OLD | NEW |
1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "sandbox/linux/services/credentials.h" | 5 #include "sandbox/linux/services/credentials.h" |
6 | 6 |
7 #include <errno.h> | 7 #include <errno.h> |
8 #include <signal.h> | 8 #include <signal.h> |
9 #include <stdio.h> | 9 #include <stdio.h> |
10 #include <sys/syscall.h> | 10 #include <sys/syscall.h> |
11 #include <sys/types.h> | 11 #include <sys/types.h> |
12 #include <sys/wait.h> | 12 #include <sys/wait.h> |
13 #include <unistd.h> | 13 #include <unistd.h> |
14 | 14 |
15 #include "base/basictypes.h" | 15 #include "base/basictypes.h" |
16 #include "base/bind.h" | 16 #include "base/bind.h" |
17 #include "base/files/file_path.h" | 17 #include "base/files/file_path.h" |
18 #include "base/files/file_util.h" | 18 #include "base/files/file_util.h" |
19 #include "base/logging.h" | 19 #include "base/logging.h" |
20 #include "base/posix/eintr_wrapper.h" | 20 #include "base/posix/eintr_wrapper.h" |
21 #include "base/process/launch.h" | 21 #include "base/process/launch.h" |
22 #include "base/template_util.h" | 22 #include "base/template_util.h" |
23 #include "base/third_party/valgrind/valgrind.h" | 23 #include "base/third_party/valgrind/valgrind.h" |
24 #include "build/build_config.h" | 24 #include "build/build_config.h" |
25 #include "sandbox/linux/services/namespace_utils.h" | 25 #include "sandbox/linux/services/namespace_utils.h" |
26 #include "sandbox/linux/services/proc_util.h" | 26 #include "sandbox/linux/services/proc_util.h" |
27 #include "sandbox/linux/services/syscall_wrappers.h" | 27 #include "sandbox/linux/services/syscall_wrappers.h" |
28 #include "sandbox/linux/services/thread_helpers.h" | 28 #include "sandbox/linux/services/thread_helpers.h" |
29 #include "sandbox/linux/system_headers/capability.h" | 29 #include "sandbox/linux/system_headers/capability.h" |
30 #include "sandbox/linux/system_headers/linux_signal.h" | |
31 | 30 |
32 namespace sandbox { | 31 namespace sandbox { |
33 | 32 |
34 namespace { | 33 namespace { |
35 | 34 |
| 35 // Signal ABI for some toolchain is incompatible with Linux's. In particular, |
| 36 // PNaCl toolchain defines SIGCHLD = 20. So, here, directly define Linux's |
| 37 // value. |
| 38 const int kLinuxSIGCHLD = 17; |
| 39 |
36 bool IsRunningOnValgrind() { return RUNNING_ON_VALGRIND; } | 40 bool IsRunningOnValgrind() { return RUNNING_ON_VALGRIND; } |
37 | 41 |
38 // Checks that the set of RES-uids and the set of RES-gids have | 42 // Checks that the set of RES-uids and the set of RES-gids have |
39 // one element each and return that element in |resuid| and |resgid| | 43 // one element each and return that element in |resuid| and |resgid| |
40 // respectively. It's ok to pass NULL as one or both of the ids. | 44 // respectively. It's ok to pass NULL as one or both of the ids. |
41 bool GetRESIds(uid_t* resuid, gid_t* resgid) { | 45 bool GetRESIds(uid_t* resuid, gid_t* resgid) { |
42 uid_t ruid, euid, suid; | 46 uid_t ruid, euid, suid; |
43 gid_t rgid, egid, sgid; | 47 gid_t rgid, egid, sgid; |
44 PCHECK(sys_getresuid(&ruid, &euid, &suid) == 0); | 48 PCHECK(sys_getresuid(&ruid, &euid, &suid) == 0); |
45 PCHECK(sys_getresgid(&rgid, &egid, &sgid) == 0); | 49 PCHECK(sys_getresgid(&rgid, &egid, &sgid) == 0); |
(...skipping 39 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
85 char stack_buf[PTHREAD_STACK_MIN]; | 89 char stack_buf[PTHREAD_STACK_MIN]; |
86 #if defined(ARCH_CPU_X86_FAMILY) || defined(ARCH_CPU_ARM_FAMILY) || \ | 90 #if defined(ARCH_CPU_X86_FAMILY) || defined(ARCH_CPU_ARM_FAMILY) || \ |
87 defined(ARCH_CPU_MIPS64_FAMILY) || defined(ARCH_CPU_MIPS_FAMILY) | 91 defined(ARCH_CPU_MIPS64_FAMILY) || defined(ARCH_CPU_MIPS_FAMILY) |
88 // The stack grows downward. | 92 // The stack grows downward. |
89 void* stack = stack_buf + sizeof(stack_buf); | 93 void* stack = stack_buf + sizeof(stack_buf); |
90 #else | 94 #else |
91 #error "Unsupported architecture" | 95 #error "Unsupported architecture" |
92 #endif | 96 #endif |
93 | 97 |
94 pid = clone(ChrootToSelfFdinfo, stack, | 98 pid = clone(ChrootToSelfFdinfo, stack, |
95 CLONE_VM | CLONE_VFORK | CLONE_FS | LINUX_SIGCHLD, nullptr, | 99 CLONE_VM | CLONE_VFORK | CLONE_FS | kLinuxSIGCHLD, |
96 nullptr, nullptr, nullptr); | 100 nullptr, nullptr, nullptr, nullptr); |
97 PCHECK(pid != -1); | 101 PCHECK(pid != -1); |
98 | 102 |
99 int status = -1; | 103 int status = -1; |
100 PCHECK(HANDLE_EINTR(waitpid(pid, &status, 0)) == pid); | 104 PCHECK(HANDLE_EINTR(waitpid(pid, &status, 0)) == pid); |
101 | 105 |
102 return WIFEXITED(status) && WEXITSTATUS(status) == kExitSuccess; | 106 return WIFEXITED(status) && WEXITSTATUS(status) == kExitSuccess; |
103 } | 107 } |
104 | 108 |
105 // CHECK() that an attempt to move to a new user namespace raised an expected | 109 // CHECK() that an attempt to move to a new user namespace raised an expected |
106 // errno. | 110 // errno. |
(...skipping 183 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
290 CHECK_LE(0, proc_fd); | 294 CHECK_LE(0, proc_fd); |
291 | 295 |
292 CHECK(ChrootToSafeEmptyDir()); | 296 CHECK(ChrootToSafeEmptyDir()); |
293 CHECK(!base::DirectoryExists(base::FilePath("/proc"))); | 297 CHECK(!base::DirectoryExists(base::FilePath("/proc"))); |
294 CHECK(!ProcUtil::HasOpenDirectory(proc_fd)); | 298 CHECK(!ProcUtil::HasOpenDirectory(proc_fd)); |
295 // We never let this function fail. | 299 // We never let this function fail. |
296 return true; | 300 return true; |
297 } | 301 } |
298 | 302 |
299 } // namespace sandbox. | 303 } // namespace sandbox. |
OLD | NEW |