Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(108)

Side by Side Diff: content/browser/renderer_host/render_sandbox_host_linux.cc

Issue 276763002: Remove SandboxIPCProcess's dependency on chrome-sandbox (Closed) Base URL: svn://svn.chromium.org/chrome/trunk/src
Patch Set: Created 6 years, 7 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch | Annotate | Revision Log
OLDNEW
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be 2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file. 3 // found in the LICENSE file.
4 4
5 #include "content/browser/renderer_host/render_sandbox_host_linux.h" 5 #include "content/browser/renderer_host/render_sandbox_host_linux.h"
6 6
7 #include <sys/socket.h> 7 #include <sys/socket.h>
8 8
9 #include "base/memory/singleton.h" 9 #include "base/memory/singleton.h"
10 #include "base/posix/eintr_wrapper.h" 10 #include "base/posix/eintr_wrapper.h"
11 #include "content/browser/renderer_host/sandbox_ipc_linux.h" 11 #include "content/browser/renderer_host/sandbox_ipc_linux.h"
12 12
13 namespace content { 13 namespace content {
14 14
15 // Runs on the main thread at startup. 15 // Runs on the main thread at startup.
16 RenderSandboxHostLinux::RenderSandboxHostLinux() 16 RenderSandboxHostLinux::RenderSandboxHostLinux()
17 : initialized_(false), 17 : initialized_(false),
18 renderer_socket_(0), 18 renderer_socket_(0),
19 childs_lifeline_fd_(0), 19 childs_lifeline_fd_(0),
20 pid_(0) { 20 pid_(0) {
21 } 21 }
22 22
23 // static 23 // static
24 RenderSandboxHostLinux* RenderSandboxHostLinux::GetInstance() { 24 RenderSandboxHostLinux* RenderSandboxHostLinux::GetInstance() {
25 return Singleton<RenderSandboxHostLinux>::get(); 25 return Singleton<RenderSandboxHostLinux>::get();
26 } 26 }
27 27
28 void RenderSandboxHostLinux::Init(const std::string& sandbox_path) { 28 void RenderSandboxHostLinux::Init() {
29 DCHECK(!initialized_); 29 DCHECK(!initialized_);
30 initialized_ = true; 30 initialized_ = true;
31 31
32 int fds[2]; 32 int fds[2];
33 // We use SOCK_SEQPACKET rather than SOCK_DGRAM to prevent the renderer from 33 // We use SOCK_SEQPACKET rather than SOCK_DGRAM to prevent the renderer from
34 // sending datagrams to other sockets on the system. The sandbox may prevent 34 // sending datagrams to other sockets on the system. The sandbox may prevent
35 // the renderer from calling socket() to create new sockets, but it'll still 35 // the renderer from calling socket() to create new sockets, but it'll still
36 // inherit some sockets. With AF_UNIX+SOCK_DGRAM, it can call sendmsg to send 36 // inherit some sockets. With AF_UNIX+SOCK_DGRAM, it can call sendmsg to send
37 // a datagram to any (abstract) socket on the same system. With 37 // a datagram to any (abstract) socket on the same system. With
38 // SOCK_SEQPACKET, this is prevented. 38 // SOCK_SEQPACKET, this is prevented.
(...skipping 18 matching lines...) Expand all
57 #if !defined(THREAD_SANITIZER) 57 #if !defined(THREAD_SANITIZER)
58 DCHECK_EQ(1, base::GetNumberOfThreads(base::GetCurrentProcessHandle())); 58 DCHECK_EQ(1, base::GetNumberOfThreads(base::GetCurrentProcessHandle()));
59 #endif // !defined(THREAD_SANITIZER) 59 #endif // !defined(THREAD_SANITIZER)
60 pid_ = fork(); 60 pid_ = fork();
61 if (pid_ == 0) { 61 if (pid_ == 0) {
62 if (IGNORE_EINTR(close(fds[0])) < 0) 62 if (IGNORE_EINTR(close(fds[0])) < 0)
63 DPLOG(ERROR) << "close"; 63 DPLOG(ERROR) << "close";
64 if (IGNORE_EINTR(close(pipefds[1])) < 0) 64 if (IGNORE_EINTR(close(pipefds[1])) < 0)
65 DPLOG(ERROR) << "close"; 65 DPLOG(ERROR) << "close";
66 66
67 SandboxIPCProcess handler(child_lifeline_fd, browser_socket, sandbox_path); 67 SandboxIPCProcess handler(child_lifeline_fd, browser_socket);
68 handler.Run(); 68 handler.Run();
69 _exit(0); 69 _exit(0);
70 } 70 }
71 } 71 }
72 72
73 RenderSandboxHostLinux::~RenderSandboxHostLinux() { 73 RenderSandboxHostLinux::~RenderSandboxHostLinux() {
74 if (initialized_) { 74 if (initialized_) {
75 if (IGNORE_EINTR(close(renderer_socket_)) < 0) 75 if (IGNORE_EINTR(close(renderer_socket_)) < 0)
76 PLOG(ERROR) << "close"; 76 PLOG(ERROR) << "close";
77 if (IGNORE_EINTR(close(childs_lifeline_fd_)) < 0) 77 if (IGNORE_EINTR(close(childs_lifeline_fd_)) < 0)
78 PLOG(ERROR) << "close"; 78 PLOG(ERROR) << "close";
79 } 79 }
80 } 80 }
81 81
82 } // namespace content 82 } // namespace content
OLDNEW

Powered by Google App Engine
This is Rietveld 408576698