1                 : /*
       2                 :  * Copyright 2010 The Native Client Authors.  All rights reserved.
       3                 :  * Use of this source code is governed by a BSD-style license that can
       4                 :  * be found in the LICENSE file.
       5                 :  */
       6                 : 
       7                 : #include <sandbox.h>
       8                 : 
       9                 : #include "native_client/src/shared/platform/nacl_log.h"
      10                 : #include "native_client/src/trusted/service_runtime/outer_sandbox.h"
      11                 : 
      12                 : 
      13                 : /* This is a small subset of Chromium's chrome/common/common.sb. */
      14                 : const char *sandbox_profile =
      15                 :   "(version 1)"
      16                 :   "(deny default)"
      17                 :   /*
      18                 :    * This allows abort() to work.  Without this, abort()'s raise()
      19                 :    * syscall fails, and its attempt to die by using an undefined
      20                 :    * instruction hangs the process.  See http://crbug.com/20370
      21                 :    */
      22                 :   "(allow signal (target self))"
      23                 :   /*
      24                 :    * Allow use of semaphores: sem_init() etc.  This is required on
      25                 :    * OS X 10.6 but not on 10.5.
      26                 :    */
      27                 :   "(allow ipc-posix-sem)"
      28                 :   /*
      29                 :    * Allow shared memory segments to be created: shm_open() etc.  This
      30                 :    * is required on OS X 10.6 but not on 10.5.
      31                 :    */
      32                 :   "(allow ipc-posix-shm)";
      33                 : 
      34                 : 
      35                 : void NaClEnableOuterSandbox(void) {
      36               0 :   char *error;
      37               0 :   int rc = sandbox_init(sandbox_profile, 0, &error);
      38               0 :   if (rc != 0) {
      39               0 :     NaClLog(LOG_FATAL, "Failed to initialise Mac OS X sandbox: %s\n", error);
      40               0 :   }
      41               0 : }