OLD | NEW |
1 // Copyright 2015 The Chromium Authors. All rights reserved. | 1 // Copyright 2015 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #ifndef SANDBOX_LINUX_SERVICES_NAMESPACE_SANDBOX_H_ | 5 #ifndef SANDBOX_LINUX_SERVICES_NAMESPACE_SANDBOX_H_ |
6 #define SANDBOX_LINUX_SERVICES_NAMESPACE_SANDBOX_H_ | 6 #define SANDBOX_LINUX_SERVICES_NAMESPACE_SANDBOX_H_ |
7 | 7 |
8 #include <sys/types.h> | |
9 | |
10 #include <string> | 8 #include <string> |
11 #include <vector> | 9 #include <vector> |
12 | 10 |
13 #include "base/command_line.h" | 11 #include "base/command_line.h" |
14 #include "base/macros.h" | 12 #include "base/macros.h" |
15 #include "base/process/launch.h" | 13 #include "base/process/launch.h" |
16 #include "base/process/process.h" | 14 #include "base/process/process.h" |
17 #include "sandbox/sandbox_export.h" | 15 #include "sandbox/sandbox_export.h" |
18 | 16 |
19 namespace sandbox { | 17 namespace sandbox { |
(...skipping 10 matching lines...) Expand all Loading... |
30 // not have an explicit signal handler registered. | 28 // not have an explicit signal handler registered. |
31 // If B dies, all the processes in the namespace will die. | 29 // If B dies, all the processes in the namespace will die. |
32 // B can fork() and the parent can assume the role of init(1), by using | 30 // B can fork() and the parent can assume the role of init(1), by using |
33 // CreateInitProcessReaper(). | 31 // CreateInitProcessReaper(). |
34 // 4. B chroots using Credentials::MoveToNewUserNS() and | 32 // 4. B chroots using Credentials::MoveToNewUserNS() and |
35 // Credentials::DropFileSystemAccess() | 33 // Credentials::DropFileSystemAccess() |
36 // 5. B drops capabilities gained by entering the new user namespace with | 34 // 5. B drops capabilities gained by entering the new user namespace with |
37 // Credentials::DropAllCapabilities(). | 35 // Credentials::DropAllCapabilities(). |
38 class SANDBOX_EXPORT NamespaceSandbox { | 36 class SANDBOX_EXPORT NamespaceSandbox { |
39 public: | 37 public: |
40 static const int kDefaultExitCode = 1; | |
41 | |
42 // Launch a new process inside its own user/PID/network namespaces (depending | 38 // Launch a new process inside its own user/PID/network namespaces (depending |
43 // on kernel support). Requires at a minimum that user namespaces are | 39 // on kernel support). Requires at a minimum that user namespaces are |
44 // supported (use Credentials::CanCreateProcessInNewUserNS to check this). | 40 // supported (use Credentials::CanCreateProcessInNewUserNS to check this). |
45 // | 41 // |
46 // pre_exec_delegate and clone_flags fields of LaunchOptions should be nullptr | 42 // pre_exec_delegate and clone_flags fields of LaunchOptions should be nullptr |
47 // and 0, respectively, since this function makes a copy of options and | 43 // and 0, respectively, since this function makes a copy of options and |
48 // overrides them. | 44 // overrides them. |
49 static base::Process LaunchProcess(const base::CommandLine& cmdline, | 45 static base::Process LaunchProcess(const base::CommandLine& cmdline, |
50 const base::LaunchOptions& options); | 46 const base::LaunchOptions& options); |
51 static base::Process LaunchProcess(const std::vector<std::string>& argv, | 47 static base::Process LaunchProcess(const std::vector<std::string>& argv, |
52 const base::LaunchOptions& options); | 48 const base::LaunchOptions& options); |
53 | 49 |
54 // Forks a process in its own PID namespace. The child process is the init | |
55 // process inside of the PID namespace, so if the child needs to fork further, | |
56 // it should call CreateInitProcessReaper, which turns the init process into a | |
57 // reaper process. | |
58 // | |
59 // Otherwise, the child should setup handlers for signals which should | |
60 // terminate the process using InstallDefaultTerminationSignalHandlers or | |
61 // InstallTerminationSignalHandler. This works around the fact that init | |
62 // processes ignore such signals unless they have an explicit handler set. | |
63 // | |
64 // This function requries CAP_SYS_ADMIN. If |drop_capabilities_in_child| is | |
65 // true, then capabilities are dropped in the child. | |
66 static pid_t ForkInNewPidNamespace(bool drop_capabilities_in_child); | |
67 | |
68 // Installs a signal handler for: | |
69 // | |
70 // SIGHUP, SIGINT, SIGABRT, SIGQUIT, SIGPIPE, SIGTERM, SIGUSR1, SIGUSR2 | |
71 // | |
72 // that exits with kDefaultExitCode. These are signals whose default action is | |
73 // to terminate the program (apart from SIGILL, SIGFPE, and SIGSEGV, which | |
74 // will still terminate the process if e.g. an illegal instruction is | |
75 // encountered, etc.). | |
76 // | |
77 // If any of these already had a signal handler installed, this function will | |
78 // not override them. | |
79 static void InstallDefaultTerminationSignalHandlers(); | |
80 | |
81 // Installs a signal handler for |sig| which exits with |exit_code|. If a | |
82 // signal handler was already present for |sig|, does nothing and returns | |
83 // false. | |
84 static bool InstallTerminationSignalHandler(int sig, int exit_code); | |
85 | |
86 // Returns whether the namespace sandbox created a new user, PID, and network | 50 // Returns whether the namespace sandbox created a new user, PID, and network |
87 // namespace. In particular, InNewUserNamespace should return true iff the | 51 // namespace. In particular, InNewUserNamespace should return true iff the |
88 // process was started via this class. | 52 // process was started via this class. |
89 static bool InNewUserNamespace(); | 53 static bool InNewUserNamespace(); |
90 static bool InNewPidNamespace(); | 54 static bool InNewPidNamespace(); |
91 static bool InNewNetNamespace(); | 55 static bool InNewNetNamespace(); |
92 | 56 |
93 private: | 57 private: |
94 DISALLOW_IMPLICIT_CONSTRUCTORS(NamespaceSandbox); | 58 DISALLOW_IMPLICIT_CONSTRUCTORS(NamespaceSandbox); |
95 }; | 59 }; |
96 | 60 |
97 } // namespace sandbox | 61 } // namespace sandbox |
98 | 62 |
99 #endif // SANDBOX_LINUX_SERVICES_NAMESPACE_SANDBOX_H_ | 63 #endif // SANDBOX_LINUX_SERVICES_NAMESPACE_SANDBOX_H_ |
OLD | NEW |