Build ForkWithFlags and part of NamespaceSandbox under nonsfi newlib.

sandbox/linux/services/namespace_sandbox.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sandbox/linux/services/namespace_sandbox.h"
 
 #include <sched.h>
 #include <signal.h>
 #include <stdlib.h>
 #include <sys/types.h>
 #include <unistd.h>
 
 #include <string>
 #include <utility>
 #include <vector>
 
 #include "base/command_line.h"
 #include "base/environment.h"
 #include "base/files/scoped_file.h"
 #include "base/logging.h"
 #include "base/macros.h"
 #include "base/posix/eintr_wrapper.h"
 #include "base/process/launch.h"
 #include "base/process/process.h"
 #include "sandbox/linux/services/credentials.h"
 #include "sandbox/linux/services/namespace_utils.h"
+#include "sandbox/linux/system_headers/linux_signal.h"
 
 namespace sandbox {
 
 namespace {
 
 const char kSandboxUSERNSEnvironmentVarName[] = "SBX_USER_NS";
 const char kSandboxPIDNSEnvironmentVarName[] = "SBX_PID_NS";
 const char kSandboxNETNSEnvironmentVarName[] = "SBX_NET_NS";
 
 #if !defined(OS_NACL_NONSFI)
@@ skipping 21 matching lines @@
   const bool supports_deny_setgroups_;
   DISALLOW_COPY_AND_ASSIGN(WriteUidGidMapDelegate);
 };
 
 void SetEnvironForNamespaceType(base::EnvironmentMap* environ,
                                 base::NativeEnvironmentString env_var,
                                 bool value) {
   // An empty string causes the env var to be unset in the child process.
   (*environ)[env_var] = value ? "1" : "";
 }
+#endif  // !defined(OS_NACL_NONSFI)
 
 // Linux supports up to 64 signals. This should be updated if that ever changes.
 int g_signal_exit_codes[64];
 
 void TerminationSignalHandler(int sig) {
   // Return a special exit code so that the process is detected as terminated by
   // a signal.
   const size_t sig_idx = static_cast<size_t>(sig);
   if (sig_idx < arraysize(g_signal_exit_codes)) {
     _exit(g_signal_exit_codes[sig_idx]);
   }
 
   _exit(NamespaceSandbox::kDefaultExitCode);
 }
-#endif  // !defined(OS_NACL_NONSFI)
 
 }  // namespace
 
 #if !defined(OS_NACL_NONSFI)
 // static
 base::Process NamespaceSandbox::LaunchProcess(
     const base::CommandLine& cmdline,
     const base::LaunchOptions& options) {
   return LaunchProcess(cmdline.argv(), options);
 }
@@ skipping 29 matching lines @@
 
   base::EnvironmentMap* environ = &launch_options.environ;
   for (const auto& entry : clone_flag_environ) {
     const int flag = entry.first;
     const char* environ_name = entry.second;
     SetEnvironForNamespaceType(environ, environ_name, clone_flags & flag);
   }
 
   return base::LaunchProcess(argv, launch_options);
 }
+#endif  // !defined(OS_NACL_NONSFI)
 
 // static
 pid_t NamespaceSandbox::ForkInNewPidNamespace(bool drop_capabilities_in_child) {
   const pid_t pid =
-      base::ForkWithFlags(CLONE_NEWPID | SIGCHLD, nullptr, nullptr);
+      base::ForkWithFlags(CLONE_NEWPID | LINUX_SIGCHLD, nullptr, nullptr);
   if (pid < 0) {
     return pid;
   }
 
   if (pid == 0) {
     DCHECK_EQ(1, getpid());
     if (drop_capabilities_in_child) {
       // Since we just forked, we are single-threaded, so this should be safe.
       CHECK(Credentials::DropAllCapabilitiesOnCurrentThread());
     }
     return 0;
   }
 
   return pid;
 }
 
 // static
 void NamespaceSandbox::InstallDefaultTerminationSignalHandlers() {
   static const int kDefaultTermSignals[] = {
       SIGHUP, SIGINT, SIGABRT, SIGQUIT, SIGPIPE, SIGTERM, SIGUSR1, SIGUSR2,

[hidehiko, 2015/06/16 05:41:53]

These values are incompatible with Linux ABIs under OS_NACL_NONSFI build. Could
you take a look at linux_signal.h?

[rickyz (no longer on Chrome), 2015/06/16 20:57:06]

Oops, thanks!

   };
 
   for (const int sig : kDefaultTermSignals) {
     InstallTerminationSignalHandler(sig, kDefaultExitCode);
   }
 }
 
 // static
 bool NamespaceSandbox::InstallTerminationSignalHandler(
     int sig,
     int exit_code) {
   struct sigaction old_action;
   PCHECK(sigaction(sig, nullptr, &old_action) == 0);

[hidehiko, 2015/06/16 05:41:53]

Youl'll need to call sys_sigaction instead. Ditto for below.

[rickyz (no longer on Chrome), 2015/06/16 20:57:07]

Oops, done - do you know whether we need our own definition of struct sigaction
as well then? I remember you saying something about sigset_t having a different
size before.

I wonder how much work it'd be to make our unit tests compile under newlib
nonsfi NaCl. Seems like there's a decent risk of bugs in these things slipping
through :-

 
+#if !defined(OS_NACL_NONSFI)
   if (old_action.sa_flags & SA_SIGINFO &&
       old_action.sa_sigaction != nullptr) {
     return false;
-  } else if (old_action.sa_handler != SIG_DFL) {
+  } else

[hidehiko, 2015/06/16 05:41:53]

nit: you don't need "else"

[rickyz (no longer on Chrome), 2015/06/16 20:57:06]

Done.

+#endif
+  if (old_action.sa_handler != SIG_DFL) {

[hidehiko, 2015/06/16 05:41:53]

SIG_DFL needs to be LINUX_SIG_DFL.

[rickyz (no longer on Chrome), 2015/06/16 20:57:06]

Done.

     return false;
   }
 
   const size_t sig_idx = static_cast<size_t>(sig);
   CHECK_LT(sig_idx, arraysize(g_signal_exit_codes));
 
   DCHECK_GE(exit_code, 0);
   DCHECK_LT(exit_code, 256);
 
   g_signal_exit_codes[sig_idx] = exit_code;
 
   struct sigaction action = {};
   action.sa_handler = &TerminationSignalHandler;
   PCHECK(sigaction(sig, &action, nullptr) == 0);
   return true;
 }
-#endif  // !defined(OS_NACL_NONSFI)
 
 // static
 bool NamespaceSandbox::InNewUserNamespace() {
   return getenv(kSandboxUSERNSEnvironmentVarName) != nullptr;
 }
 
 // static
 bool NamespaceSandbox::InNewPidNamespace() {
   return getenv(kSandboxPIDNSEnvironmentVarName) != nullptr;
 }
 
 // static
 bool NamespaceSandbox::InNewNetNamespace() {
   return getenv(kSandboxNETNSEnvironmentVarName) != nullptr;
 }
 
 }  // namespace sandbox