mandoline sandbox: prewarm libraries before we raise the sandbox.

mojo/runner/linux_sandbox.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "mandoline/app/desktop/linux_sandbox.h"
+#include "mojo/runner/linux_sandbox.h"
 
 #include <fcntl.h>
 #include <sys/syscall.h>
 
 #include "base/bind.h"
 #include "base/debug/leak_annotations.h"
 #include "base/posix/eintr_wrapper.h"
 #include "base/rand_util.h"
 #include "base/sys_info.h"
 #include "sandbox/linux/bpf_dsl/policy.h"
 #include "sandbox/linux/bpf_dsl/trap_registry.h"
 #include "sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.h"
 #include "sandbox/linux/seccomp-bpf-helpers/syscall_sets.h"
 #include "sandbox/linux/seccomp-bpf/sandbox_bpf.h"
 #include "sandbox/linux/services/credentials.h"
 #include "sandbox/linux/services/namespace_sandbox.h"
 #include "sandbox/linux/services/proc_util.h"
+#include "sandbox/linux/services/thread_helpers.h"
 
 using sandbox::syscall_broker::BrokerFilePermission;
 
 namespace mandoline {
 
 namespace {
 
 intptr_t SandboxSIGSYSHandler(const struct sandbox::arch_seccomp_data& args,
                               void* aux) {
   RAW_CHECK(aux);
@@ skipping 58 matching lines @@
 
 LinuxSandbox::LinuxSandbox(const std::vector<BrokerFilePermission>& permissions)
     : broker_(new sandbox::syscall_broker::BrokerProcess(EPERM, permissions)) {
   broker_->Init(
       base::Bind<bool (*)()>(&sandbox::Credentials::DropAllCapabilities));
   policy_.reset(new SandboxPolicy(broker_.get()));
 }
 
 LinuxSandbox::~LinuxSandbox() {}
 
-// static
-std::vector<BrokerFilePermission> LinuxSandbox::GetPermissions() {
-  std::vector<BrokerFilePermission> permissions;
-  permissions.push_back(BrokerFilePermission::ReadOnly("/dev/urandom"));
-  permissions.push_back(BrokerFilePermission::ReadOnly("/etc/ld.so.cache"));
-  permissions.push_back(BrokerFilePermission::ReadOnlyRecursive("/lib/"));
-  permissions.push_back(BrokerFilePermission::ReadOnlyRecursive("/usr/lib/"));
-  return permissions;
-}
-
 void LinuxSandbox::Warmup() {
   proc_fd_ = sandbox::ProcUtil::OpenProc();
   warmed_up_ = true;
+
+  // Verify that we haven't started threads or grabbed directory file
+  // descriptors.
+  sandbox::ThreadHelpers::AssertSingleThreaded(proc_fd_.get());
+  CHECK(!sandbox::ProcUtil::HasOpenDirectory(proc_fd_.get()));
 }
 
 void LinuxSandbox::EngageNamespaceSandbox() {
   CHECK(warmed_up_);
   CHECK_EQ(1, getpid());
   CHECK(sandbox::NamespaceSandbox::InNewPidNamespace());
   CHECK(sandbox::Credentials::MoveToNewUserNS());
   CHECK(sandbox::Credentials::DropFileSystemAccess(proc_fd_.get()));
   CHECK(sandbox::Credentials::DropAllCapabilities(proc_fd_.get()));
 }
@@ skipping 12 matching lines @@
   // The Broker is now bound to this process and should only be destroyed when
   // the process exits or is killed.
   ANNOTATE_LEAKING_OBJECT_PTR(broker_.release());
 }
 
 void LinuxSandbox::Seal() {
   proc_fd_.reset();
 }
 
 }  // namespace mandoline