| OLD | NEW |
| 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "sandbox/linux/services/credentials.h" | 5 #include "sandbox/linux/services/credentials.h" |
| 6 | 6 |
| 7 #include <errno.h> | 7 #include <errno.h> |
| 8 #include <signal.h> | 8 #include <signal.h> |
| 9 #include <stdint.h> | 9 #include <stdint.h> |
| 10 #include <stdio.h> | 10 #include <stdio.h> |
| 11 #include <sys/syscall.h> | 11 #include <sys/syscall.h> |
| 12 #include <sys/types.h> | 12 #include <sys/types.h> |
| 13 #include <sys/wait.h> | 13 #include <sys/wait.h> |
| 14 #include <unistd.h> | 14 #include <unistd.h> |
| 15 | 15 |
| 16 #include "base/bind.h" | 16 #include "base/bind.h" |
| 17 #include "base/files/file_path.h" | 17 #include "base/files/file_path.h" |
| 18 #include "base/files/file_util.h" | 18 #include "base/files/file_util.h" |
| 19 #include "base/logging.h" | 19 #include "base/logging.h" |
| 20 #include "base/posix/eintr_wrapper.h" | 20 #include "base/posix/eintr_wrapper.h" |
| 21 #include "base/process/launch.h" | 21 #include "base/process/launch.h" |
| 22 #include "base/template_util.h" | 22 #include "base/template_util.h" |
| 23 #include "base/third_party/valgrind/valgrind.h" | 23 #include "base/third_party/valgrind/valgrind.h" |
| 24 #include "build/build_config.h" | 24 #include "build/build_config.h" |
| 25 #include "sandbox/linux/services/namespace_utils.h" | 25 #include "sandbox/linux/services/namespace_utils.h" |
| 26 #include "sandbox/linux/services/proc_util.h" | 26 #include "sandbox/linux/services/proc_util.h" |
| 27 #include "sandbox/linux/services/syscall_wrappers.h" | 27 #include "sandbox/linux/services/syscall_wrappers.h" |
| 28 #include "sandbox/linux/services/thread_helpers.h" | 28 #include "sandbox/linux/services/thread_helpers.h" |
| 29 #include "sandbox/linux/system_headers/capability.h" | 29 #include "sandbox/linux/system_headers/capability.h" |
| 30 #include "sandbox/linux/system_headers/linux_signal.h" | |
| 31 | 30 |
| 32 namespace sandbox { | 31 namespace sandbox { |
| 33 | 32 |
| 34 namespace { | 33 namespace { |
| 35 | 34 |
| 35 // Signal ABI for some toolchain is incompatible with Linux's. In particular, |
| 36 // PNaCl toolchain defines SIGCHLD = 20. So, here, directly define Linux's |
| 37 // value. |
| 38 const int kLinuxSIGCHLD = 17; |
| 39 |
| 36 bool IsRunningOnValgrind() { return RUNNING_ON_VALGRIND; } | 40 bool IsRunningOnValgrind() { return RUNNING_ON_VALGRIND; } |
| 37 | 41 |
| 38 // Checks that the set of RES-uids and the set of RES-gids have | 42 // Checks that the set of RES-uids and the set of RES-gids have |
| 39 // one element each and return that element in |resuid| and |resgid| | 43 // one element each and return that element in |resuid| and |resgid| |
| 40 // respectively. It's ok to pass NULL as one or both of the ids. | 44 // respectively. It's ok to pass NULL as one or both of the ids. |
| 41 bool GetRESIds(uid_t* resuid, gid_t* resgid) { | 45 bool GetRESIds(uid_t* resuid, gid_t* resgid) { |
| 42 uid_t ruid, euid, suid; | 46 uid_t ruid, euid, suid; |
| 43 gid_t rgid, egid, sgid; | 47 gid_t rgid, egid, sgid; |
| 44 PCHECK(sys_getresuid(&ruid, &euid, &suid) == 0); | 48 PCHECK(sys_getresuid(&ruid, &euid, &suid) == 0); |
| 45 PCHECK(sys_getresgid(&rgid, &egid, &sgid) == 0); | 49 PCHECK(sys_getresgid(&rgid, &egid, &sgid) == 0); |
| (...skipping 39 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 85 char stack_buf[PTHREAD_STACK_MIN]; | 89 char stack_buf[PTHREAD_STACK_MIN]; |
| 86 #if defined(ARCH_CPU_X86_FAMILY) || defined(ARCH_CPU_ARM_FAMILY) || \ | 90 #if defined(ARCH_CPU_X86_FAMILY) || defined(ARCH_CPU_ARM_FAMILY) || \ |
| 87 defined(ARCH_CPU_MIPS64_FAMILY) || defined(ARCH_CPU_MIPS_FAMILY) | 91 defined(ARCH_CPU_MIPS64_FAMILY) || defined(ARCH_CPU_MIPS_FAMILY) |
| 88 // The stack grows downward. | 92 // The stack grows downward. |
| 89 void* stack = stack_buf + sizeof(stack_buf); | 93 void* stack = stack_buf + sizeof(stack_buf); |
| 90 #else | 94 #else |
| 91 #error "Unsupported architecture" | 95 #error "Unsupported architecture" |
| 92 #endif | 96 #endif |
| 93 | 97 |
| 94 pid = clone(ChrootToSelfFdinfo, stack, | 98 pid = clone(ChrootToSelfFdinfo, stack, |
| 95 CLONE_VM | CLONE_VFORK | CLONE_FS | LINUX_SIGCHLD, nullptr, | 99 CLONE_VM | CLONE_VFORK | CLONE_FS | kLinuxSIGCHLD, |
| 96 nullptr, nullptr, nullptr); | 100 nullptr, nullptr, nullptr, nullptr); |
| 97 PCHECK(pid != -1); | 101 PCHECK(pid != -1); |
| 98 | 102 |
| 99 int status = -1; | 103 int status = -1; |
| 100 PCHECK(HANDLE_EINTR(waitpid(pid, &status, 0)) == pid); | 104 PCHECK(HANDLE_EINTR(waitpid(pid, &status, 0)) == pid); |
| 101 | 105 |
| 102 return WIFEXITED(status) && WEXITSTATUS(status) == kExitSuccess; | 106 return WIFEXITED(status) && WEXITSTATUS(status) == kExitSuccess; |
| 103 } | 107 } |
| 104 | 108 |
| 105 // CHECK() that an attempt to move to a new user namespace raised an expected | 109 // CHECK() that an attempt to move to a new user namespace raised an expected |
| 106 // errno. | 110 // errno. |
| (...skipping 183 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 290 CHECK_LE(0, proc_fd); | 294 CHECK_LE(0, proc_fd); |
| 291 | 295 |
| 292 CHECK(ChrootToSafeEmptyDir()); | 296 CHECK(ChrootToSafeEmptyDir()); |
| 293 CHECK(!base::DirectoryExists(base::FilePath("/proc"))); | 297 CHECK(!base::DirectoryExists(base::FilePath("/proc"))); |
| 294 CHECK(!ProcUtil::HasOpenDirectory(proc_fd)); | 298 CHECK(!ProcUtil::HasOpenDirectory(proc_fd)); |
| 295 // We never let this function fail. | 299 // We never let this function fail. |
| 296 return true; | 300 return true; |
| 297 } | 301 } |
| 298 | 302 |
| 299 } // namespace sandbox. | 303 } // namespace sandbox. |
| OLD | NEW |