1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. 2 // Use of this source code is governed by a BSD-style license that can be 3 // found in the LICENSE file. 4 5 #ifndef DBUS_FILE_DESCRIPTOR_H_ 6 #define DBUS_FILE_DESCRIPTOR_H_ 7 8 #include "base/memory/scoped_ptr.h" 9 #include "base/move.h" 10 #include "dbus/dbus_export.h" 11 12 namespace dbus { 13 14 // FileDescriptor is a type used to encapsulate D-Bus file descriptors 15 // and to follow the RAII idiom appropiate for use with message operations 16 // where the descriptor might be easily leaked. To guard against this the 17 // descriptor is closed when an instance is destroyed if it is owned. 18 // Ownership is asserted only when PutValue is used and TakeValue can be 19 // used to take ownership. 20 // 21 // For example, in the following 22 // FileDescriptor fd; 23 // if (!reader->PopString(&name) || 24 // !reader->PopFileDescriptor(&fd) || 25 // !reader->PopUint32(&flags)) { 26 // the descriptor in fd will be closed if the PopUint32 fails. But 27 // writer.AppendFileDescriptor(dbus::FileDescriptor(1)); 28 // will not automatically close "1" because it is not owned. 29 // 30 // Descriptors must be validated before marshalling in a D-Bus message 31 // or using them after unmarshalling. We disallow descriptors to a 32 // directory to reduce the security risks. Splitting out validation 33 // also allows the caller to do this work on the File thread to conform 34 // with i/o restrictions. 35 class CHROME_DBUS_EXPORT FileDescriptor { 36 MOVE_ONLY_TYPE_FOR_CPP_03(FileDescriptor); 37 38 public: 39 // This provides a simple way to pass around file descriptors since they must 40 // be closed on a thread that is allowed to perform I/O. 41 struct Deleter { 42 void CHROME_DBUS_EXPORT operator()(FileDescriptor* fd); 43 }; 44 45 // Permits initialization without a value for passing to 46 // dbus::MessageReader::PopFileDescriptor to fill in and from int values. FileDescriptor()47 FileDescriptor() : value_(-1), owner_(false), valid_(false) {} FileDescriptor(int value)48 explicit FileDescriptor(int value) : value_(value), owner_(false), 49 valid_(false) {} 50 51 FileDescriptor(FileDescriptor&& other); 52 53 virtual ~FileDescriptor(); 54 55 FileDescriptor& operator=(FileDescriptor&& other); 56 57 // Retrieves value as an int without affecting ownership. 58 int value() const; 59 60 // Retrieves whether or not the descriptor is ok to send/receive. is_valid()61 int is_valid() const { return valid_; } 62 63 // Sets the value and assign ownership. PutValue(int value)64 void PutValue(int value) { 65 value_ = value; 66 owner_ = true; 67 valid_ = false; 68 } 69 70 // Takes the value and ownership. 71 int TakeValue(); 72 73 // Checks (and records) validity of the file descriptor. 74 // We disallow directories to avoid potential sandbox escapes. 75 // Note this call must be made on a thread where file i/o is allowed. 76 void CheckValidity(); 77 78 private: 79 void Swap(FileDescriptor* other); 80 81 int value_; 82 bool owner_; 83 bool valid_; 84 }; 85 86 using ScopedFileDescriptor = 87 scoped_ptr<FileDescriptor, FileDescriptor::Deleter>; 88 89 } // namespace dbus 90 91 #endif // DBUS_FILE_DESCRIPTOR_H_ 92