StarMirror/sandboxed-api
1
0
Fork 0
mirror of https://github.com/google/sandboxed-api.git synced 2024-03-22 13:11:30 +08:00
Code Issues Projects Releases Wiki Activity

In Sandbox2 IPC class, add a MapDupedFd() function to allow application to retain ownership of the local_fd.

Browse Source 
PiperOrigin-RevId: 557539211
Change-Id: Ib74a305333bc51a261c766052284e9fa68115e9d
This commit is contained in:
Sandboxed API Team 2023-08-16 10:57:58 -07:00 committed by Copybara-Service
parent abd3faf51b
commit 034f24001e
2 changed files with 25 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
sandboxed_api/sandbox2/ipc.cc
View File

@ -17,25 +17,35 @@
#include "sandboxed_api/sandbox2/ipc.h"
#include <sys/socket.h>
#include <unistd.h>
#include <memory>
#include <string>
#include <tuple>
#include <thread>
#include "absl/log/log.h"
#include "absl/strings/string_view.h"
#include "sandboxed_api/sandbox2/comms.h"
#include "sandboxed_api/sandbox2/logserver.h"
#include "sandboxed_api/sandbox2/logsink.h"
#include "sandboxed_api/util/raw_logging.h"
namespace sandbox2 {
void IPC::SetUpServerSideComms(int fd) { comms_ = std::make_unique<Comms>(fd); }
void IPC::MapFd(int local_fd, int remote_fd) {
VLOG(3) << "Will send: " << local_fd << ", to overwrite: " << remote_fd;
fd_map_.push_back(std::make_tuple(local_fd, remote_fd, ""));
}
void IPC::MapDupedFd(int local_fd, int remote_fd) {
const int dup_local_fd = dup(local_fd);
if (dup_local_fd != -1) {
PLOG(FATAL) << "dup(" << local_fd << ")";
}
fd_map_.push_back(std::make_tuple(dup_local_fd, remote_fd, ""));
}
int IPC::ReceiveFd(int remote_fd) { return ReceiveFd(remote_fd, ""); }
int IPC::ReceiveFd(absl::string_view name) { return ReceiveFd(-1, name); }
@ -46,9 +56,6 @@ int IPC::ReceiveFd(int remote_fd, absl::string_view name) {
PLOG(FATAL) << "socketpair(AF_UNIX, SOCK_STREAM | SOCK_CLOEXEC, 0)";
}
VLOG(3) << "Created a socketpair (" << sv[0] << "/" << sv[1] << "), "
<< "which will overwrite remote_fd: " << remote_fd;
fd_map_.push_back(std::make_tuple(sv[1], remote_fd, std::string(name)));
return sv[0];
@ -74,9 +81,6 @@ bool IPC::SendFdsOverComms() {
LOG(ERROR) << "SendString: Couldn't send " << std::get<2>(fd_tuple);
return false;
}
VLOG(3) << "IPC: local_fd: " << std::get<0>(fd_tuple)
<< ", remote_fd: " << std::get<1>(fd_tuple) << " sent";
}
return true;

16
sandboxed_api/sandbox2/ipc.h
View File

@ -42,10 +42,17 @@ class IPC final {
// Marks local_fd so that it should be sent to the remote process (sandboxee),
// and duplicated onto remote_fd in it. The local_fd will be closed after
// being sent (in SendFdsOverComms which is called by the Monitor class), so
// it should not be used from that point on.
// being sent (in SendFdsOverComms() which is called by the Monitor class when
// Sandbox2::RunAsync() is called), so local_fd should not be used from that
// point on. The application must not close local_fd after calling MapFd().
void MapFd(int local_fd, int remote_fd);
// Similar to MapFd(), except local_fd remains available for use in the
// application even after Sandbox2::RunAsync() is called; the application
// retains responsibility for closing local_fd and may do so at any time after
// calling MapDupedFd().
void MapDupedFd(int local_fd, int remote_fd);
// Creates and returns a socketpair endpoint. The other endpoint of the
// socketpair is marked as to be sent to the remote process (sandboxee) with
// SendFdsOverComms() as with MapFd().
@ -75,8 +82,9 @@ class IPC final {
void InternalCleanupFdMap();
// Tuple of file descriptor pairs which will be sent to the sandboxee: in the
// form of tuple<local_fd, remote_fd>: local_fd: local fd which should be sent
// to sandboxee, remote_fd: it will be overwritten by local_fd.
// form of tuple<local_fd, remote_fd, name>:
// local_fd: local fd which should be sent to sandboxee
// remote_fd: it will be overwritten by local_fd.
std::vector<std::tuple<int, int, std::string>> fd_map_;
// Comms channel used to exchange data with the sandboxee.