wine/gecko
0
0
Fork 0
mirror of https://gitlab.winehq.org/wine/wine-gecko.git synced 2024-09-13 09:24:08 -07:00
Code Issues Packages Projects Releases Wiki Activity

Bug 786631, part 1: Refactor privilege adjustment. r=dhylands

Browse Source
This commit is contained in:
Chris Jones 2013-01-17 12:06:36 -08:00
parent 8e180ba6d7
commit 61289b3aab
4 changed files with 78 additions and 60 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
ipc/chromium/src/base/process_util.h
View File

@ -131,7 +131,8 @@ enum ChildPrivileges {
PRIVILEGES_UNPRIVILEGED,
PRIVILEGES_CAMERA,
PRIVILEGES_VIDEO,
PRIVILEGES_INHERIT
PRIVILEGES_INHERIT,
PRIVILEGES_LAST
};
#if defined(OS_WIN)
@ -179,9 +180,12 @@ bool LaunchApp(const std::vector<std::string>& argv,
const environment_map& env_vars_to_set,
bool wait, ProcessHandle* process_handle,
ProcessArchitecture arch=GetCurrentProcessArchitecture());
#endif
// Adjust the privileges of this process to match |privs|. Only
// returns if privileges were successfully adjusted.
void SetCurrentProcessPrivileges(ChildPrivileges privs);
// Executes the application specified by cl. This function delegates to one
// of the above two platform-specific functions.
bool LaunchApp(const CommandLine& cl,

82
ipc/chromium/src/base/process_util_linux.cc
View File

@ -231,7 +231,46 @@ bool LaunchApp(const std::vector<std::string>& argv,
argv_cstr[i] = const_cast<char*>(argv[i].c_str());
argv_cstr[argv.size()] = NULL;
if (privs != PRIVILEGES_INHERIT) {
SetCurrentProcessPrivileges(privs);
#ifdef HAVE_PR_DUPLICATE_ENVIRONMENT
execve(argv_cstr[0], argv_cstr.get(), envp);
#else
for (environment_map::const_iterator it = env_vars_to_set.begin();
it != env_vars_to_set.end(); ++it) {
if (setenv(it->first.c_str(), it->second.c_str(), 1/*overwrite*/))
_exit(127);
}
execv(argv_cstr[0], argv_cstr.get());
#endif
// if we get here, we're in serious trouble and should complain loudly
DLOG(ERROR) << "FAILED TO exec() CHILD PROCESS, path: " << argv_cstr[0];
_exit(127);
} else {
gProcessLog.print("==> process %d launched child process %d\n",
GetCurrentProcId(), pid);
if (wait)
HANDLE_EINTR(waitpid(pid, 0, 0));
if (process_handle)
*process_handle = pid;
}
return true;
}
bool LaunchApp(const CommandLine& cl,
bool wait, bool start_hidden,
ProcessHandle* process_handle) {
file_handle_mapping_vector no_files;
return LaunchApp(cl.argv(), no_files, wait, process_handle);
}
void SetCurrentProcessPrivileges(ChildPrivileges privs) {
if (privs == PRIVILEGES_INHERIT) {
return;
}
gid_t gid = CHILD_UNPRIVILEGED_GID;
uid_t uid = CHILD_UNPRIVILEGED_UID;
#ifdef MOZ_WIDGET_GONK
@ -266,61 +305,28 @@ bool LaunchApp(const std::vector<std::string>& argv,
if (privs == PRIVILEGES_CAMERA) {
gid_t groups[] = { AID_AUDIO, AID_CAMERA, AID_SDCARD_RW };
if (setgroups(sizeof(groups) / sizeof(groups[0]), groups) != 0) {
DLOG(ERROR) << "FAILED TO setgroups() CHILD PROCESS, path: " << argv_cstr[0];
DLOG(ERROR) << "FAILED TO setgroups() CHILD PROCESS";
_exit(127);
}
}
else if (privs == PRIVILEGES_VIDEO) {
gid_t groups[] = { AID_AUDIO, AID_MEDIA };
if (setgroups(sizeof(groups) / sizeof(groups[0]), groups) != 0) {
DLOG(ERROR) << "FAILED TO setgroups() CHILD PROCESS, path: " << argv_cstr[0];
DLOG(ERROR) << "FAILED TO setgroups() CHILD PROCESS";
_exit(127);
}
}
#endif
if (setgid(gid) != 0) {
DLOG(ERROR) << "FAILED TO setgid() CHILD PROCESS, path: " << argv_cstr[0];
DLOG(ERROR) << "FAILED TO setgid() CHILD PROCESS";
_exit(127);
}
if (setuid(uid) != 0) {
DLOG(ERROR) << "FAILED TO setuid() CHILD PROCESS, path: " << argv_cstr[0];
DLOG(ERROR) << "FAILED TO setuid() CHILD PROCESS";
_exit(127);
}
if (chdir("/") != 0)
gProcessLog.print("==> could not chdir()\n");
}
#ifdef HAVE_PR_DUPLICATE_ENVIRONMENT
execve(argv_cstr[0], argv_cstr.get(), envp);
#else
for (environment_map::const_iterator it = env_vars_to_set.begin();
it != env_vars_to_set.end(); ++it) {
if (setenv(it->first.c_str(), it->second.c_str(), 1/*overwrite*/))
_exit(127);
}
execv(argv_cstr[0], argv_cstr.get());
#endif
// if we get here, we're in serious trouble and should complain loudly
DLOG(ERROR) << "FAILED TO exec() CHILD PROCESS, path: " << argv_cstr[0];
_exit(127);
} else {
gProcessLog.print("==> process %d launched child process %d\n",
GetCurrentProcId(), pid);
if (wait)
HANDLE_EINTR(waitpid(pid, 0, 0));
if (process_handle)
*process_handle = pid;
}
return true;
}
bool LaunchApp(const CommandLine& cl,
bool wait, bool start_hidden,
ProcessHandle* process_handle) {
file_handle_mapping_vector no_files;
return LaunchApp(cl.argv(), no_files, wait, process_handle);
}
NamedProcessIterator::NamedProcessIterator(const std::wstring& executable_name,

4
ipc/chromium/src/base/process_util_mac.mm
View File

@ -188,6 +188,10 @@ bool LaunchApp(const CommandLine& cl,
return LaunchApp(cl.argv(), no_files, wait, process_handle);
}
void SetCurrentProcessPrivileges(ChildPrivileges privs) {
}
NamedProcessIterator::NamedProcessIterator(const std::wstring& executable_name,
const ProcessFilter* filter)
: executable_name_(executable_name),

4
ipc/chromium/src/base/process_util_win.cc
View File

@ -337,6 +337,10 @@ bool WaitForExitCode(ProcessHandle handle, int* exit_code) {
return true;
}
void SetCurrentProcessPrivileges(ChildPrivileges privs) {
}
NamedProcessIterator::NamedProcessIterator(const std::wstring& executable_name,
const ProcessFilter* filter)
: started_iteration_(false),