Chromium Code Reviews
Help | Chromium Project | Gerrit Changes | Sign in
(100)

Issue 1158793003: Enable one PID namespace per process for NaCl processes. (Closed)

Created:
4 years, 3 months ago by rickyz (no longer on Chrome)
Modified:
4 years, 3 months ago
CC:
chromium-reviews, darin-cc_chromium.org, jam, rickyz+watch_chromium.org, jln+watch_chromium.org, hidehiko
Base URL:
https://chromium.googlesource.com/chromium/src.git@master
Target Ref:
refs/pending/heads/master
Project:
chromium
Visibility:
Public.

Description

Enable one PID namespace per process for NaCl processes. This CL does two things: - Make the NaCl helper fork each process into a new PID namespace via ForkInNewPidNamespace. - Bring the non-NaCl process termination exit codes in line with NaCl's default signal handlers, that is exit with an exit code of -sig & 0xff. This change depends on https://codereview.chromium.org/1159803003, which adds termination signals handlers in SFI NaCl. BUG=460972 Committed: https://crrev.com/d423ad87b1fdc8a59a7c945c000bfbbd9d8b2245 Cr-Commit-Position: refs/heads/master@{#335223}

Patch Set 1 #

Patch Set 2 : Get rid of kDefaultExitCode. #

Total comments: 14

Patch Set 3 : Respond to comments. #

Total comments: 2

Patch Set 4 : Respond to comments. #

Patch Set 5 : Split out nonSFI bits. #

Total comments: 8

Patch Set 6 : More comments. #

Total comments: 7

Patch Set 7 : Install signal handlers for nonsfi mode. #

Patch Set 8 : Fix embarassing compile fail. #

Total comments: 1

Patch Set 9 : Enable PID namespace per process for nonsfi newlib NaCl as well. #

Unified diffs Side-by-side diffs Delta from patch set Stats (+63 lines, -36 lines) Patch
M components/nacl/loader/nacl_helper_linux.cc View 1 2 3 4 5 6 7 8 2 chunks +19 lines, -1 line 0 comments Download
M components/nacl/loader/nonsfi/irt_exception_handling.cc View 1 2 3 4 5 6 1 chunk +1 line, -1 line 0 comments Download
M components/nacl/loader/sandbox_linux/nacl_sandbox_linux.cc View 1 2 1 chunk +7 lines, -3 lines 0 comments Download
M content/zygote/zygote_linux.cc View 1 2 3 4 chunks +11 lines, -21 lines 0 comments Download
M sandbox/linux/services/credentials.h View 1 2 1 chunk +3 lines, -0 lines 0 comments Download
M sandbox/linux/services/credentials.cc View 1 2 1 chunk +11 lines, -0 lines 0 comments Download
M sandbox/linux/services/namespace_sandbox.h View 1 2 3 4 5 6 7 8 3 chunks +6 lines, -4 lines 0 comments Download
M sandbox/linux/services/namespace_sandbox.cc View 1 2 3 4 5 6 7 8 2 chunks +2 lines, -2 lines 0 comments Download
M sandbox/linux/services/namespace_sandbox_unittest.cc View 1 2 4 chunks +3 lines, -4 lines 0 comments Download

Messages

Total messages: 48 (15 generated)
rickyz (no longer on Chrome)
Here's the chromium side of the change. Should only be submitted after https://codereview.chromium.org/1159803003/ is submitted ...
4 years, 3 months ago (2015-05-27 05:30:46 UTC) #2
jln (very slow on Chromium)
Looks ok in general. Added mdempsky@ since I'm OOO. - How come NONSFI doesn't support ...
4 years, 3 months ago (2015-05-28 09:02:34 UTC) #4
mdempsky
https://chromiumcodereview.appspot.com/1158793003/diff/20001/components/nacl/loader/nacl_helper_linux.cc File components/nacl/loader/nacl_helper_linux.cc (right): https://chromiumcodereview.appspot.com/1158793003/diff/20001/components/nacl/loader/nacl_helper_linux.cc#newcode205 components/nacl/loader/nacl_helper_linux.cc:205: #if !defined(OS_NACL_NONSFI) nit: Having an #if block just for ...
4 years, 3 months ago (2015-05-28 21:23:23 UTC) #5
hidehiko
FYI. https://codereview.chromium.org/1158793003/diff/20001/components/nacl/loader/nacl_helper_linux.cc File components/nacl/loader/nacl_helper_linux.cc (right): https://codereview.chromium.org/1158793003/diff/20001/components/nacl/loader/nacl_helper_linux.cc#newcode197 components/nacl/loader/nacl_helper_linux.cc:197: if (sandbox::NamespaceSandbox::InNewUserNamespace()) { On 2015/05/28 09:02:33, jln (OOO ...
4 years, 3 months ago (2015-05-29 05:46:58 UTC) #7
hidehiko
https://codereview.chromium.org/1158793003/diff/20001/components/nacl/loader/nacl_helper_linux.cc File components/nacl/loader/nacl_helper_linux.cc (right): https://codereview.chromium.org/1158793003/diff/20001/components/nacl/loader/nacl_helper_linux.cc#newcode197 components/nacl/loader/nacl_helper_linux.cc:197: if (sandbox::NamespaceSandbox::InNewUserNamespace()) { On 2015/05/29 05:46:58, hidehiko wrote: > ...
4 years, 3 months ago (2015-05-29 06:14:52 UTC) #8
rickyz (no longer on Chrome)
https://codereview.chromium.org/1158793003/diff/20001/components/nacl/loader/nacl_helper_linux.cc File components/nacl/loader/nacl_helper_linux.cc (right): https://codereview.chromium.org/1158793003/diff/20001/components/nacl/loader/nacl_helper_linux.cc#newcode197 components/nacl/loader/nacl_helper_linux.cc:197: if (sandbox::NamespaceSandbox::InNewUserNamespace()) { On 2015/05/29 06:14:52, hidehiko wrote: > ...
4 years, 3 months ago (2015-05-29 23:16:39 UTC) #10
Mark Seaborn
I assume you're not waiting for me on this one? jln and mdempsky know the ...
4 years, 3 months ago (2015-06-04 20:34:33 UTC) #11
rickyz (no longer on Chrome)
On 2015/06/04 20:34:33, Mark Seaborn wrote: > I assume you're not waiting for me on ...
4 years, 3 months ago (2015-06-04 22:20:57 UTC) #12
commit-bot: I haz the power
Dry run: CQ is trying da patch. Follow status at https://chromium-cq-status.appspot.com/patch-status/1158793003/60001
4 years, 3 months ago (2015-06-08 20:45:17 UTC) #14
commit-bot: I haz the power
Dry run: This issue passed the CQ dry run.
4 years, 3 months ago (2015-06-08 21:27:52 UTC) #16
jln (very slow on Chromium)
lgtm, but please add a comment to the bug that NonSFI still needs support for ...
4 years, 3 months ago (2015-06-09 21:11:45 UTC) #17
jln (very slow on Chromium)
https://chromiumcodereview.appspot.com/1158793003/diff/60001/sandbox/linux/services/namespace_sandbox.h File sandbox/linux/services/namespace_sandbox.h (right): https://chromiumcodereview.appspot.com/1158793003/diff/60001/sandbox/linux/services/namespace_sandbox.h#newcode86 sandbox/linux/services/namespace_sandbox.h:86: static inline int SignalExitCode(int sig) { return -sig & ...
4 years, 3 months ago (2015-06-09 21:18:10 UTC) #18
rickyz (no longer on Chrome)
https://codereview.chromium.org/1158793003/diff/60001/sandbox/linux/services/namespace_sandbox.h File sandbox/linux/services/namespace_sandbox.h (right): https://codereview.chromium.org/1158793003/diff/60001/sandbox/linux/services/namespace_sandbox.h#newcode86 sandbox/linux/services/namespace_sandbox.h:86: static inline int SignalExitCode(int sig) { return -sig & ...
4 years, 3 months ago (2015-06-09 22:55:25 UTC) #19
commit-bot: I haz the power
CQ is trying da patch. Follow status at https://chromium-cq-status.appspot.com/patch-status/1158793003/80001
4 years, 3 months ago (2015-06-09 22:59:19 UTC) #22
rickyz (no longer on Chrome)
On 2015/06/09 22:59:19, commit-bot: I haz the power wrote: > CQ is trying da patch. ...
4 years, 3 months ago (2015-06-09 23:01:41 UTC) #24
commit-bot: I haz the power
CQ is trying da patch. Follow status at https://chromium-cq-status.appspot.com/patch-status/1158793003/100001
4 years, 3 months ago (2015-06-09 23:03:10 UTC) #27
commit-bot: I haz the power
Try jobs failed on following builders: chromium_presubmit on tryserver.chromium.linux (JOB_FAILED, http://build.chromium.org/p/tryserver.chromium.linux/builders/chromium_presubmit/builds/69648)
4 years, 3 months ago (2015-06-09 23:31:03 UTC) #29
rickyz (no longer on Chrome)
Ah oops, I'm not thinking straight. Can you take a look at components/nacl, mseaborn@?
4 years, 3 months ago (2015-06-09 23:34:16 UTC) #30
Mark Seaborn
LGTM for components/nacl/ https://codereview.chromium.org/1158793003/diff/100001/components/nacl/loader/nacl_helper_linux.cc File components/nacl/loader/nacl_helper_linux.cc (right): https://codereview.chromium.org/1158793003/diff/100001/components/nacl/loader/nacl_helper_linux.cc#newcode196 components/nacl/loader/nacl_helper_linux.cc:196: #if !defined(OS_NACL_NONSFI) Should this instead be ...
4 years, 3 months ago (2015-06-09 23:44:19 UTC) #31
rickyz (no longer on Chrome)
Thanks! Mind taking a quick look at the changes here? I didn't realize that non-newlib ...
4 years, 3 months ago (2015-06-10 01:31:44 UTC) #32
Mark Seaborn
LGTM https://codereview.chromium.org/1158793003/diff/120001/components/nacl/loader/nonsfi/irt_exception_handling.cc File components/nacl/loader/nonsfi/irt_exception_handling.cc (right): https://codereview.chromium.org/1158793003/diff/120001/components/nacl/loader/nonsfi/irt_exception_handling.cc#newcode32 components/nacl/loader/nonsfi/irt_exception_handling.cc:32: SIGHUP, SIGINT, SIGQUIT, SIGILL, SIGTRAP, SIGBUS, SIGFPE, SIGSEGV, ...
4 years, 3 months ago (2015-06-10 18:53:12 UTC) #33
rickyz (no longer on Chrome)
https://codereview.chromium.org/1158793003/diff/120001/components/nacl/loader/nonsfi/irt_exception_handling.cc File components/nacl/loader/nonsfi/irt_exception_handling.cc (right): https://codereview.chromium.org/1158793003/diff/120001/components/nacl/loader/nonsfi/irt_exception_handling.cc#newcode32 components/nacl/loader/nonsfi/irt_exception_handling.cc:32: SIGHUP, SIGINT, SIGQUIT, SIGILL, SIGTRAP, SIGBUS, SIGFPE, SIGSEGV, SIGTERM, ...
4 years, 3 months ago (2015-06-10 22:42:34 UTC) #34
rickyz (no longer on Chrome)
On 2015/06/10 22:42:34, rickyz wrote: > https://codereview.chromium.org/1158793003/diff/120001/components/nacl/loader/nonsfi/irt_exception_handling.cc > File components/nacl/loader/nonsfi/irt_exception_handling.cc (right): > > https://codereview.chromium.org/1158793003/diff/120001/components/nacl/loader/nonsfi/irt_exception_handling.cc#newcode32 > ...
4 years, 3 months ago (2015-06-15 21:41:51 UTC) #35
Mark Seaborn
https://codereview.chromium.org/1158793003/diff/120001/components/nacl/loader/nonsfi/irt_exception_handling.cc File components/nacl/loader/nonsfi/irt_exception_handling.cc (right): https://codereview.chromium.org/1158793003/diff/120001/components/nacl/loader/nonsfi/irt_exception_handling.cc#newcode52 components/nacl/loader/nonsfi/irt_exception_handling.cc:52: _exit(-sig); On 2015/06/10 22:42:34, rickyz wrote: > On 2015/06/10 ...
4 years, 3 months ago (2015-06-15 22:29:05 UTC) #36
rickyz (no longer on Chrome)
https://codereview.chromium.org/1158793003/diff/120001/components/nacl/loader/nonsfi/irt_exception_handling.cc File components/nacl/loader/nonsfi/irt_exception_handling.cc (right): https://codereview.chromium.org/1158793003/diff/120001/components/nacl/loader/nonsfi/irt_exception_handling.cc#newcode52 components/nacl/loader/nonsfi/irt_exception_handling.cc:52: _exit(-sig); On 2015/06/15 22:29:04, Mark Seaborn wrote: > On ...
4 years, 3 months ago (2015-06-15 23:23:51 UTC) #37
Junichi Uekawa
FYI https://chromiumcodereview.appspot.com/1158793003/diff/160001/components/nacl/loader/nonsfi/irt_exception_handling.cc File components/nacl/loader/nonsfi/irt_exception_handling.cc (right): https://chromiumcodereview.appspot.com/1158793003/diff/160001/components/nacl/loader/nonsfi/irt_exception_handling.cc#newcode52 components/nacl/loader/nonsfi/irt_exception_handling.cc:52: _exit(-sig); If you want to depend on this ...
4 years, 3 months ago (2015-06-15 23:58:35 UTC) #39
rickyz (no longer on Chrome)
On 2015/06/15 23:58:35, Junichi Uekawa wrote: > FYI > > https://chromiumcodereview.appspot.com/1158793003/diff/160001/components/nacl/loader/nonsfi/irt_exception_handling.cc > File components/nacl/loader/nonsfi/irt_exception_handling.cc (right): ...
4 years, 3 months ago (2015-06-16 00:28:29 UTC) #40
Mark Seaborn
On 2015/06/15 23:23:51, rickyz wrote: > Ah, thank you for the detailed explanation. In that ...
4 years, 3 months ago (2015-06-16 21:41:38 UTC) #41
rickyz (no longer on Chrome)
On 2015/06/16 21:41:38, Mark Seaborn wrote: > On 2015/06/15 23:23:51, rickyz wrote: > > Ah, ...
4 years, 3 months ago (2015-06-16 21:45:09 UTC) #42
rickyz (no longer on Chrome)
https://codereview.chromium.org/1176413003/ landed, so I enabled one PID namespace for process for all NaCl processes, including ...
4 years, 3 months ago (2015-06-19 07:55:34 UTC) #43
commit-bot: I haz the power
CQ is trying da patch. Follow status at https://chromium-cq-status.appspot.com/patch-status/1158793003/180001
4 years, 3 months ago (2015-06-19 07:56:36 UTC) #46
commit-bot: I haz the power
Committed patchset #9 (id:180001)
4 years, 3 months ago (2015-06-19 08:30:40 UTC) #47
commit-bot: I haz the power
4 years, 3 months ago (2015-06-19 08:31:43 UTC) #48
Message was sent while issue was closed.
Patchset 9 (id:??) landed as
https://crrev.com/d423ad87b1fdc8a59a7c945c000bfbbd9d8b2245
Cr-Commit-Position: refs/heads/master@{#335223}

Powered by Google App Engine
This is Rietveld 408576698