content/browser/renderer_host/render_sandbox_host_linux.cc

   1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "content/browser/renderer_host/render_sandbox_host_linux.h"
   6
   7 #include <fcntl.h>
   8 #include <fontconfig/fontconfig.h>
   9 #include <stdint.h>
  10 #include <sys/poll.h>
  11 #include <sys/socket.h>
  12 #include <sys/stat.h>
  13 #include <sys/uio.h>
  14 #include <time.h>
  15 #include <unistd.h>
  16
  17 #include <vector>
  18
  19 #include "base/command_line.h"
  20 #include "base/linux_util.h"
  21 #include "base/memory/scoped_ptr.h"
  22 #include "base/memory/shared_memory.h"
  23 #include "base/memory/singleton.h"
  24 #include "base/pickle.h"
  25 #include "base/posix/eintr_wrapper.h"
  26 #include "base/posix/unix_domain_socket_linux.h"
  27 #include "base/process/launch.h"
  28 #include "base/process/process_metrics.h"
  29 #include "base/strings/string_number_conversions.h"
  30 #include "base/strings/string_util.h"
  31 #include "content/child/webkitplatformsupport_impl.h"
  32 #include "content/common/font_config_ipc_linux.h"
  33 #include "content/common/sandbox_linux/sandbox_linux.h"
  34 #include "content/common/set_process_title.h"
  35 #include "content/public/common/content_switches.h"
  36 #include "skia/ext/skia_utils_base.h"
  37 #include "third_party/WebKit/public/platform/linux/WebFontInfo.h"
  38 #include "third_party/WebKit/public/web/WebKit.h"
  39 #include "third_party/npapi/bindings/npapi_extensions.h"
  40 #include "third_party/skia/include/ports/SkFontConfigInterface.h"
  41 #include "ui/gfx/font_render_params_linux.h"
  42
  43 using blink::WebCString;
  44 using blink::WebFontInfo;
  45 using blink::WebUChar;
  46 using blink::WebUChar32;
  47
  48 namespace content {
  49
  50 // http://code.google.com/p/chromium/wiki/LinuxSandboxIPC
  51
  52 // BEWARE: code in this file run across *processes* (not just threads).
  53
  54 // This code runs in a child process
  55 class SandboxIPCProcess  {
  56  public:
  57   // lifeline_fd: this is the read end of a pipe which the browser process
  58   //   holds the other end of. If the browser process dies, its descriptors are
  59   //   closed and we will noticed an EOF on the pipe. That's our signal to exit.
  60   // browser_socket: the browser's end of the sandbox IPC socketpair. From the
  61   //   point of view of the renderer, it's talking to the browser but this
  62   //   object actually services the requests.
  63   // sandbox_cmd: the path of the sandbox executable.
  64   SandboxIPCProcess(int lifeline_fd, int browser_socket,
  65                     std::string sandbox_cmd)
  66       : lifeline_fd_(lifeline_fd),
  67         browser_socket_(browser_socket) {
  68     if (!sandbox_cmd.empty()) {
  69       sandbox_cmd_.push_back(sandbox_cmd);
  70       sandbox_cmd_.push_back(base::kFindInodeSwitch);
  71     }
  72
  73     // FontConfig doesn't provide a standard property to control subpixel
  74     // positioning, so we pass the current setting through to WebKit.
  75     WebFontInfo::setSubpixelPositioning(
  76         gfx::GetDefaultWebkitSubpixelPositioning());
  77
  78     CommandLine& command_line = *CommandLine::ForCurrentProcess();
  79     command_line.AppendSwitchASCII(switches::kProcessType,
  80                                    switches::kSandboxIPCProcess);
  81
  82     // Update the process title. The argv was already cached by the call to
  83     // SetProcessTitleFromCommandLine in content_main_runner.cc, so we can pass
  84     // NULL here (we don't have the original argv at this point).
  85     SetProcessTitleFromCommandLine(NULL);
  86   }
  87
  88   ~SandboxIPCProcess();
  89
  90   void Run() {
  91     struct pollfd pfds[2];
  92     pfds[0].fd = lifeline_fd_;
  93     pfds[0].events = POLLIN;
  94     pfds[1].fd = browser_socket_;
  95     pfds[1].events = POLLIN;
  96
  97     int failed_polls = 0;
  98     for (;;) {
  99       const int r = HANDLE_EINTR(poll(pfds, 2, -1 /* no timeout */));
 100       // '0' is not a possible return value with no timeout.
 101       DCHECK_NE(0, r);
 102       if (r < 0) {
 103         PLOG(WARNING) << "poll";
 104         if (failed_polls++ == 3) {
 105           LOG(FATAL) << "poll(2) failing. RenderSandboxHostLinux aborting.";
 106           return;
 107         }
 108         continue;
 109       }
 110
 111       failed_polls = 0;
 112
 113       if (pfds[0].revents) {
 114         // our parent died so we should too.
 115         _exit(0);
 116       }
 117
 118       if (pfds[1].revents) {
 119         HandleRequestFromRenderer(browser_socket_);
 120       }
 121     }
 122   }
 123
 124  private:
 125   void EnsureWebKitInitialized();
 126
 127   // ---------------------------------------------------------------------------
 128   // Requests from the renderer...
 129
 130   void HandleRequestFromRenderer(int fd) {
 131     std::vector<int> fds;
 132
 133     // A FontConfigIPC::METHOD_MATCH message could be kMaxFontFamilyLength
 134     // bytes long (this is the largest message type).
 135     // 128 bytes padding are necessary so recvmsg() does not return MSG_TRUNC
 136     // error for a maximum length message.
 137     char buf[FontConfigIPC::kMaxFontFamilyLength + 128];
 138
 139     const ssize_t len = UnixDomainSocket::RecvMsg(fd, buf, sizeof(buf), &fds);
 140     if (len == -1) {
 141       // TODO: should send an error reply, or the sender might block forever.
 142       NOTREACHED()
 143           << "Sandbox host message is larger than kMaxFontFamilyLength";
 144       return;
 145     }
 146     if (fds.empty())
 147       return;
 148
 149     Pickle pickle(buf, len);
 150     PickleIterator iter(pickle);
 151
 152     int kind;
 153     if (!pickle.ReadInt(&iter, &kind))
 154       goto error;
 155
 156     if (kind == FontConfigIPC::METHOD_MATCH) {
 157       HandleFontMatchRequest(fd, pickle, iter, fds);
 158     } else if (kind == FontConfigIPC::METHOD_OPEN) {
 159       HandleFontOpenRequest(fd, pickle, iter, fds);
 160     } else if (kind == LinuxSandbox::METHOD_GET_FONT_FAMILY_FOR_CHAR) {
 161       HandleGetFontFamilyForChar(fd, pickle, iter, fds);
 162     } else if (kind == LinuxSandbox::METHOD_LOCALTIME) {
 163       HandleLocaltime(fd, pickle, iter, fds);
 164     } else if (kind == LinuxSandbox::METHOD_GET_CHILD_WITH_INODE) {
 165       HandleGetChildWithInode(fd, pickle, iter, fds);
 166     } else if (kind == LinuxSandbox::METHOD_GET_STYLE_FOR_STRIKE) {
 167       HandleGetStyleForStrike(fd, pickle, iter, fds);
 168     } else if (kind == LinuxSandbox::METHOD_MAKE_SHARED_MEMORY_SEGMENT) {
 169       HandleMakeSharedMemorySegment(fd, pickle, iter, fds);
 170     } else if (kind == LinuxSandbox::METHOD_MATCH_WITH_FALLBACK) {
 171       HandleMatchWithFallback(fd, pickle, iter, fds);
 172     }
 173
 174   error:
 175     for (std::vector<int>::const_iterator
 176          i = fds.begin(); i != fds.end(); ++i) {
 177       close(*i);
 178     }
 179   }
 180
 181   int FindOrAddPath(const SkString& path) {
 182     int count = paths_.count();
 183     for (int i = 0; i < count; ++i) {
 184       if (path == *paths_[i])
 185         return i;
 186     }
 187     *paths_.append() = new SkString(path);
 188     return count;
 189   }
 190
 191   void HandleFontMatchRequest(int fd, const Pickle& pickle, PickleIterator iter,
 192                               std::vector<int>& fds) {
 193     uint32_t requested_style;
 194     std::string family;
 195     if (!pickle.ReadString(&iter, &family) ||
 196         !pickle.ReadUInt32(&iter, &requested_style))
 197       return;
 198
 199     SkFontConfigInterface::FontIdentity result_identity;
 200     SkString result_family;
 201     SkTypeface::Style result_style;
 202     SkFontConfigInterface* fc =
 203         SkFontConfigInterface::GetSingletonDirectInterface();
 204     const bool r = fc->matchFamilyName(
 205         family.c_str(), static_cast<SkTypeface::Style>(requested_style),
 206         &result_identity, &result_family, &result_style);
 207
 208     Pickle reply;
 209     if (!r) {
 210       reply.WriteBool(false);
 211     } else {
 212       // Stash away the returned path, so we can give it an ID (index)
 213       // which will later be given to us in a request to open the file.
 214       int index = FindOrAddPath(result_identity.fString);
 215       result_identity.fID = static_cast<uint32_t>(index);
 216
 217       reply.WriteBool(true);
 218       skia::WriteSkString(&reply, result_family);
 219       skia::WriteSkFontIdentity(&reply, result_identity);
 220       reply.WriteUInt32(result_style);
 221     }
 222     SendRendererReply(fds, reply, -1);
 223   }
 224
 225   void HandleFontOpenRequest(int fd, const Pickle& pickle, PickleIterator iter,
 226                              std::vector<int>& fds) {
 227     uint32_t index;
 228     if (!pickle.ReadUInt32(&iter, &index))
 229       return;
 230     if (index >= static_cast<uint32_t>(paths_.count()))
 231       return;
 232     const int result_fd = open(paths_[index]->c_str(), O_RDONLY);
 233
 234     Pickle reply;
 235     if (result_fd == -1) {
 236       reply.WriteBool(false);
 237     } else {
 238       reply.WriteBool(true);
 239     }
 240
 241     // The receiver will have its own access to the file, so we will close it
 242     // after this send.
 243     SendRendererReply(fds, reply, result_fd);
 244
 245     if (result_fd >= 0) {
 246       int err = IGNORE_EINTR(close(result_fd));
 247       DCHECK(!err);
 248     }
 249   }
 250
 251   void HandleGetFontFamilyForChar(int fd, const Pickle& pickle,
 252                                   PickleIterator iter,
 253                                   std::vector<int>& fds) {
 254     // The other side of this call is
 255     // chrome/renderer/renderer_sandbox_support_linux.cc
 256
 257     EnsureWebKitInitialized();
 258     WebUChar32 c;
 259     if (!pickle.ReadInt(&iter, &c))
 260       return;
 261
 262     std::string preferred_locale;
 263     if (!pickle.ReadString(&iter, &preferred_locale))
 264       return;
 265
 266     blink::WebFontFamily family;
 267     WebFontInfo::familyForChar(c, preferred_locale.c_str(), &family);
 268
 269     Pickle reply;
 270     if (family.name.data()) {
 271       reply.WriteString(family.name.data());
 272     } else {
 273       reply.WriteString(std::string());
 274     }
 275     reply.WriteBool(family.isBold);
 276     reply.WriteBool(family.isItalic);
 277     SendRendererReply(fds, reply, -1);
 278   }
 279
 280   void HandleGetStyleForStrike(int fd, const Pickle& pickle,
 281                                PickleIterator iter,
 282                                std::vector<int>& fds) {
 283     std::string family;
 284     int sizeAndStyle;
 285
 286     if (!pickle.ReadString(&iter, &family) ||
 287         !pickle.ReadInt(&iter, &sizeAndStyle)) {
 288       return;
 289     }
 290
 291     EnsureWebKitInitialized();
 292     blink::WebFontRenderStyle style;
 293     WebFontInfo::renderStyleForStrike(family.c_str(), sizeAndStyle, &style);
 294
 295     Pickle reply;
 296     reply.WriteInt(style.useBitmaps);
 297     reply.WriteInt(style.useAutoHint);
 298     reply.WriteInt(style.useHinting);
 299     reply.WriteInt(style.hintStyle);
 300     reply.WriteInt(style.useAntiAlias);
 301     reply.WriteInt(style.useSubpixelRendering);
 302     reply.WriteInt(style.useSubpixelPositioning);
 303
 304     SendRendererReply(fds, reply, -1);
 305   }
 306
 307   void HandleLocaltime(int fd, const Pickle& pickle, PickleIterator iter,
 308                        std::vector<int>& fds) {
 309     // The other side of this call is in zygote_main_linux.cc
 310
 311     std::string time_string;
 312     if (!pickle.ReadString(&iter, &time_string) ||
 313         time_string.size() != sizeof(time_t)) {
 314       return;
 315     }
 316
 317     time_t time;
 318     memcpy(&time, time_string.data(), sizeof(time));
 319     // We use localtime here because we need the tm_zone field to be filled
 320     // out. Since we are a single-threaded process, this is safe.
 321     const struct tm* expanded_time = localtime(&time);
 322
 323     std::string result_string;
 324     const char* time_zone_string = "";
 325     if (expanded_time != NULL) {
 326       result_string = std::string(reinterpret_cast<const char*>(expanded_time),
 327                                   sizeof(struct tm));
 328       time_zone_string = expanded_time->tm_zone;
 329     }
 330
 331     Pickle reply;
 332     reply.WriteString(result_string);
 333     reply.WriteString(time_zone_string);
 334     SendRendererReply(fds, reply, -1);
 335   }
 336
 337   void HandleGetChildWithInode(int fd, const Pickle& pickle,
 338                                PickleIterator iter,
 339                                std::vector<int>& fds) {
 340     // The other side of this call is in zygote_main_linux.cc
 341     if (sandbox_cmd_.empty()) {
 342       LOG(ERROR) << "Not in the sandbox, this should not be called";
 343       return;
 344     }
 345
 346     uint64_t inode;
 347     if (!pickle.ReadUInt64(&iter, &inode))
 348       return;
 349
 350     base::ProcessId pid = 0;
 351     std::string inode_output;
 352
 353     std::vector<std::string> sandbox_cmd = sandbox_cmd_;
 354     sandbox_cmd.push_back(base::Int64ToString(inode));
 355     CommandLine get_inode_cmd(sandbox_cmd);
 356     if (base::GetAppOutput(get_inode_cmd, &inode_output))
 357       base::StringToInt(inode_output, &pid);
 358
 359     if (!pid) {
 360       // Even though the pid is invalid, we still need to reply to the zygote
 361       // and not just return here.
 362       LOG(ERROR) << "Could not get pid";
 363     }
 364
 365     Pickle reply;
 366     reply.WriteInt(pid);
 367     SendRendererReply(fds, reply, -1);
 368   }
 369
 370   void HandleMakeSharedMemorySegment(int fd, const Pickle& pickle,
 371                                      PickleIterator iter,
 372                                      std::vector<int>& fds) {
 373     base::SharedMemoryCreateOptions options;
 374     uint32_t size;
 375     if (!pickle.ReadUInt32(&iter, &size))
 376       return;
 377     options.size = size;
 378     if (!pickle.ReadBool(&iter, &options.executable))
 379       return;
 380     int shm_fd = -1;
 381     base::SharedMemory shm;
 382     if (shm.Create(options))
 383       shm_fd = shm.handle().fd;
 384     Pickle reply;
 385     SendRendererReply(fds, reply, shm_fd);
 386   }
 387
 388   void HandleMatchWithFallback(int fd, const Pickle& pickle,
 389                                PickleIterator iter,
 390                                std::vector<int>& fds) {
 391     // Unlike the other calls, for which we are an indirection in front of
 392     // WebKit or Skia, this call is always made via this sandbox helper
 393     // process. Therefore the fontconfig code goes in here directly.
 394
 395     std::string face;
 396     bool is_bold, is_italic;
 397     uint32 charset;
 398
 399     if (!pickle.ReadString(&iter, &face) ||
 400         face.empty() ||
 401         !pickle.ReadBool(&iter, &is_bold) ||
 402         !pickle.ReadBool(&iter, &is_italic) ||
 403         !pickle.ReadUInt32(&iter, &charset)) {
 404       return;
 405     }
 406
 407     FcLangSet* langset = FcLangSetCreate();
 408     MSCharSetToFontconfig(langset, charset);
 409
 410     FcPattern* pattern = FcPatternCreate();
 411     // TODO(agl): FC_FAMILy needs to change
 412     FcPatternAddString(pattern, FC_FAMILY, (FcChar8*) face.c_str());
 413     if (is_bold)
 414       FcPatternAddInteger(pattern, FC_WEIGHT, FC_WEIGHT_BOLD);
 415     if (is_italic)
 416       FcPatternAddInteger(pattern, FC_SLANT, FC_SLANT_ITALIC);
 417     FcPatternAddLangSet(pattern, FC_LANG, langset);
 418     FcPatternAddBool(pattern, FC_SCALABLE, FcTrue);
 419     FcConfigSubstitute(NULL, pattern, FcMatchPattern);
 420     FcDefaultSubstitute(pattern);
 421
 422     FcResult result;
 423     FcFontSet* font_set = FcFontSort(0, pattern, 0, 0, &result);
 424     int font_fd = -1;
 425     int good_enough_index = -1;
 426     bool good_enough_index_set = false;
 427
 428     if (font_set) {
 429       for (int i = 0; i < font_set->nfont; ++i) {
 430         FcPattern* current = font_set->fonts[i];
 431
 432         // Older versions of fontconfig have a bug where they cannot select
 433         // only scalable fonts so we have to manually filter the results.
 434         FcBool is_scalable;
 435         if (FcPatternGetBool(current, FC_SCALABLE, 0,
 436                              &is_scalable) != FcResultMatch ||
 437             !is_scalable) {
 438           continue;
 439         }
 440
 441         FcChar8* c_filename;
 442         if (FcPatternGetString(current, FC_FILE, 0, &c_filename) !=
 443             FcResultMatch) {
 444           continue;
 445         }
 446
 447         // We only want to return sfnt (TrueType) based fonts. We don't have a
 448         // very good way of detecting this so we'll filter based on the
 449         // filename.
 450         bool is_sfnt = false;
 451         static const char kSFNTExtensions[][5] = {
 452           ".ttf", ".otc", ".TTF", ".ttc", ""
 453         };
 454         const size_t filename_len = strlen(reinterpret_cast<char*>(c_filename));
 455         for (unsigned j = 0; ; j++) {
 456           if (kSFNTExtensions[j][0] == 0) {
 457             // None of the extensions matched.
 458             break;
 459           }
 460           const size_t ext_len = strlen(kSFNTExtensions[j]);
 461           if (filename_len > ext_len &&
 462               memcmp(c_filename + filename_len - ext_len,
 463                      kSFNTExtensions[j], ext_len) == 0) {
 464             is_sfnt = true;
 465             break;
 466           }
 467         }
 468
 469         if (!is_sfnt)
 470           continue;
 471
 472         // This font is good enough to pass muster, but we might be able to do
 473         // better with subsequent ones.
 474         if (!good_enough_index_set) {
 475           good_enough_index = i;
 476           good_enough_index_set = true;
 477         }
 478
 479         FcValue matrix;
 480         bool have_matrix = FcPatternGet(current, FC_MATRIX, 0, &matrix) == 0;
 481
 482         if (is_italic && have_matrix) {
 483           // we asked for an italic font, but fontconfig is giving us a
 484           // non-italic font with a transformation matrix.
 485           continue;
 486         }
 487
 488         FcValue embolden;
 489         const bool have_embolden =
 490             FcPatternGet(current, FC_EMBOLDEN, 0, &embolden) == 0;
 491
 492         if (is_bold && have_embolden) {
 493           // we asked for a bold font, but fontconfig gave us a non-bold font
 494           // and asked us to apply fake bolding.
 495           continue;
 496         }
 497
 498         font_fd = open(reinterpret_cast<char*>(c_filename), O_RDONLY);
 499         if (font_fd >= 0)
 500           break;
 501       }
 502     }
 503
 504     if (font_fd == -1 && good_enough_index_set) {
 505       // We didn't find a font that we liked, so we fallback to something
 506       // acceptable.
 507       FcPattern* current = font_set->fonts[good_enough_index];
 508       FcChar8* c_filename;
 509       FcPatternGetString(current, FC_FILE, 0, &c_filename);
 510       font_fd = open(reinterpret_cast<char*>(c_filename), O_RDONLY);
 511     }
 512
 513     if (font_set)
 514       FcFontSetDestroy(font_set);
 515     FcPatternDestroy(pattern);
 516
 517     Pickle reply;
 518     SendRendererReply(fds, reply, font_fd);
 519
 520     if (font_fd >= 0) {
 521       if (IGNORE_EINTR(close(font_fd)) < 0)
 522         PLOG(ERROR) << "close";
 523     }
 524   }
 525
 526   // MSCharSetToFontconfig translates a Microsoft charset identifier to a
 527   // fontconfig language set by appending to |langset|.
 528   static void MSCharSetToFontconfig(FcLangSet* langset, unsigned fdwCharSet) {
 529     // We have need to translate raw fdwCharSet values into terms that
 530     // fontconfig can understand. (See the description of fdwCharSet in the MSDN
 531     // documentation for CreateFont:
 532     // http://msdn.microsoft.com/en-us/library/dd183499(VS.85).aspx )
 533     //
 534     // Although the argument is /called/ 'charset', the actual values conflate
 535     // character sets (which are sets of Unicode code points) and character
 536     // encodings (which are algorithms for turning a series of bits into a
 537     // series of code points.) Sometimes the values will name a language,
 538     // sometimes they'll name an encoding. In the latter case I'm assuming that
 539     // they mean the set of code points in the domain of that encoding.
 540     //
 541     // fontconfig deals with ISO 639-1 language codes:
 542     //   http://en.wikipedia.org/wiki/List_of_ISO_639-1_codes
 543     //
 544     // So, for each of the documented fdwCharSet values I've had to take a
 545     // guess at the set of ISO 639-1 languages intended.
 546
 547     switch (fdwCharSet) {
 548       case NPCharsetAnsi:
 549       // These values I don't really know what to do with, so I'm going to map
 550       // them to English also.
 551       case NPCharsetDefault:
 552       case NPCharsetMac:
 553       case NPCharsetOEM:
 554       case NPCharsetSymbol:
 555         FcLangSetAdd(langset, reinterpret_cast<const FcChar8*>("en"));
 556         break;
 557       case NPCharsetBaltic:
 558         // The three baltic languages.
 559         FcLangSetAdd(langset, reinterpret_cast<const FcChar8*>("et"));
 560         FcLangSetAdd(langset, reinterpret_cast<const FcChar8*>("lv"));
 561         FcLangSetAdd(langset, reinterpret_cast<const FcChar8*>("lt"));
 562         break;
 563       // TODO(jungshik): Would we be better off mapping Big5 to zh-tw
 564       // and GB2312 to zh-cn? Fontconfig has 4 separate orthography
 565       // files (zh-{cn,tw,hk,mo}.
 566       case NPCharsetChineseBIG5:
 567       case NPCharsetGB2312:
 568         FcLangSetAdd(langset, reinterpret_cast<const FcChar8*>("zh"));
 569         break;
 570       case NPCharsetEastEurope:
 571         // A scattering of eastern European languages.
 572         FcLangSetAdd(langset, reinterpret_cast<const FcChar8*>("pl"));
 573         FcLangSetAdd(langset, reinterpret_cast<const FcChar8*>("cs"));
 574         FcLangSetAdd(langset, reinterpret_cast<const FcChar8*>("sk"));
 575         FcLangSetAdd(langset, reinterpret_cast<const FcChar8*>("hu"));
 576         FcLangSetAdd(langset, reinterpret_cast<const FcChar8*>("hr"));
 577         break;
 578       case NPCharsetGreek:
 579         FcLangSetAdd(langset, reinterpret_cast<const FcChar8*>("el"));
 580         break;
 581       case NPCharsetHangul:
 582       case NPCharsetJohab:
 583         // Korean
 584         FcLangSetAdd(langset, reinterpret_cast<const FcChar8*>("ko"));
 585         break;
 586       case NPCharsetRussian:
 587         FcLangSetAdd(langset, reinterpret_cast<const FcChar8*>("ru"));
 588         break;
 589       case NPCharsetShiftJIS:
 590         // Japanese
 591         FcLangSetAdd(langset, reinterpret_cast<const FcChar8*>("ja"));
 592         break;
 593       case NPCharsetTurkish:
 594         FcLangSetAdd(langset, reinterpret_cast<const FcChar8*>("tr"));
 595         break;
 596       case NPCharsetVietnamese:
 597         FcLangSetAdd(langset, reinterpret_cast<const FcChar8*>("vi"));
 598         break;
 599       case NPCharsetArabic:
 600         FcLangSetAdd(langset, reinterpret_cast<const FcChar8*>("ar"));
 601         break;
 602       case NPCharsetHebrew:
 603         FcLangSetAdd(langset, reinterpret_cast<const FcChar8*>("he"));
 604         break;
 605       case NPCharsetThai:
 606         FcLangSetAdd(langset, reinterpret_cast<const FcChar8*>("th"));
 607         break;
 608       // default:
 609       // Don't add any languages in that case that we don't recognise the
 610       // constant.
 611     }
 612   }
 613
 614   void SendRendererReply(const std::vector<int>& fds, const Pickle& reply,
 615                          int reply_fd) {
 616     struct msghdr msg;
 617     memset(&msg, 0, sizeof(msg));
 618     struct iovec iov = {const_cast<void*>(reply.data()), reply.size()};
 619     msg.msg_iov = &iov;
 620     msg.msg_iovlen = 1;
 621
 622     char control_buffer[CMSG_SPACE(sizeof(int))];
 623
 624     if (reply_fd != -1) {
 625       struct stat st;
 626       if (fstat(reply_fd, &st) == 0 && S_ISDIR(st.st_mode)) {
 627         LOG(FATAL) << "Tried to send a directory descriptor over sandbox IPC";
 628         // We must never send directory descriptors to a sandboxed process
 629         // because they can use openat with ".." elements in the path in order
 630         // to escape the sandbox and reach the real filesystem.
 631       }
 632
 633       struct cmsghdr *cmsg;
 634       msg.msg_control = control_buffer;
 635       msg.msg_controllen = sizeof(control_buffer);
 636       cmsg = CMSG_FIRSTHDR(&msg);
 637       cmsg->cmsg_level = SOL_SOCKET;
 638       cmsg->cmsg_type = SCM_RIGHTS;
 639       cmsg->cmsg_len = CMSG_LEN(sizeof(int));
 640       memcpy(CMSG_DATA(cmsg), &reply_fd, sizeof(reply_fd));
 641       msg.msg_controllen = cmsg->cmsg_len;
 642     }
 643
 644     if (HANDLE_EINTR(sendmsg(fds[0], &msg, MSG_DONTWAIT)) < 0)
 645       PLOG(ERROR) << "sendmsg";
 646   }
 647
 648   // ---------------------------------------------------------------------------
 649
 650   const int lifeline_fd_;
 651   const int browser_socket_;
 652   std::vector<std::string> sandbox_cmd_;
 653   scoped_ptr<WebKitPlatformSupportImpl> webkit_platform_support_;
 654   SkTDArray<SkString*> paths_;
 655 };
 656
 657 SandboxIPCProcess::~SandboxIPCProcess() {
 658   paths_.deleteAll();
 659   if (webkit_platform_support_)
 660     blink::shutdownWithoutV8();
 661 }
 662
 663 void SandboxIPCProcess::EnsureWebKitInitialized() {
 664   if (webkit_platform_support_)
 665     return;
 666   webkit_platform_support_.reset(new WebKitPlatformSupportImpl);
 667   blink::initializeWithoutV8(webkit_platform_support_.get());
 668 }
 669
 670 // -----------------------------------------------------------------------------
 671
 672 // Runs on the main thread at startup.
 673 RenderSandboxHostLinux::RenderSandboxHostLinux()
 674     : initialized_(false),
 675       renderer_socket_(0),
 676       childs_lifeline_fd_(0),
 677       pid_(0) {
 678 }
 679
 680 // static
 681 RenderSandboxHostLinux* RenderSandboxHostLinux::GetInstance() {
 682   return Singleton<RenderSandboxHostLinux>::get();
 683 }
 684
 685 void RenderSandboxHostLinux::Init(const std::string& sandbox_path) {
 686   DCHECK(!initialized_);
 687   initialized_ = true;
 688
 689   int fds[2];
 690   // We use SOCK_SEQPACKET rather than SOCK_DGRAM to prevent the renderer from
 691   // sending datagrams to other sockets on the system. The sandbox may prevent
 692   // the renderer from calling socket() to create new sockets, but it'll still
 693   // inherit some sockets. With PF_UNIX+SOCK_DGRAM, it can call sendmsg to send
 694   // a datagram to any (abstract) socket on the same system. With
 695   // SOCK_SEQPACKET, this is prevented.
 696 #if defined(OS_FREEBSD) || defined(OS_OPENBSD)
 697   // The BSDs often don't support SOCK_SEQPACKET yet, so fall back to
 698   // SOCK_DGRAM if necessary.
 699   if (socketpair(AF_UNIX, SOCK_SEQPACKET, 0, fds) != 0)
 700     CHECK(socketpair(AF_UNIX, SOCK_DGRAM, 0, fds) == 0);
 701 #else
 702   CHECK(socketpair(AF_UNIX, SOCK_SEQPACKET, 0, fds) == 0);
 703 #endif
 704
 705   renderer_socket_ = fds[0];
 706   const int browser_socket = fds[1];
 707
 708   int pipefds[2];
 709   CHECK(0 == pipe(pipefds));
 710   const int child_lifeline_fd = pipefds[0];
 711   childs_lifeline_fd_ = pipefds[1];
 712
 713   // We need to be monothreaded before we fork().
 714 #if !defined(TOOLKIT_GTK) && !defined(THREAD_SANITIZER)
 715   // Exclude gtk port as TestSuite in base/tests/test_suite.cc is calling
 716   // gtk_init.
 717   // TODO(oshima): Remove ifdef when above issues are resolved.
 718   DCHECK_EQ(1, base::GetNumberOfThreads(base::GetCurrentProcessHandle()));
 719 #endif  // !defined(TOOLKIT_GTK) && !defined(THREAD_SANITIZER)
 720   pid_ = fork();
 721   if (pid_ == 0) {
 722     if (IGNORE_EINTR(close(fds[0])) < 0)
 723       DPLOG(ERROR) << "close";
 724     if (IGNORE_EINTR(close(pipefds[1])) < 0)
 725       DPLOG(ERROR) << "close";
 726
 727     SandboxIPCProcess handler(child_lifeline_fd, browser_socket, sandbox_path);
 728     handler.Run();
 729     _exit(0);
 730   }
 731 }
 732
 733 RenderSandboxHostLinux::~RenderSandboxHostLinux() {
 734   if (initialized_) {
 735     if (IGNORE_EINTR(close(renderer_socket_)) < 0)
 736       PLOG(ERROR) << "close";
 737     if (IGNORE_EINTR(close(childs_lifeline_fd_)) < 0)
 738       PLOG(ERROR) << "close";
 739   }
 740 }
 741
 742 }  // namespace content