| OLD | NEW |
|---|
| (Empty) |
| 1 // Copyright (c) 2010 The Chromium Authors. All rights reserved. | |
| 2 // Use of this source code is governed by a BSD-style license that can be | |
| 3 // found in the LICENSE file. | |
| 4 | |
| 5 #include <dlfcn.h> | |
| 6 #include <fcntl.h> | |
| 7 #include <pthread.h> | |
| 8 #include <sys/epoll.h> | |
| 9 #include <sys/prctl.h> | |
| 10 #include <sys/signal.h> | |
| 11 #include <sys/socket.h> | |
| 12 #include <sys/stat.h> | |
| 13 #include <sys/types.h> | |
| 14 #include <sys/wait.h> | |
| 15 #include <unistd.h> | |
| 16 | |
| 17 #if defined(CHROMIUM_SELINUX) | |
| 18 #include <selinux/selinux.h> | |
| 19 #include <selinux/context.h> | |
| 20 #endif | |
| 21 | |
| 22 #include "base/basictypes.h" | |
| 23 #include "base/command_line.h" | |
| 24 #include "base/eintr_wrapper.h" | |
| 25 #include "base/file_path.h" | |
| 26 #include "base/global_descriptors_posix.h" | |
| 27 #include "base/hash_tables.h" | |
| 28 #include "base/linux_util.h" | |
| 29 #include "base/path_service.h" | |
| 30 #include "base/pickle.h" | |
| 31 #include "base/process_util.h" | |
| 32 #include "base/rand_util.h" | |
| 33 #include "base/scoped_ptr.h" | |
| 34 #include "base/sys_info.h" | |
| 35 #include "build/build_config.h" | |
| 36 #include "chrome/browser/zygote_host_linux.h" | |
| 37 #include "chrome/common/chrome_descriptors.h" | |
| 38 #include "chrome/common/chrome_switches.h" | |
| 39 #include "chrome/common/font_config_ipc_linux.h" | |
| 40 #include "chrome/common/main_function_params.h" | |
| 41 #include "chrome/common/pepper_plugin_registry.h" | |
| 42 #include "chrome/common/process_watcher.h" | |
| 43 #include "chrome/common/result_codes.h" | |
| 44 #include "chrome/common/sandbox_methods_linux.h" | |
| 45 #include "chrome/common/set_process_title.h" | |
| 46 #include "chrome/common/unix_domain_socket_posix.h" | |
| 47 #include "media/base/media.h" | |
| 48 #include "seccompsandbox/sandbox.h" | |
| 49 #include "skia/ext/SkFontHost_fontconfig_control.h" | |
| 50 #include "unicode/timezone.h" | |
| 51 | |
| 52 #if defined(ARCH_CPU_X86_FAMILY) && !defined(CHROMIUM_SELINUX) && \ | |
| 53 !defined(__clang__) | |
| 54 // The seccomp sandbox is enabled on all ia32 and x86-64 processor as long as | |
| 55 // we aren't using SELinux or clang. | |
| 56 #define SECCOMP_SANDBOX | |
| 57 #endif | |
| 58 | |
| 59 // http://code.google.com/p/chromium/wiki/LinuxZygote | |
| 60 | |
| 61 static const int kBrowserDescriptor = 3; | |
| 62 static const int kMagicSandboxIPCDescriptor = 5; | |
| 63 static const int kZygoteIdDescriptor = 7; | |
| 64 static bool g_suid_sandbox_active = false; | |
| 65 #if defined(SECCOMP_SANDBOX) | |
| 66 // |g_proc_fd| is used only by the seccomp sandbox. | |
| 67 static int g_proc_fd = -1; | |
| 68 #endif | |
| 69 | |
| 70 #if defined(CHROMIUM_SELINUX) | |
| 71 static void SELinuxTransitionToTypeOrDie(const char* type) { | |
| 72 security_context_t security_context; | |
| 73 if (getcon(&security_context)) | |
| 74 LOG(FATAL) << "Cannot get SELinux context"; | |
| 75 | |
| 76 context_t context = context_new(security_context); | |
| 77 context_type_set(context, type); | |
| 78 const int r = setcon(context_str(context)); | |
| 79 context_free(context); | |
| 80 freecon(security_context); | |
| 81 | |
| 82 if (r) { | |
| 83 LOG(FATAL) << "dynamic transition to type '" << type << "' failed. " | |
| 84 "(this binary has been built with SELinux support, but maybe " | |
| 85 "the policies haven't been loaded into the kernel?)"; | |
| 86 } | |
| 87 } | |
| 88 #endif // CHROMIUM_SELINUX | |
| 89 | |
| 90 // This is the object which implements the zygote. The ZygoteMain function, | |
| 91 // which is called from ChromeMain, simply constructs one of these objects and | |
| 92 // runs it. | |
| 93 class Zygote { | |
| 94 public: | |
| 95 explicit Zygote(int sandbox_flags) | |
| 96 : sandbox_flags_(sandbox_flags) { | |
| 97 } | |
| 98 | |
| 99 bool ProcessRequests() { | |
| 100 // A SOCK_SEQPACKET socket is installed in fd 3. We get commands from the | |
| 101 // browser on it. | |
| 102 // A SOCK_DGRAM is installed in fd 5. This is the sandbox IPC channel. | |
| 103 // See http://code.google.com/p/chromium/wiki/LinuxSandboxIPC | |
| 104 | |
| 105 // We need to accept SIGCHLD, even though our handler is a no-op because | |
| 106 // otherwise we cannot wait on children. (According to POSIX 2001.) | |
| 107 struct sigaction action; | |
| 108 memset(&action, 0, sizeof(action)); | |
| 109 action.sa_handler = SIGCHLDHandler; | |
| 110 CHECK(sigaction(SIGCHLD, &action, NULL) == 0); | |
| 111 | |
| 112 if (g_suid_sandbox_active) { | |
| 113 // Let the ZygoteHost know we are ready to go. | |
| 114 // The receiving code is in chrome/browser/zygote_host_linux.cc. | |
| 115 std::vector<int> empty; | |
| 116 bool r = UnixDomainSocket::SendMsg(kBrowserDescriptor, kZygoteMagic, | |
| 117 sizeof(kZygoteMagic), empty); | |
| 118 CHECK(r) << "Sending zygote magic failed"; | |
| 119 } | |
| 120 | |
| 121 for (;;) { | |
| 122 // This function call can return multiple times, once per fork(). | |
| 123 if (HandleRequestFromBrowser(kBrowserDescriptor)) | |
| 124 return true; | |
| 125 } | |
| 126 } | |
| 127 | |
| 128 private: | |
| 129 // See comment below, where sigaction is called. | |
| 130 static void SIGCHLDHandler(int signal) { } | |
| 131 | |
| 132 // --------------------------------------------------------------------------- | |
| 133 // Requests from the browser... | |
| 134 | |
| 135 // Read and process a request from the browser. Returns true if we are in a | |
| 136 // new process and thus need to unwind back into ChromeMain. | |
| 137 bool HandleRequestFromBrowser(int fd) { | |
| 138 std::vector<int> fds; | |
| 139 static const unsigned kMaxMessageLength = 1024; | |
| 140 char buf[kMaxMessageLength]; | |
| 141 const ssize_t len = UnixDomainSocket::RecvMsg(fd, buf, sizeof(buf), &fds); | |
| 142 | |
| 143 if (len == 0 || (len == -1 && errno == ECONNRESET)) { | |
| 144 // EOF from the browser. We should die. | |
| 145 _exit(0); | |
| 146 return false; | |
| 147 } | |
| 148 | |
| 149 if (len == -1) { | |
| 150 PLOG(ERROR) << "Error reading message from browser"; | |
| 151 return false; | |
| 152 } | |
| 153 | |
| 154 Pickle pickle(buf, len); | |
| 155 void* iter = NULL; | |
| 156 | |
| 157 int kind; | |
| 158 if (pickle.ReadInt(&iter, &kind)) { | |
| 159 switch (kind) { | |
| 160 case ZygoteHost::kCmdFork: | |
| 161 // This function call can return multiple times, once per fork(). | |
| 162 return HandleForkRequest(fd, pickle, iter, fds); | |
| 163 case ZygoteHost::kCmdReap: | |
| 164 if (!fds.empty()) | |
| 165 break; | |
| 166 HandleReapRequest(fd, pickle, iter); | |
| 167 return false; | |
| 168 case ZygoteHost::kCmdGetTerminationStatus: | |
| 169 if (!fds.empty()) | |
| 170 break; | |
| 171 HandleGetTerminationStatus(fd, pickle, iter); | |
| 172 return false; | |
| 173 case ZygoteHost::kCmdGetSandboxStatus: | |
| 174 HandleGetSandboxStatus(fd, pickle, iter); | |
| 175 return false; | |
| 176 default: | |
| 177 NOTREACHED(); | |
| 178 break; | |
| 179 } | |
| 180 } | |
| 181 | |
| 182 LOG(WARNING) << "Error parsing message from browser"; | |
| 183 for (std::vector<int>::const_iterator | |
| 184 i = fds.begin(); i != fds.end(); ++i) | |
| 185 close(*i); | |
| 186 return false; | |
| 187 } | |
| 188 | |
| 189 void HandleReapRequest(int fd, const Pickle& pickle, void* iter) { | |
| 190 base::ProcessId child; | |
| 191 base::ProcessId actual_child; | |
| 192 | |
| 193 if (!pickle.ReadInt(&iter, &child)) { | |
| 194 LOG(WARNING) << "Error parsing reap request from browser"; | |
| 195 return; | |
| 196 } | |
| 197 | |
| 198 if (g_suid_sandbox_active) { | |
| 199 actual_child = real_pids_to_sandbox_pids[child]; | |
| 200 if (!actual_child) | |
| 201 return; | |
| 202 real_pids_to_sandbox_pids.erase(child); | |
| 203 } else { | |
| 204 actual_child = child; | |
| 205 } | |
| 206 | |
| 207 ProcessWatcher::EnsureProcessTerminated(actual_child); | |
| 208 } | |
| 209 | |
| 210 void HandleGetTerminationStatus(int fd, const Pickle& pickle, void* iter) { | |
| 211 base::ProcessHandle child; | |
| 212 | |
| 213 if (!pickle.ReadInt(&iter, &child)) { | |
| 214 LOG(WARNING) << "Error parsing GetTerminationStatus request " | |
| 215 << "from browser"; | |
| 216 return; | |
| 217 } | |
| 218 | |
| 219 base::TerminationStatus status; | |
| 220 int exit_code; | |
| 221 if (g_suid_sandbox_active) | |
| 222 child = real_pids_to_sandbox_pids[child]; | |
| 223 if (child) { | |
| 224 status = base::GetTerminationStatus(child, &exit_code); | |
| 225 } else { | |
| 226 // Assume that if we can't find the child in the sandbox, then | |
| 227 // it terminated normally. | |
| 228 status = base::TERMINATION_STATUS_NORMAL_TERMINATION; | |
| 229 exit_code = ResultCodes::NORMAL_EXIT; | |
| 230 } | |
| 231 | |
| 232 Pickle write_pickle; | |
| 233 write_pickle.WriteInt(static_cast<int>(status)); | |
| 234 write_pickle.WriteInt(exit_code); | |
| 235 ssize_t written = | |
| 236 HANDLE_EINTR(write(fd, write_pickle.data(), write_pickle.size())); | |
| 237 if (written != static_cast<ssize_t>(write_pickle.size())) | |
| 238 PLOG(ERROR) << "write"; | |
| 239 } | |
| 240 | |
| 241 // This is equivalent to fork(), except that, when using the SUID | |
| 242 // sandbox, it returns the real PID of the child process as it | |
| 243 // appears outside the sandbox, rather than returning the PID inside | |
| 244 // the sandbox. | |
| 245 int ForkWithRealPid() { | |
| 246 if (!g_suid_sandbox_active) | |
| 247 return fork(); | |
| 248 | |
| 249 int dummy_fd; | |
| 250 ino_t dummy_inode; | |
| 251 int pipe_fds[2] = { -1, -1 }; | |
| 252 base::ProcessId pid = 0; | |
| 253 | |
| 254 dummy_fd = socket(PF_UNIX, SOCK_DGRAM, 0); | |
| 255 if (dummy_fd < 0) { | |
| 256 LOG(ERROR) << "Failed to create dummy FD"; | |
| 257 goto error; | |
| 258 } | |
| 259 if (!base::FileDescriptorGetInode(&dummy_inode, dummy_fd)) { | |
| 260 LOG(ERROR) << "Failed to get inode for dummy FD"; | |
| 261 goto error; | |
| 262 } | |
| 263 if (pipe(pipe_fds) != 0) { | |
| 264 LOG(ERROR) << "Failed to create pipe"; | |
| 265 goto error; | |
| 266 } | |
| 267 | |
| 268 pid = fork(); | |
| 269 if (pid < 0) { | |
| 270 goto error; | |
| 271 } else if (pid == 0) { | |
| 272 // In the child process. | |
| 273 close(pipe_fds[1]); | |
| 274 char buffer[1]; | |
| 275 // Wait until the parent process has discovered our PID. We | |
| 276 // should not fork any child processes (which the seccomp | |
| 277 // sandbox does) until then, because that can interfere with the | |
| 278 // parent's discovery of our PID. | |
| 279 if (HANDLE_EINTR(read(pipe_fds[0], buffer, 1)) != 1 || | |
| 280 buffer[0] != 'x') { | |
| 281 LOG(FATAL) << "Failed to synchronise with parent zygote process"; | |
| 282 } | |
| 283 close(pipe_fds[0]); | |
| 284 close(dummy_fd); | |
| 285 return 0; | |
| 286 } else { | |
| 287 // In the parent process. | |
| 288 close(dummy_fd); | |
| 289 dummy_fd = -1; | |
| 290 close(pipe_fds[0]); | |
| 291 pipe_fds[0] = -1; | |
| 292 uint8_t reply_buf[512]; | |
| 293 Pickle request; | |
| 294 request.WriteInt(LinuxSandbox::METHOD_GET_CHILD_WITH_INODE); | |
| 295 request.WriteUInt64(dummy_inode); | |
| 296 | |
| 297 const ssize_t r = UnixDomainSocket::SendRecvMsg( | |
| 298 kMagicSandboxIPCDescriptor, reply_buf, sizeof(reply_buf), NULL, | |
| 299 request); | |
| 300 if (r == -1) { | |
| 301 LOG(ERROR) << "Failed to get child process's real PID"; | |
| 302 goto error; | |
| 303 } | |
| 304 | |
| 305 base::ProcessId real_pid; | |
| 306 Pickle reply(reinterpret_cast<char*>(reply_buf), r); | |
| 307 void* iter2 = NULL; | |
| 308 if (!reply.ReadInt(&iter2, &real_pid)) | |
| 309 goto error; | |
| 310 if (real_pid <= 0) { | |
| 311 // METHOD_GET_CHILD_WITH_INODE failed. Did the child die already? | |
| 312 LOG(ERROR) << "METHOD_GET_CHILD_WITH_INODE failed"; | |
| 313 goto error; | |
| 314 } | |
| 315 real_pids_to_sandbox_pids[real_pid] = pid; | |
| 316 if (HANDLE_EINTR(write(pipe_fds[1], "x", 1)) != 1) { | |
| 317 LOG(ERROR) << "Failed to synchronise with child process"; | |
| 318 goto error; | |
| 319 } | |
| 320 close(pipe_fds[1]); | |
| 321 return real_pid; | |
| 322 } | |
| 323 | |
| 324 error: | |
| 325 if (pid > 0) { | |
| 326 if (waitpid(pid, NULL, WNOHANG) == -1) | |
| 327 LOG(ERROR) << "Failed to wait for process"; | |
| 328 } | |
| 329 if (dummy_fd >= 0) | |
| 330 close(dummy_fd); | |
| 331 if (pipe_fds[0] >= 0) | |
| 332 close(pipe_fds[0]); | |
| 333 if (pipe_fds[1] >= 0) | |
| 334 close(pipe_fds[1]); | |
| 335 return -1; | |
| 336 } | |
| 337 | |
| 338 // Handle a 'fork' request from the browser: this means that the browser | |
| 339 // wishes to start a new renderer. | |
| 340 bool HandleForkRequest(int fd, const Pickle& pickle, void* iter, | |
| 341 std::vector<int>& fds) { | |
| 342 std::vector<std::string> args; | |
| 343 int argc, numfds; | |
| 344 base::GlobalDescriptors::Mapping mapping; | |
| 345 base::ProcessId child; | |
| 346 | |
| 347 if (!pickle.ReadInt(&iter, &argc)) | |
| 348 goto error; | |
| 349 | |
| 350 for (int i = 0; i < argc; ++i) { | |
| 351 std::string arg; | |
| 352 if (!pickle.ReadString(&iter, &arg)) | |
| 353 goto error; | |
| 354 args.push_back(arg); | |
| 355 } | |
| 356 | |
| 357 if (!pickle.ReadInt(&iter, &numfds)) | |
| 358 goto error; | |
| 359 if (numfds != static_cast<int>(fds.size())) | |
| 360 goto error; | |
| 361 | |
| 362 for (int i = 0; i < numfds; ++i) { | |
| 363 base::GlobalDescriptors::Key key; | |
| 364 if (!pickle.ReadUInt32(&iter, &key)) | |
| 365 goto error; | |
| 366 mapping.push_back(std::make_pair(key, fds[i])); | |
| 367 } | |
| 368 | |
| 369 mapping.push_back(std::make_pair( | |
| 370 static_cast<uint32_t>(kSandboxIPCChannel), kMagicSandboxIPCDescriptor)); | |
| 371 | |
| 372 child = ForkWithRealPid(); | |
| 373 | |
| 374 if (!child) { | |
| 375 #if defined(SECCOMP_SANDBOX) | |
| 376 // Try to open /proc/self/maps as the seccomp sandbox needs access to it | |
| 377 if (g_proc_fd >= 0) { | |
| 378 int proc_self_maps = openat(g_proc_fd, "self/maps", O_RDONLY); | |
| 379 if (proc_self_maps >= 0) { | |
| 380 SeccompSandboxSetProcSelfMaps(proc_self_maps); | |
| 381 } | |
| 382 close(g_proc_fd); | |
| 383 g_proc_fd = -1; | |
| 384 } | |
| 385 #endif | |
| 386 | |
| 387 close(kBrowserDescriptor); // our socket from the browser | |
| 388 if (g_suid_sandbox_active) | |
| 389 close(kZygoteIdDescriptor); // another socket from the browser | |
| 390 base::GlobalDescriptors::GetInstance()->Reset(mapping); | |
| 391 | |
| 392 #if defined(CHROMIUM_SELINUX) | |
| 393 SELinuxTransitionToTypeOrDie("chromium_renderer_t"); | |
| 394 #endif | |
| 395 | |
| 396 // Reset the process-wide command line to our new command line. | |
| 397 CommandLine::Reset(); | |
| 398 CommandLine::Init(0, NULL); | |
| 399 CommandLine::ForCurrentProcess()->InitFromArgv(args); | |
| 400 | |
| 401 // Update the process title. The argv was already cached by the call to | |
| 402 // SetProcessTitleFromCommandLine in ChromeMain, so we can pass NULL here | |
| 403 // (we don't have the original argv at this point). | |
| 404 SetProcessTitleFromCommandLine(NULL); | |
| 405 | |
| 406 // The fork() request is handled further up the call stack. | |
| 407 return true; | |
| 408 } else if (child < 0) { | |
| 409 LOG(ERROR) << "Zygote could not fork: " << errno; | |
| 410 goto error; | |
| 411 } | |
| 412 | |
| 413 for (std::vector<int>::const_iterator | |
| 414 i = fds.begin(); i != fds.end(); ++i) | |
| 415 close(*i); | |
| 416 | |
| 417 if (HANDLE_EINTR(write(fd, &child, sizeof(child))) < 0) | |
| 418 PLOG(ERROR) << "write"; | |
| 419 return false; | |
| 420 | |
| 421 error: | |
| 422 LOG(ERROR) << "Error parsing fork request from browser"; | |
| 423 for (std::vector<int>::const_iterator | |
| 424 i = fds.begin(); i != fds.end(); ++i) | |
| 425 close(*i); | |
| 426 return false; | |
| 427 } | |
| 428 | |
| 429 bool HandleGetSandboxStatus(int fd, const Pickle& pickle, void* iter) { | |
| 430 if (HANDLE_EINTR(write(fd, &sandbox_flags_, sizeof(sandbox_flags_)) != | |
| 431 sizeof(sandbox_flags_))) { | |
| 432 PLOG(ERROR) << "write"; | |
| 433 } | |
| 434 | |
| 435 return false; | |
| 436 } | |
| 437 | |
| 438 // In the SUID sandbox, we try to use a new PID namespace. Thus the PIDs | |
| 439 // fork() returns are not the real PIDs, so we need to map the Real PIDS | |
| 440 // into the sandbox PID namespace. | |
| 441 typedef base::hash_map<base::ProcessHandle, base::ProcessHandle> ProcessMap; | |
| 442 ProcessMap real_pids_to_sandbox_pids; | |
| 443 | |
| 444 const int sandbox_flags_; | |
| 445 }; | |
| 446 | |
| 447 // With SELinux we can carve out a precise sandbox, so we don't have to play | |
| 448 // with intercepting libc calls. | |
| 449 #if !defined(CHROMIUM_SELINUX) | |
| 450 | |
| 451 static void ProxyLocaltimeCallToBrowser(time_t input, struct tm* output, | |
| 452 char* timezone_out, | |
| 453 size_t timezone_out_len) { | |
| 454 Pickle request; | |
| 455 request.WriteInt(LinuxSandbox::METHOD_LOCALTIME); | |
| 456 request.WriteString( | |
| 457 std::string(reinterpret_cast<char*>(&input), sizeof(input))); | |
| 458 | |
| 459 uint8_t reply_buf[512]; | |
| 460 const ssize_t r = UnixDomainSocket::SendRecvMsg( | |
| 461 kMagicSandboxIPCDescriptor, reply_buf, sizeof(reply_buf), NULL, request); | |
| 462 if (r == -1) { | |
| 463 memset(output, 0, sizeof(struct tm)); | |
| 464 return; | |
| 465 } | |
| 466 | |
| 467 Pickle reply(reinterpret_cast<char*>(reply_buf), r); | |
| 468 void* iter = NULL; | |
| 469 std::string result, timezone; | |
| 470 if (!reply.ReadString(&iter, &result) || | |
| 471 !reply.ReadString(&iter, &timezone) || | |
| 472 result.size() != sizeof(struct tm)) { | |
| 473 memset(output, 0, sizeof(struct tm)); | |
| 474 return; | |
| 475 } | |
| 476 | |
| 477 memcpy(output, result.data(), sizeof(struct tm)); | |
| 478 if (timezone_out_len) { | |
| 479 const size_t copy_len = std::min(timezone_out_len - 1, timezone.size()); | |
| 480 memcpy(timezone_out, timezone.data(), copy_len); | |
| 481 timezone_out[copy_len] = 0; | |
| 482 output->tm_zone = timezone_out; | |
| 483 } else { | |
| 484 output->tm_zone = NULL; | |
| 485 } | |
| 486 } | |
| 487 | |
| 488 static bool g_am_zygote_or_renderer = false; | |
| 489 | |
| 490 // Sandbox interception of libc calls. | |
| 491 // | |
| 492 // Because we are running in a sandbox certain libc calls will fail (localtime | |
| 493 // being the motivating example - it needs to read /etc/localtime). We need to | |
| 494 // intercept these calls and proxy them to the browser. However, these calls | |
| 495 // may come from us or from our libraries. In some cases we can't just change | |
| 496 // our code. | |
| 497 // | |
| 498 // It's for these cases that we have the following setup: | |
| 499 // | |
| 500 // We define global functions for those functions which we wish to override. | |
| 501 // Since we will be first in the dynamic resolution order, the dynamic linker | |
| 502 // will point callers to our versions of these functions. However, we have the | |
| 503 // same binary for both the browser and the renderers, which means that our | |
| 504 // overrides will apply in the browser too. | |
| 505 // | |
| 506 // The global |g_am_zygote_or_renderer| is true iff we are in a zygote or | |
| 507 // renderer process. It's set in ZygoteMain and inherited by the renderers when | |
| 508 // they fork. (This means that it'll be incorrect for global constructor | |
| 509 // functions and before ZygoteMain is called - beware). | |
| 510 // | |
| 511 // Our replacement functions can check this global and either proxy | |
| 512 // the call to the browser over the sandbox IPC | |
| 513 // (http://code.google.com/p/chromium/wiki/LinuxSandboxIPC) or they can use | |
| 514 // dlsym with RTLD_NEXT to resolve the symbol, ignoring any symbols in the | |
| 515 // current module. | |
| 516 // | |
| 517 // Other avenues: | |
| 518 // | |
| 519 // Our first attempt involved some assembly to patch the GOT of the current | |
| 520 // module. This worked, but was platform specific and doesn't catch the case | |
| 521 // where a library makes a call rather than current module. | |
| 522 // | |
| 523 // We also considered patching the function in place, but this would again by | |
| 524 // platform specific and the above technique seems to work well enough. | |
| 525 | |
| 526 typedef struct tm* (*LocaltimeFunction)(const time_t* timep); | |
| 527 typedef struct tm* (*LocaltimeRFunction)(const time_t* timep, | |
| 528 struct tm* result); | |
| 529 | |
| 530 static pthread_once_t g_libc_localtime_funcs_guard = PTHREAD_ONCE_INIT; | |
| 531 static LocaltimeFunction g_libc_localtime; | |
| 532 static LocaltimeRFunction g_libc_localtime_r; | |
| 533 | |
| 534 static void InitLibcLocaltimeFunctions() { | |
| 535 g_libc_localtime = reinterpret_cast<LocaltimeFunction>( | |
| 536 dlsym(RTLD_NEXT, "localtime")); | |
| 537 g_libc_localtime_r = reinterpret_cast<LocaltimeRFunction>( | |
| 538 dlsym(RTLD_NEXT, "localtime_r")); | |
| 539 | |
| 540 if (!g_libc_localtime || !g_libc_localtime_r) { | |
| 541 // http://code.google.com/p/chromium/issues/detail?id=16800 | |
| 542 // | |
| 543 // Nvidia's libGL.so overrides dlsym for an unknown reason and replaces | |
| 544 // it with a version which doesn't work. In this case we'll get a NULL | |
| 545 // result. There's not a lot we can do at this point, so we just bodge it! | |
| 546 LOG(ERROR) << "Your system is broken: dlsym doesn't work! This has been " | |
| 547 "reported to be caused by Nvidia's libGL. You should expect" | |
| 548 " time related functions to misbehave. " | |
| 549 "http://code.google.com/p/chromium/issues/detail?id=16800"; | |
| 550 } | |
| 551 | |
| 552 if (!g_libc_localtime) | |
| 553 g_libc_localtime = gmtime; | |
| 554 if (!g_libc_localtime_r) | |
| 555 g_libc_localtime_r = gmtime_r; | |
| 556 } | |
| 557 | |
| 558 struct tm* localtime(const time_t* timep) { | |
| 559 if (g_am_zygote_or_renderer) { | |
| 560 static struct tm time_struct; | |
| 561 static char timezone_string[64]; | |
| 562 ProxyLocaltimeCallToBrowser(*timep, &time_struct, timezone_string, | |
| 563 sizeof(timezone_string)); | |
| 564 return &time_struct; | |
| 565 } else { | |
| 566 CHECK_EQ(0, pthread_once(&g_libc_localtime_funcs_guard, | |
| 567 InitLibcLocaltimeFunctions)); | |
| 568 return g_libc_localtime(timep); | |
| 569 } | |
| 570 } | |
| 571 | |
| 572 struct tm* localtime_r(const time_t* timep, struct tm* result) { | |
| 573 if (g_am_zygote_or_renderer) { | |
| 574 ProxyLocaltimeCallToBrowser(*timep, result, NULL, 0); | |
| 575 return result; | |
| 576 } else { | |
| 577 CHECK_EQ(0, pthread_once(&g_libc_localtime_funcs_guard, | |
| 578 InitLibcLocaltimeFunctions)); | |
| 579 return g_libc_localtime_r(timep, result); | |
| 580 } | |
| 581 } | |
| 582 | |
| 583 #endif // !CHROMIUM_SELINUX | |
| 584 | |
| 585 // This function triggers the static and lazy construction of objects that need | |
| 586 // to be created before imposing the sandbox. | |
| 587 static void PreSandboxInit() { | |
| 588 base::RandUint64(); | |
| 589 | |
| 590 base::SysInfo::MaxSharedMemorySize(); | |
| 591 | |
| 592 // ICU DateFormat class (used in base/time_format.cc) needs to get the | |
| 593 // Olson timezone ID by accessing the zoneinfo files on disk. After | |
| 594 // TimeZone::createDefault is called once here, the timezone ID is | |
| 595 // cached and there's no more need to access the file system. | |
| 596 scoped_ptr<icu::TimeZone> zone(icu::TimeZone::createDefault()); | |
| 597 | |
| 598 FilePath module_path; | |
| 599 if (PathService::Get(base::DIR_MODULE, &module_path)) | |
| 600 media::InitializeMediaLibrary(module_path); | |
| 601 | |
| 602 // Ensure access to the Pepper plugins before the sandbox is turned on. | |
| 603 PepperPluginRegistry::PreloadModules(); | |
| 604 } | |
| 605 | |
| 606 #if !defined(CHROMIUM_SELINUX) | |
| 607 static bool EnterSandbox() { | |
| 608 // The SUID sandbox sets this environment variable to a file descriptor | |
| 609 // over which we can signal that we have completed our startup and can be | |
| 610 // chrooted. | |
| 611 const char* const sandbox_fd_string = getenv("SBX_D"); | |
| 612 | |
| 613 if (sandbox_fd_string) { | |
| 614 // Use the SUID sandbox. This still allows the seccomp sandbox to | |
| 615 // be enabled by the process later. | |
| 616 g_suid_sandbox_active = true; | |
| 617 | |
| 618 char* endptr; | |
| 619 const long fd_long = strtol(sandbox_fd_string, &endptr, 10); | |
| 620 if (!*sandbox_fd_string || *endptr || fd_long < 0 || fd_long > INT_MAX) | |
| 621 return false; | |
| 622 const int fd = fd_long; | |
| 623 | |
| 624 PreSandboxInit(); | |
| 625 | |
| 626 static const char kMsgChrootMe = 'C'; | |
| 627 static const char kMsgChrootSuccessful = 'O'; | |
| 628 | |
| 629 if (HANDLE_EINTR(write(fd, &kMsgChrootMe, 1)) != 1) { | |
| 630 LOG(ERROR) << "Failed to write to chroot pipe: " << errno; | |
| 631 return false; | |
| 632 } | |
| 633 | |
| 634 // We need to reap the chroot helper process in any event: | |
| 635 wait(NULL); | |
| 636 | |
| 637 char reply; | |
| 638 if (HANDLE_EINTR(read(fd, &reply, 1)) != 1) { | |
| 639 LOG(ERROR) << "Failed to read from chroot pipe: " << errno; | |
| 640 return false; | |
| 641 } | |
| 642 | |
| 643 if (reply != kMsgChrootSuccessful) { | |
| 644 LOG(ERROR) << "Error code reply from chroot helper"; | |
| 645 return false; | |
| 646 } | |
| 647 | |
| 648 SkiaFontConfigSetImplementation( | |
| 649 new FontConfigIPC(kMagicSandboxIPCDescriptor)); | |
| 650 | |
| 651 // Previously, we required that the binary be non-readable. This causes the | |
| 652 // kernel to mark the process as non-dumpable at startup. The thinking was | |
| 653 // that, although we were putting the renderers into a PID namespace (with | |
| 654 // the SUID sandbox), they would nonetheless be in the /same/ PID | |
| 655 // namespace. So they could ptrace each other unless they were non-dumpable. | |
| 656 // | |
| 657 // If the binary was readable, then there would be a window between process | |
| 658 // startup and the point where we set the non-dumpable flag in which a | |
| 659 // compromised renderer could ptrace attach. | |
| 660 // | |
| 661 // However, now that we have a zygote model, only the (trusted) zygote | |
| 662 // exists at this point and we can set the non-dumpable flag which is | |
| 663 // inherited by all our renderer children. | |
| 664 // | |
| 665 // Note: a non-dumpable process can't be debugged. To debug sandbox-related | |
| 666 // issues, one can specify --allow-sandbox-debugging to let the process be | |
| 667 // dumpable. | |
| 668 const CommandLine& command_line = *CommandLine::ForCurrentProcess(); | |
| 669 if (!command_line.HasSwitch(switches::kAllowSandboxDebugging)) { | |
| 670 prctl(PR_SET_DUMPABLE, 0, 0, 0, 0); | |
| 671 if (prctl(PR_GET_DUMPABLE, 0, 0, 0, 0)) { | |
| 672 LOG(ERROR) << "Failed to set non-dumpable flag"; | |
| 673 return false; | |
| 674 } | |
| 675 } | |
| 676 } else if (switches::SeccompSandboxEnabled()) { | |
| 677 PreSandboxInit(); | |
| 678 SkiaFontConfigSetImplementation( | |
| 679 new FontConfigIPC(kMagicSandboxIPCDescriptor)); | |
| 680 } else { | |
| 681 SkiaFontConfigUseDirectImplementation(); | |
| 682 } | |
| 683 | |
| 684 return true; | |
| 685 } | |
| 686 #else // CHROMIUM_SELINUX | |
| 687 | |
| 688 static bool EnterSandbox() { | |
| 689 PreSandboxInit(); | |
| 690 SkiaFontConfigUseIPCImplementation(kMagicSandboxIPCDescriptor); | |
| 691 return true; | |
| 692 } | |
| 693 | |
| 694 #endif // CHROMIUM_SELINUX | |
| 695 | |
| 696 bool ZygoteMain(const MainFunctionParams& params) { | |
| 697 #if !defined(CHROMIUM_SELINUX) | |
| 698 g_am_zygote_or_renderer = true; | |
| 699 #endif | |
| 700 | |
| 701 #if defined(SECCOMP_SANDBOX) | |
| 702 // The seccomp sandbox needs access to files in /proc, which might be denied | |
| 703 // after one of the other sandboxes have been started. So, obtain a suitable | |
| 704 // file handle in advance. | |
| 705 if (switches::SeccompSandboxEnabled()) { | |
| 706 g_proc_fd = open("/proc", O_DIRECTORY | O_RDONLY); | |
| 707 if (g_proc_fd < 0) { | |
| 708 LOG(ERROR) << "WARNING! Cannot access \"/proc\". Disabling seccomp " | |
| 709 "sandboxing."; | |
| 710 } | |
| 711 } | |
| 712 #endif // SECCOMP_SANDBOX | |
| 713 | |
| 714 // Turn on the SELinux or SUID sandbox | |
| 715 if (!EnterSandbox()) { | |
| 716 LOG(FATAL) << "Failed to enter sandbox. Fail safe abort. (errno: " | |
| 717 << errno << ")"; | |
| 718 return false; | |
| 719 } | |
| 720 | |
| 721 int sandbox_flags = 0; | |
| 722 if (getenv("SBX_D")) | |
| 723 sandbox_flags |= ZygoteHost::kSandboxSUID; | |
| 724 if (getenv("SBX_PID_NS")) | |
| 725 sandbox_flags |= ZygoteHost::kSandboxPIDNS; | |
| 726 if (getenv("SBX_NET_NS")) | |
| 727 sandbox_flags |= ZygoteHost::kSandboxNetNS; | |
| 728 | |
| 729 #if defined(SECCOMP_SANDBOX) | |
| 730 // The seccomp sandbox will be turned on when the renderers start. But we can | |
| 731 // already check if sufficient support is available so that we only need to | |
| 732 // print one error message for the entire browser session. | |
| 733 if (g_proc_fd >= 0 && switches::SeccompSandboxEnabled()) { | |
| 734 if (!SupportsSeccompSandbox(g_proc_fd)) { | |
| 735 // There are a good number of users who cannot use the seccomp sandbox | |
| 736 // (e.g. because their distribution does not enable seccomp mode by | |
| 737 // default). While we would prefer to deny execution in this case, it | |
| 738 // seems more realistic to continue in degraded mode. | |
| 739 LOG(ERROR) << "WARNING! This machine lacks support needed for the " | |
| 740 "Seccomp sandbox. Running renderers with Seccomp " | |
| 741 "sandboxing disabled."; | |
| 742 } else { | |
| 743 VLOG(1) << "Enabling experimental Seccomp sandbox."; | |
| 744 sandbox_flags |= ZygoteHost::kSandboxSeccomp; | |
| 745 } | |
| 746 } | |
| 747 #endif // SECCOMP_SANDBOX | |
| 748 | |
| 749 Zygote zygote(sandbox_flags); | |
| 750 // This function call can return multiple times, once per fork(). | |
| 751 return zygote.ProcessRequests(); | |
| 752 } | |
| OLD | NEW |
|---|
Chromium Code Reviews
Issue 6538111:
Move the rest of the core files in chrome\browser to content\browser.... (Closed)
Base URL: svn://chrome-svn/chrome/trunk/src/