Linux: don't bother passing the chroot directory fd to the zygote.

sandbox/linux/suid/sandbox.cc

 // Copyright (c) 2009 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // http://code.google.com/p/chromium/wiki/LinuxSUIDSandbox
 
 #include <asm/unistd.h>
 #include <errno.h>
 #include <fcntl.h>
 #include <sched.h>
@@ skipping 60 matching lines @@
     if (!temp_dir)
       FatalError("Failed to create temp directory for chroot");
 
     const int chroot_dir_fd = open(temp_dir, O_DIRECTORY | O_RDONLY);
     if (chroot_dir_fd < 0) {
       rmdir(temp_dir);
       FatalError("Failed to open chroot temp directory");
     }
 
     rmdir(temp_dir);
-    fchown(chroot_dir_fd, 0, 0);
-    fchmod(chroot_dir_fd, 0555);
+    fchown(chroot_dir_fd, 0 /* root */, 0 /* root */);
 
     // We share our files structure with an untrusted process. As a security in
     // depth measure, we make sure that we can't open anything by mistake.
     // TODO: drop CAP_SYS_RESOURCE
 
     const struct rlimit nofile = {0, 0};
     if (setrlimit(RLIMIT_NOFILE, &nofile))
       FatalError("Setting RLIMIT_NOFILE");
 
     if (close(sv[1]))
       FatalError("close");
 
     char msg;
     ssize_t bytes;
     do {
       bytes = read(sv[0], &msg, 1);
     } while (bytes == -1 && errno == EINTR);
 
     if (bytes == 0)
       _exit(0);
     if (bytes != 1)
       FatalError("read");
 
     if (msg != kMsgChrootMe)
       FatalError("Unknown message from sandboxed process");
 
     if (fchdir(chroot_dir_fd))
       FatalError("Cannot chdir into chroot temp directory");
+    fchmod(chroot_dir_fd, 0000 /* no-access */);
 
     struct stat st;
     if (stat(".", &st))
       FatalError("stat");
 
     if (st.st_uid || st.st_gid || st.st_mode & S_IWOTH)
       FatalError("Bad permissions on chroot temp directory");
 
     if (chroot("."))
       FatalError("Cannot chroot into temp directory");
 
     if (chdir("/"))
       FatalError("Cannot chdir to / after chroot");
 
     const char reply = kMsgChrootSuccessful;
     do {
-      struct msghdr msg = {0};
-      struct iovec iov = {(char *) &reply, 1};
-
-      msg.msg_iov = &iov;
-      msg.msg_iovlen = 1;
-
-      char control_buffer[CMSG_SPACE(sizeof(int))];
-      msg.msg_control = control_buffer;
-      msg.msg_controllen = sizeof(control_buffer);
-      struct cmsghdr* cmsg = CMSG_FIRSTHDR(&msg);
-      cmsg->cmsg_level = SOL_SOCKET;
-      cmsg->cmsg_type = SCM_RIGHTS;
-      cmsg->cmsg_len = CMSG_LEN(sizeof(int));
-      memcpy(CMSG_DATA(cmsg), &chroot_dir_fd, sizeof(int));
-      msg.msg_controllen = cmsg->cmsg_len;
-
-      bytes = sendmsg(sv[0], &msg, 0);
+      bytes = write(sv[0], &reply, 1);
     } while (bytes == -1 && errno == EINTR);
 
     if (bytes != 1)
       FatalError("Writing reply");
 
     _exit(0);
   }
 
   if (close(sv[0])) {
     close(sv[1]);
@@ skipping 96 matching lines @@
   if (!SpawnChrootHelper())
     return 1;
   if (!DropRoot())
     return 1;
 
   execv(argv[1], &argv[1]);
   FatalError("execv failed");
 
   return 1;
 }