OLD | NEW |
(Empty) | |
| 1 // Copyright (c) 2011 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. |
| 4 |
| 5 // A mini-zygote specifically for Native Client. |
| 6 |
| 7 #include <errno.h> |
| 8 #include <stdlib.h> |
| 9 #include <sys/socket.h> |
| 10 #include <sys/types.h> |
| 11 |
| 12 #include <string> |
| 13 #include <vector> |
| 14 |
| 15 #include "base/at_exit.h" |
| 16 #include "base/eintr_wrapper.h" |
| 17 #include "base/logging.h" |
| 18 #include "base/message_loop.h" |
| 19 #include "base/rand_util.h" |
| 20 #include "chrome/common/nacl_helper_linux.h" |
| 21 #include "chrome/nacl/nacl_listener.h" |
| 22 #include "content/common/main_function_params.h" |
| 23 #include "content/common/unix_domain_socket_posix.h" |
| 24 #include "ipc/ipc_switches.h" |
| 25 |
| 26 static bool g_suid_sandbox_active; |
| 27 |
| 28 // The child must mimic the behavior of zygote_main_linux.cc on the child |
| 29 // side of the fork. See zygote_main_linux.cc:HandleForkRequest from |
| 30 // if (!child) { |
| 31 // Note: this code doesn't attempt to support SELINUX or the SECCOMP sandbox. |
| 32 static void BecomeNaClLoader(const std::vector<int>& child_fds) { |
| 33 VLOG(1) << "NaCl loader: setting up IPC descriptor"; |
| 34 close(kNaClZygoteDescriptor); // don't need this any more |
| 35 // Set up browser descriptor as expected by Chrome on fd 3 |
| 36 // The zygote takes care of putting the sandbox IPC channel on fd 5 |
| 37 int zfd = dup2(child_fds[kNaClBrowserFDIndex], kNaClBrowserDescriptor); |
| 38 if (zfd != kNaClBrowserDescriptor) { |
| 39 LOG(ERROR) << "Could not initialize kNaClBrowserDescriptor"; |
| 40 _exit(-1); |
| 41 } |
| 42 |
| 43 MessageLoopForIO main_message_loop; |
| 44 NaClListener *listener = new NaClListener(); |
| 45 listener->Listen(); |
| 46 _exit(0); |
| 47 } |
| 48 |
| 49 // Some of this code was lifted from |
| 50 // content/browser/zygote_main_linux.cc:ForkWithRealPid() |
| 51 static void HandleForkRequest(const std::vector<int>& child_fds) { |
| 52 VLOG(1) << "nacl_helper: forking"; |
| 53 pid_t childpid = fork(); |
| 54 if (childpid < 0) { |
| 55 perror("fork"); |
| 56 LOG(ERROR) << "*** HandleForkRequest failed\n"; |
| 57 // fall through to parent case below |
| 58 } else if (childpid == 0) { // In the child process. |
| 59 bool validack = false; |
| 60 const size_t kMaxReadSize = 1024; |
| 61 char buffer[kMaxReadSize]; |
| 62 // Wait until the parent process has discovered our PID. We |
| 63 // should not fork any child processes (which the seccomp |
| 64 // sandbox does) until then, because that can interfere with the |
| 65 // parent's discovery of our PID. |
| 66 int nread = HANDLE_EINTR(read(child_fds[kNaClParentFDIndex], buffer, |
| 67 kMaxReadSize)); |
| 68 std::string swtch("--"); |
| 69 swtch += switches::kProcessChannelID; |
| 70 swtch += "="; |
| 71 const size_t len = swtch.length(); |
| 72 |
| 73 if (nread < 0) { |
| 74 perror("read"); |
| 75 LOG(ERROR) << "read returned " << nread; |
| 76 } else if (nread > static_cast<int>(len)) { |
| 77 buffer[nread] = '\0'; |
| 78 if (swtch.compare(0, len, buffer, 0, len) == 0) { |
| 79 fprintf(stderr, "nacl_helper: ack %s\n", buffer); |
| 80 VLOG(1) << "NaCl loader is synchronised with Chrome zygote"; |
| 81 CommandLine::ForCurrentProcess()->AppendSwitchASCII( |
| 82 switches::kProcessChannelID, |
| 83 std::string(&buffer[len])); |
| 84 validack = true; |
| 85 } |
| 86 } |
| 87 close(child_fds[kNaClDummyFDIndex]); |
| 88 close(child_fds[kNaClParentFDIndex]); |
| 89 if (validack) { |
| 90 BecomeNaClLoader(child_fds); |
| 91 } else { |
| 92 LOG(ERROR) << "Failed to synch with zygote"; |
| 93 } |
| 94 // NOTREACHED |
| 95 return; |
| 96 } |
| 97 // I am the parent. |
| 98 // First, close the dummy_fd so the sandbox won't find me when |
| 99 // looking for the child's pid in /proc. Also close other fds. |
| 100 for (size_t i = 0; i < child_fds.size(); i++) { |
| 101 close(child_fds[i]); |
| 102 } |
| 103 VLOG(1) << "nacl_helper: childpid is " << childpid; |
| 104 // Now tell childpid to the Chrome zygote. |
| 105 if (HANDLE_EINTR(send(kNaClZygoteDescriptor, |
| 106 &childpid, sizeof(childpid), MSG_EOR)) |
| 107 != sizeof(childpid)) { |
| 108 LOG(ERROR) << "*** send() to zygote failed"; |
| 109 } |
| 110 } |
| 111 |
| 112 int main(int argc, char *argv[]) { |
| 113 CommandLine::Init(argc, argv); |
| 114 base::AtExitManager exit_manager; |
| 115 base::RandUint64(); // acquire /dev/urandom fd before sandbox is raised |
| 116 std::vector<int> empty; // for SendMsg() calls |
| 117 |
| 118 g_suid_sandbox_active = (NULL != getenv("SBX_D")); |
| 119 |
| 120 // Send the zygote a message to let it know we are ready to help |
| 121 if (!UnixDomainSocket::SendMsg(kNaClZygoteDescriptor, |
| 122 kNaClHelperStartupAck, |
| 123 sizeof(kNaClHelperStartupAck), empty)) { |
| 124 LOG(ERROR) << "*** send() to zygote failed"; |
| 125 } |
| 126 |
| 127 while (true) { |
| 128 int badpid = -1; |
| 129 std::vector<int> fds; |
| 130 static const unsigned kMaxMessageLength = 2048; |
| 131 char buf[kMaxMessageLength]; |
| 132 const ssize_t msglen = UnixDomainSocket::RecvMsg(kNaClZygoteDescriptor, |
| 133 &buf, sizeof(buf), &fds); |
| 134 if (msglen == 0 || (msglen == -1 && errno == ECONNRESET)) { |
| 135 // EOF from the browser. Goodbye! |
| 136 _exit(0); |
| 137 } |
| 138 if (msglen == sizeof(kNaClForkRequest) - 1 && |
| 139 memcmp(buf, kNaClForkRequest, msglen) == 0) { |
| 140 if (kNaClParentFDIndex + 1 == fds.size()) { |
| 141 HandleForkRequest(fds); |
| 142 continue; // fork succeeded. Note: child does not return |
| 143 } else { |
| 144 LOG(ERROR) << "nacl_helper: unexpected number of fds, got " |
| 145 << fds.size(); |
| 146 } |
| 147 } else { |
| 148 if (msglen != 0) { |
| 149 LOG(ERROR) << "nacl_helper unrecognized request: %s"; |
| 150 _exit(-1); |
| 151 } |
| 152 } |
| 153 // if fork fails, send PID=-1 to zygote |
| 154 if (!UnixDomainSocket::SendMsg(kNaClZygoteDescriptor, &badpid, |
| 155 sizeof(badpid), empty)) { |
| 156 LOG(ERROR) << "*** send() to zygote failed"; |
| 157 } |
| 158 } |
| 159 } |
OLD | NEW |