diff options
| -rw-r--r-- | build/common.gypi | 5 | ||||
| -rw-r--r-- | content/browser/browser_main_loop.cc | 60 | ||||
| -rw-r--r-- | content/content_browser.gypi | 8 |
3 files changed, 34 insertions, 39 deletions
diff --git a/build/common.gypi b/build/common.gypi index 6b98fc0..c493b30 100644 --- a/build/common.gypi +++ b/build/common.gypi @@ -949,11 +949,6 @@ # remaining. 'win_third_party_warn_as_error%': 'true', - # This is the location of the sandbox binary. Chrome looks for this before - # running the zygote process. If found, and SUID, it will be used to - # sandbox the zygote process and, thus, all renderer processes. - 'linux_sandbox_path%': '', - # Clang stuff. 'clang%': '<(clang)', 'make_clang_dir%': 'third_party/llvm-build/Release+Asserts', diff --git a/content/browser/browser_main_loop.cc b/content/browser/browser_main_loop.cc index 9e02cc4..dbcc3df 100644 --- a/content/browser/browser_main_loop.cc +++ b/content/browser/browser_main_loop.cc @@ -7,10 +7,12 @@ #include "base/bind.h" #include "base/command_line.h" #include "base/debug/trace_event.h" +#include "base/file_util.h" #include "base/logging.h" #include "base/message_loop/message_loop.h" #include "base/metrics/field_trial.h" #include "base/metrics/histogram.h" +#include "base/path_service.h" #include "base/pending_task.h" #include "base/power_monitor/power_monitor.h" #include "base/process/process_metrics.h" @@ -119,19 +121,28 @@ void SetupSandbox(const CommandLine& parsed_command_line) { TRACE_EVENT0("startup", "SetupSandbox"); // TODO(evanm): move this into SandboxWrapper; I'm just trying to move this // code en masse out of chrome_main for now. - const char* sandbox_binary = NULL; + base::FilePath sandbox_binary; + bool env_chrome_devel_sandbox_set = false; struct stat st; - // In Chromium branded builds, developers can set an environment variable to - // use the development sandbox. See - // http://code.google.com/p/chromium/wiki/LinuxSUIDSandboxDevelopment - if (stat(base::kProcSelfExe, &st) == 0 && st.st_uid == getuid()) - sandbox_binary = getenv("CHROME_DEVEL_SANDBOX"); + base::FilePath exe_dir; + if (PathService::Get(base::DIR_EXE, &exe_dir)) { + base::FilePath sandbox_candidate = exe_dir.AppendASCII("chrome-sandbox"); + if (base::PathExists(sandbox_candidate)) + sandbox_binary = sandbox_candidate; + } -#if defined(LINUX_SANDBOX_PATH) - if (!sandbox_binary) - sandbox_binary = LINUX_SANDBOX_PATH; -#endif + // In user-managed builds, including development builds, an environment + // variable is required to enable the sandbox. See + // http://code.google.com/p/chromium/wiki/LinuxSUIDSandboxDevelopment + if (sandbox_binary.empty() && + stat(base::kProcSelfExe, &st) == 0 && st.st_uid == getuid()) { + const char* devel_sandbox_path = getenv("CHROME_DEVEL_SANDBOX"); + if (devel_sandbox_path) { + env_chrome_devel_sandbox_set = true; + sandbox_binary = base::FilePath(devel_sandbox_path); + } + } const bool want_setuid_sandbox = !parsed_command_line.HasSwitch(switches::kNoSandbox) && @@ -141,26 +152,23 @@ void SetupSandbox(const CommandLine& parsed_command_line) { static const char no_suid_error[] = "Running without the SUID sandbox! See " "https://code.google.com/p/chromium/wiki/LinuxSUIDSandboxDevelopment " "for more information on developing with the sandbox on."; - if (!sandbox_binary) { - // This needs to be fatal. Talk to security@chromium.org if you feel - // otherwise. - LOG(FATAL) << no_suid_error; - } - // TODO(jln): an empty CHROME_DEVEL_SANDBOX environment variable (as - // opposed to a non existing one) is not fatal yet. This is needed because - // of existing bots and scripts. Fix it (crbug.com/245376). - if (sandbox_binary && *sandbox_binary == '\0') + if (sandbox_binary.empty()) { + if (!env_chrome_devel_sandbox_set) { + // This needs to be fatal. Talk to security@chromium.org if you feel + // otherwise. + LOG(FATAL) << no_suid_error; + } + + // TODO(jln): an empty CHROME_DEVEL_SANDBOX environment variable (as + // opposed to a non existing one) is not fatal yet. This is needed + // because of existing bots and scripts. Fix it (crbug.com/245376). LOG(ERROR) << no_suid_error; - } - - std::string sandbox_cmd; - if (want_setuid_sandbox && sandbox_binary) { - sandbox_cmd = sandbox_binary; + } } // Tickle the sandbox host and zygote host so they fork now. - RenderSandboxHostLinux::GetInstance()->Init(sandbox_cmd); - ZygoteHostImpl::GetInstance()->Init(sandbox_cmd); + RenderSandboxHostLinux::GetInstance()->Init(sandbox_binary.value()); + ZygoteHostImpl::GetInstance()->Init(sandbox_binary.value()); } #endif diff --git a/content/content_browser.gypi b/content/content_browser.gypi index 47bb068..d57974c 100644 --- a/content/content_browser.gypi +++ b/content/content_browser.gypi @@ -1328,14 +1328,6 @@ '../build/linux/system.gyp:udev', '../sandbox/sandbox.gyp:libc_urandom_override', ], - # Set LINUX_SANDBOX_PATH for Linux, including Chrome OS - 'conditions': [ - ['linux_sandbox_path != ""', { - 'defines': [ - 'LINUX_SANDBOX_PATH="<(linux_sandbox_path)"', - ], - }], - ], }], ['OS=="linux" and use_aura==1', { 'dependencies': [ |