemes such as: 1. open privileged resources 2. Enable sandbox 3.
Drop access to privilege resources.
(3) failing can be very problematic, especially for directory fd and the setuid
sandbox (since openat(dir_fd, ...) can bypass a chroot).

A lot of the code in sandbox/ is paranoid and redefines its own *Closer because
base/ is not reliable. It looks like patching base is the right thing to do
instead.

+      // properly. It's important to crash here.
+      PCHECK(0 == IGNORE_EINTR(close(*x)));
     }
   }
 };
@@ -427,6 +428,8 @@ struct ScopedFDClose {
 // need to store the FD separately and keep its memory alive). This should
 // probably be called |ScopedFDCloser| or something like that.
 typedef scoped_ptr<int, ScopedFDClose> ScopedFD;
+// Let new users use ScopedFDCloser already, while ScopedFD is replaced.
+typedef ScopedFD ScopedFDCloser;
 #endif  // OS_POSIX
 
 #if defined(OS_LINUX)