attempt to make the libc urandom override work for non-glibc too

sandbox/linux/services/libc_urandom_override.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sandbox/linux/services/libc_urandom_override.h"
 
 #include <dlfcn.h>
 #include <pthread.h>
 #include <stdio.h>
 #include <sys/stat.h>
 #include <unistd.h>
 
 #include "base/logging.h"
 #include "base/posix/eintr_wrapper.h"
 #include "base/rand_util.h"
 
 // Note: this file is used by the zygote and nacl_helper.
 
+#if defined(LIBC_GLIBC)
+#define HAVE_XSTAT
+#endif
+
 namespace sandbox {
 
 static bool g_override_urandom = false;
 
 void InitLibcUrandomOverrides() {
   // Make sure /dev/urandom is open.
   base::GetUrandomFD();
   g_override_urandom = true;
 }
 
 // TODO(sergeyu): Currently this code doesn't work properly under ASAN
 // - it crashes content_unittests. Make sure it works properly and
 // enable it here. http://crbug.com/123263
 #if !defined(ADDRESS_SANITIZER)
 
 static const char kUrandomDevPath[] = "/dev/urandom";
 
 typedef FILE* (*FopenFunction)(const char* path, const char* mode);
+typedef int (*StatFunction)(const char *path, struct stat *buf);
+typedef int (*Stat64Function)(const char *path, struct stat64 *buf);
+
+static pthread_once_t g_libc_file_io_funcs_guard = PTHREAD_ONCE_INIT;
+static FopenFunction g_libc_fopen;
+static FopenFunction g_libc_fopen64;
+static StatFunction g_libc_stat;
+static Stat64Function g_libc_stat64;
+
+#if defined(HAVE_XSTAT)
 typedef int (*XstatFunction)(int version, const char *path, struct stat *buf);
 typedef int (*Xstat64Function)(int version, const char *path,
                                struct stat64 *buf);
 
-static pthread_once_t g_libc_file_io_funcs_guard = PTHREAD_ONCE_INIT;
-static FopenFunction g_libc_fopen;
-static FopenFunction g_libc_fopen64;
 static XstatFunction g_libc_xstat;
 static Xstat64Function g_libc_xstat64;
+#endif  // defined(HAVE_XSTAT)
 
 static void InitLibcFileIOFunctions() {
   g_libc_fopen = reinterpret_cast<FopenFunction>(
       dlsym(RTLD_NEXT, "fopen"));
   g_libc_fopen64 = reinterpret_cast<FopenFunction>(
       dlsym(RTLD_NEXT, "fopen64"));
 
   if (!g_libc_fopen) {
     LOG(FATAL) << "Failed to get fopen() from libc.";
   } else if (!g_libc_fopen64) {
 #if !defined(OS_OPENBSD) && !defined(OS_FREEBSD)
     LOG(WARNING) << "Failed to get fopen64() from libc. Using fopen() instead.";
 #endif  // !defined(OS_OPENBSD) && !defined(OS_FREEBSD)
     g_libc_fopen64 = g_libc_fopen;
   }
 
-#if defined(LIBC_GLIBC)
-  // TODO(sergeyu): This works only on systems with glibc. Fix it to
-  // work properly on other systems if necessary.
+  // TODO(sergeyu, mostynb): Hopefully the stat/xstat overrides can work

[Sergey Ulanov, 2013/06/14 20:13:47]

nit: This TODO seems to be too vague to be actionable. Maybe remove TODO() and
leave the rest of the comment as is.

[Mostyn Bramley-Moore, 2013/06/14 20:38:23]

Done.

+  // on glibc, uClibc and others.  It would be good to verify that we
+  // don't need to override any other stat family functions in the case
+  // where xstat is not available.
+
+  g_libc_stat = reinterpret_cast<StatFunction>(
+      dlsym(RTLD_NEXT, "stat"));
+  g_libc_stat64 = reinterpret_cast<Stat64Function>(
+      dlsym(RTLD_NEXT, "stat64"));
+
+  if (!g_libc_stat) {
+    LOG(FATAL) << "Failed to get stat() from libc.";
+  }
+  if (!g_libc_stat64) {
+    LOG(WARNING) << "Failed to get stat64() from libc.";

[jln (very slow on Chromium), 2013/06/14 19:43:16]

It looks like the rationale for doing a LOG(WARNING) rather than LOG(FATAL)
above is that there is a fallback from fopen64 to fopen.

Since it's not the case here, please LOG(FATAL). (In general I would rather
discourage the use of untested fallbacks).

For consistency, please patch the LOG(WARNING) below as well.

Unless of course we know that for some reason I missed we recover from missing
*64 functions gracefully.

[Mostyn Bramley-Moore, 2013/06/14 20:38:23]

I made this change in patchset 2, but now I think we might need to wrap the *64
functions in __USE_LARGEFILE64 ifdefs- though I need to see if this will work
for freebsd/openbsd too first.

+  }
+
+#if defined(HAVE_XSTAT)
   g_libc_xstat = reinterpret_cast<XstatFunction>(
       dlsym(RTLD_NEXT, "__xstat"));
   g_libc_xstat64 = reinterpret_cast<Xstat64Function>(
       dlsym(RTLD_NEXT, "__xstat64"));
 
   if (!g_libc_xstat) {
     LOG(FATAL) << "Failed to get __xstat() from libc.";
   }
   if (!g_libc_xstat64) {
     LOG(WARNING) << "Failed to get __xstat64() from libc.";
   }
+#endif  // defined(HAVE_XSTAT)
 }
 
 // fopen() and fopen64() are intercepted here so that NSS can open
 // /dev/urandom to seed its random number generator. NSS is used by
 // remoting in the sendbox.
 
 // fopen() call may be redirected to fopen64() in stdio.h using
 // __REDIRECT(), which sets asm name for fopen() to "fopen64". This
 // means that we cannot override fopen() directly here. Instead the
 // the code below defines fopen_override() function with asm name
@@ skipping 27 matching lines @@
       return NULL;
     }
     return fdopen(fd, mode);
   } else {
     CHECK_EQ(0, pthread_once(&g_libc_file_io_funcs_guard,
                              InitLibcFileIOFunctions));
     return g_libc_fopen64(path, mode);
   }
 }
 
-// stat() is subject to the same problem as fopen(), so we have to use
-// the same trick to override it.
+// The stat() family of functions are subject to the same problem as
+// fopen(), so we have to use the same trick to override them.
+
+__attribute__ ((__visibility__("default")))
+int stat_override(const char *path,
+                   struct stat *buf)  __asm__ ("stat");
+
+__attribute__ ((__visibility__("default")))
+int stat_override(const char *path, struct stat *buf) {
+  if (g_override_urandom && strcmp(path, kUrandomDevPath) == 0) {
+    int result = fstat(base::GetUrandomFD(), buf);
+    return result;
+  } else {
+    CHECK_EQ(0, pthread_once(&g_libc_file_io_funcs_guard,
+                             InitLibcFileIOFunctions));
+    return g_libc_stat(path, buf);
+  }
+}
+
+__attribute__ ((__visibility__("default")))
+int stat64_override(const char *path,
+                     struct stat64 *buf)  __asm__ ("stat64");
+
+__attribute__ ((__visibility__("default")))
+int stat64_override(const char *path, struct stat64 *buf) {
+  if (g_override_urandom && strcmp(path, kUrandomDevPath) == 0) {
+    int result = fstat64(base::GetUrandomFD(), buf);
+    return result;
+  } else {
+    CHECK_EQ(0, pthread_once(&g_libc_file_io_funcs_guard,
+                             InitLibcFileIOFunctions));
+    CHECK(g_libc_stat64);
+    return g_libc_stat64(path, buf);
+  }
+}
+
+#if defined(HAVE_XSTAT)
+// glibc implements the stat() family by using __xstat() variants,
+// so this should be sufficient to catch all such calls.  We leave
+// the stat overrides outside this ifdef in the hope of making this
+// work for other libc's.
+
 __attribute__ ((__visibility__("default")))
 int xstat_override(int version,
                    const char *path,
                    struct stat *buf)  __asm__ ("__xstat");
 
 __attribute__ ((__visibility__("default")))
 int xstat_override(int version, const char *path, struct stat *buf) {
   if (g_override_urandom && strcmp(path, kUrandomDevPath) == 0) {
     int result = __fxstat(version, base::GetUrandomFD(), buf);
     return result;
@@ skipping 14 matching lines @@
   if (g_override_urandom && strcmp(path, kUrandomDevPath) == 0) {
     int result = __fxstat64(version, base::GetUrandomFD(), buf);
     return result;
   } else {
     CHECK_EQ(0, pthread_once(&g_libc_file_io_funcs_guard,
                              InitLibcFileIOFunctions));
     CHECK(g_libc_xstat64);
     return g_libc_xstat64(version, path, buf);
   }
 }
-#endif  // defined(LIBC_GLIBC)
+#endif  // defined(HAVE_XSTAT)
 
 #endif  // !defined(ADDRESS_SANITIZER)
 
 }  // namespace content