New NaCl zygote implementation 2

chrome/nacl/nacl_helper_linux.cc

Index: chrome/nacl/nacl_helper_linux.cc
diff --git a/chrome/nacl/nacl_helper_linux.cc b/chrome/nacl/nacl_helper_linux.cc
new file mode 100644
index 0000000000000000000000000000000000000000..f699a081ed1fa17e4ae68d0f6bbba4e8e950796d
--- /dev/null
+++ b/chrome/nacl/nacl_helper_linux.cc
@@ -0,0 +1,229 @@
+// Copyright (c) 2011 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// A mini-zygote specifically for Native Client.
+
+#include <errno.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/socket.h>
+#include <sys/stat.h>  // for debugging
+#include <sys/types.h>
+#include <unistd.h>
+
+#include <vector>
+
+#include "base/at_exit.h"
+#include "base/command_line.h"
+#include "base/eintr_wrapper.h"
+#include "base/mac/scoped_nsautorelease_pool.h"
+#include "base/rand_util.h"
+#include "base/rand_util_c.h"
+#include "chrome/common/nacl_helper_linux.h"
+#include "content/common/main_function_params.h"
+#include "content/common/unix_domain_socket_posix.h"
+
+#include "base/message_loop.h"
+#include "content/common/child_process.h"
+#include "chrome/nacl/nacl_launcher_thread.h"
+#undef DCHECK
+
+// We define DCHECK internally instead of including base/logging.h
+// from Chromium, in hopes of avoiding a large dependency tree. The
+// goal is to make the nacl_helper binary small, as it is a new
+// binary in the Chrome Linux distribution.
+#if defined(NDEBUG)
+#define DCHECK(condition) {}
+#define DEBUG(s) do { if (0) { s; } } while (0)
+#else
+#define DCHECK(condition) \
+  { if (!condition) fprintf(stderr, "Check failed: %s.\n", #condition); }
+#define DEBUG(s) s
+#endif
+
+#if !defined(NDEBUG)
+class GURL;
+// This is another attempt to reduce binary size by pruning dependencies.
+// These two symbols from webkit_glue are being referenced someplace
+// in debug builds but apparently are not being called. I do not know
+// from where they are referenced, but as long as it's not in release
+// builds this seems okay.
+namespace webkit_glue {
+
+bool FindProxyForUrl(const GURL& url, std::string* proxy_list) {
+  fprintf(stderr, "Who is calling FindProxyForUrl?");
+  _exit(-1);
+  return false;
+}
+
+std::string GetProductVersion() {
+  fprintf(stderr, "Who is calling GetProductVersion?");
+  _exit(-1);
+  return "";
+}
+
+}  // namespace webkit_glue
+#endif  // NDEBUG
+
+#if !defined(NDEBUG)
+static void PrintFDMap() {
+  printf("FD map:\n");
+  for (int i = 0; i < 100; i++) {
+    struct stat ss;
+    if (fstat(i, &ss) >= 0) {
+      printf("  %2d: %llx:%o\n", i, ss.st_ino, ss.st_mode);
+    }
+  }
+}
+#endif
+
+static bool g_suid_sandbox_active;
+extern int NaClMain(const MainFunctionParams&);
+typedef int NaClHandle;
+extern "C" int NaClMainForChromium(int handle_count,
+                                   const NaClHandle* handles,
+                                   int debug);
+
+// The child must mimic the behavior of zygote_main_linux.cc on the child
+// side of the fork. See zygote_main_linux.cc:HandleForkRequest from
+//   if (!child) {
+// Note: this code doesn't attempt to support SELINUX or the SECCOMP sandbox.
+static void BecomeNaClLoader(const std::vector<int>& child_fds) {
+  DEBUG(fprintf(stderr, "NaCl loader: setting up IPC descriptor\n"));
+  close(kNaClZygoteDescriptor); // don't need this any more
+  // Set up browser descriptor as expected by Chrome on fd 3
+  // The zygote takes care of putting the sandbox IPC channel on fd 5
+  int zfd = dup2(child_fds[kNaClBrowserFDIndex], kNaClBrowserDescriptor);
+  if (zfd != kNaClBrowserDescriptor) {
+    fprintf(stderr, "Could not initialize kNaClBrowserDescriptor (%d)\n", zfd);
+    _exit(-1);
+  }
+
+#if 0
+  // this is the code that actually works
+  base::mac::ScopedNSAutoreleasePool autorelease_pool;

[agl, 2011/06/20 17:28:55]

It's odd to see "base::mac::" in a _linux file.

[Brad Chen, 2011/06/20 22:09:47]

Agreed! In the next revision NaClMain() has been deconstructed such that the
scoped pointer stuff is no longer needed.

On 2011/06/20 17:28:55, agl wrote:

+  SandboxInitWrapper sandbox_wrapper;
+  const CommandLine& command_line = *CommandLine::ForCurrentProcess();
+  const MainFunctionParams mainparams(command_line,
+                                      sandbox_wrapper,
+                                      &autorelease_pool);
+  DEBUG(fprintf(stderr, "calling NaClMain\n"));
+  NaClMain(mainparams);
+  _exit(0);
+#endif
+  // debugging code below; it works
+  {
+    // deconstructed NaClMain
+    PrintFDMap();
+    MessageLoopForIO main_message_loop;
+    PrintFDMap();
+    ChildProcess nacl_process;
+    nacl_process.set_main_thread(new NaClLauncherThread(false /* debug */));
+    PrintFDMap();
+    MessageLoop::current()->Run();
+    _exit(0);
+  }
+  //  NaClMainForChromium(0, NULL, 0);
+}
+
+// Some of this code was lifted from
+// content/browser/zygote_main_linux.cc:ForkWithRealPid()
+static void HandleForkRequest(const std::vector<int>& child_fds) {
+  DEBUG(fprintf(stderr, "nacl_helper: forking\n"));
+  pid_t childpid = fork();
+  if (childpid < 0) {
+    perror("fork");
+    fprintf(stderr, "*** HandleForkRequest failed\n");
+    // fall through to parent case below
+  } else if (childpid == 0) {  // In the child process.
+    if (g_suid_sandbox_active) {
+      char buffer[1];
+      // Wait until the parent process has discovered our PID.  We
+      // should not fork any child processes (which the seccomp
+      // sandbox does) until then, because that can interfere with the
+      // parent's discovery of our PID.
+      int nread = HANDLE_EINTR(read(child_fds[kNaClParentFDIndex], buffer, 1));
+      if (nread != 1 || buffer[0] != 'x') {
+        if (nread < 0) {
+          perror("read");
+        }
+        fprintf(stderr, "Failed to synch with zygote (%d:%d)\n",
+                nread, buffer[0]);
+      } else {
+        DEBUG(fprintf(stderr,
+                      "NaCl loader is synchronised with Chrome zygote\n"));
+      }
+    }
+    close(child_fds[kNaClDummyFDIndex]);
+    close(child_fds[kNaClParentFDIndex]);
+    BecomeNaClLoader(child_fds);
+    // NOTREACHED
+    return;
+  }
+  // I am the parent.
+  // First, close the dummy_fd so the sandbox won't find me when
+  // looking for the child's pid in /proc. Also close other fds.
+  for (size_t i = 0; i < child_fds.size(); i++) {
+    close(child_fds[i]);
+  }
+  fprintf(stderr, "nacl_helper: childpid is %d\n", childpid);
+  // Now tell childpid to the Chrome zygote.
+  if (HANDLE_EINTR(send(kNaClZygoteDescriptor,
+                        &childpid, sizeof(childpid), MSG_EOR))
+      != sizeof(childpid)) {
+    fprintf(stderr, "*** send() to zygote failed");
+  }
+}
+
+int main(int argc, char *argv[]) {
+  CommandLine::Init(argc, argv);
+  base::AtExitManager exit_manager;
+  base::RandUint64();  // acquire /dev/urandom fd before sandbox is raised
+  std::vector<int> empty; // for SendMsg() calls
+
+  g_suid_sandbox_active = (NULL != getenv("SBX_D"));
+
+  // Send the zygote a message to let it know we are ready to help
+  if (!UnixDomainSocket::SendMsg(kNaClZygoteDescriptor,
+                                 kNaClHelperStartupAck,
+                                 sizeof(kNaClHelperStartupAck), empty)) {
+    fprintf(stderr, "*** send() to zygote failed");
+  }
+  DEBUG(fprintf(stderr, "nacl_helper: ready to help\n"));
+  DEBUG(fprintf(stderr, " /dev/urandom is on fd %d\n", GetUrandomFD()));
+
+  while (true) {
+    int badpid = -1;
+    std::vector<int> fds;
+    static const unsigned kMaxMessageLength = 2048;
+    char buf[kMaxMessageLength];
+    const ssize_t msglen = UnixDomainSocket::RecvMsg(kNaClZygoteDescriptor,
+                                                     &buf, sizeof(buf), &fds);
+    if (msglen == -1) {
+      fprintf(stderr, "NaCl helper: error reading message from zygote\n");
+      _exit(-1);
+    }
+    // fork request
+    if (msglen == sizeof(kNaClForkRequest) &&
+        memcmp(buf, kNaClForkRequest, msglen) == 0) {
+      if (kNaClBrowserFDIndex + 1 == fds.size() ||
+          kNaClParentFDIndex + 1 == fds.size()) {
+        HandleForkRequest(fds);
+        continue;  // fork succeeded. Note: child does not return
+      } else {
+        fprintf(stderr, "nacl_helper: unexpected number of fds, got %d\n",
+                int(fds.size()));
+      }
+    } else {
+      fprintf(stderr, "nacl_helper unrecognized request: %s:%d\n", buf, msglen);
+      _exit(-1);
+    }
+    // if fork fails, send PID=-1 to zygote
+    if (!UnixDomainSocket::SendMsg(kNaClZygoteDescriptor, &badpid,
+                                   sizeof(badpid), empty)) {
+      fprintf(stderr, "*** send() to zygote failed");
+    }
+  }
+}