Linux: SUID sandbox support

chrome/browser/zygote_host_linux.cc

 // Copyright (c) 2009 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/zygote_host_linux.h"
 
 #include <unistd.h>
 #include <sys/types.h>
 #include <sys/socket.h>
+#include <sys/stat.h>
 
 #include "base/command_line.h"
 #include "base/eintr_wrapper.h"
 #include "base/logging.h"
 #include "base/path_service.h"
 #include "base/pickle.h"
 #include "base/process_util.h"
+#include "base/string_util.h"
 #include "base/unix_domain_socket_posix.h"
 
 #include "chrome/browser/renderer_host/render_sandbox_host_linux.h"
+#include "chrome/common/chrome_constants.h"
 #include "chrome/common/chrome_switches.h"
 
 ZygoteHost::ZygoteHost() {
   std::wstring chrome_path;
   CHECK(PathService::Get(base::FILE_EXE, &chrome_path));
   CommandLine cmd_line(chrome_path);
 
   cmd_line.AppendSwitchWithValue(switches::kProcessType,
                                  switches::kZygoteProcess);
 
   int fds[2];
   CHECK(socketpair(PF_UNIX, SOCK_SEQPACKET, 0, fds) == 0);
   base::file_handle_mapping_vector fds_to_map;
   fds_to_map.push_back(std::make_pair(fds[1], 3));
 
   const CommandLine& browser_command_line = *CommandLine::ForCurrentProcess();
   if (browser_command_line.HasSwitch(switches::kZygoteCmdPrefix)) {
     const std::wstring prefix =
         browser_command_line.GetSwitchValue(switches::kZygoteCmdPrefix);
     cmd_line.PrependWrapper(prefix);
   }
 
+  const std::string kSandboxPath =
+    WideToASCII(std::wstring(L"/var/run/") +
+                chrome::kBrowserProcessExecutableName +
+                L"-sandbox");
+
+  const std::string sandbox_bin = WideToASCII(chrome_path) + "-sandbox";
+  struct stat st;
+  if (access(sandbox_bin.c_str(), X_OK) == 0 &&
+      stat(sandbox_bin.c_str(), &st) == 0 &&
+      (st.st_mode & S_ISUID) &&
+      (st.st_mode & S_IXOTH) &&
+      access(kSandboxPath.c_str(), F_OK) == 0) {
+    cmd_line.PrependWrapper(chrome_path + L"-sandbox");
+  }
+
   // Start up the sandbox host process and get the file descriptor for the
   // renderers to talk to it.
   const int sfd = Singleton<RenderSandboxHostLinux>()->GetRendererSocket();
   fds_to_map.push_back(std::make_pair(sfd, 5));
 
   base::ProcessHandle process;
   base::LaunchApp(cmd_line.argv(), fds_to_map, false, &process);
   CHECK(process != -1) << "Failed to launch zygote process";
 
   close(fds[1]);
@@ skipping 70 matching lines @@
       !read_pickle.ReadBool(&iter, &tmp_child_exited)) {
     LOG(WARNING) << "Error parsing DidProcessCrash response from zygote.";
     return false;
   }
 
   if (child_exited)
     *child_exited = tmp_child_exited;
 
   return did_crash;
 }