OLD | NEW |
---|---|
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "sandbox/linux/services/libc_urandom_override.h" | 5 #include "sandbox/linux/services/libc_urandom_override.h" |
6 | 6 |
7 #include <dlfcn.h> | 7 #include <dlfcn.h> |
8 #include <pthread.h> | 8 #include <pthread.h> |
9 #include <stdio.h> | 9 #include <stdio.h> |
10 #include <sys/stat.h> | 10 #include <sys/stat.h> |
11 #include <unistd.h> | 11 #include <unistd.h> |
12 | 12 |
13 #include "base/logging.h" | 13 #include "base/logging.h" |
14 #include "base/posix/eintr_wrapper.h" | 14 #include "base/posix/eintr_wrapper.h" |
15 #include "base/rand_util.h" | 15 #include "base/rand_util.h" |
16 | 16 |
17 // Note: this file is used by the zygote and nacl_helper. | 17 // Note: this file is used by the zygote and nacl_helper. |
18 | 18 |
19 // This is used when mapping stat* calls to __xstat* calls. | |
20 #define XSTAT_VERSION 3 | |
21 | |
19 namespace sandbox { | 22 namespace sandbox { |
20 | 23 |
21 static bool g_override_urandom = false; | 24 static bool g_override_urandom = false; |
22 | 25 |
23 void InitLibcUrandomOverrides() { | |
24 // Make sure /dev/urandom is open. | |
25 base::GetUrandomFD(); | |
26 g_override_urandom = true; | |
27 } | |
28 | |
29 // TODO(sergeyu): Currently this code doesn't work properly under ASAN | 26 // TODO(sergeyu): Currently this code doesn't work properly under ASAN |
30 // - it crashes content_unittests. Make sure it works properly and | 27 // - it crashes content_unittests. Make sure it works properly and |
31 // enable it here. http://crbug.com/123263 | 28 // enable it here. http://crbug.com/123263 |
32 #if !defined(ADDRESS_SANITIZER) | 29 #if !defined(ADDRESS_SANITIZER) |
33 | 30 |
34 static const char kUrandomDevPath[] = "/dev/urandom"; | 31 static const char kUrandomDevPath[] = "/dev/urandom"; |
35 | 32 |
36 typedef FILE* (*FopenFunction)(const char* path, const char* mode); | 33 typedef FILE* (*FopenFunction)(const char* path, const char* mode); |
37 typedef int (*XstatFunction)(int version, const char *path, struct stat *buf); | 34 typedef int (*XstatFunction)(int version, const char *path, struct stat *buf); |
38 typedef int (*Xstat64Function)(int version, const char *path, | 35 typedef int (*Xstat64Function)(int version, const char *path, |
39 struct stat64 *buf); | 36 struct stat64 *buf); |
37 typedef int (*StatFunction)(const char *path, struct stat *buf); | |
38 typedef int (*Stat64Function)(const char *path, struct stat64 *buf); | |
39 typedef int (*FxstatFunction)(int version, int fd, struct stat *buf); | |
40 typedef int (*Fxstat64Function)(int version, int fd, struct stat64 *buf); | |
40 | 41 |
41 static pthread_once_t g_libc_file_io_funcs_guard = PTHREAD_ONCE_INIT; | 42 static pthread_once_t g_libc_file_io_funcs_guard = PTHREAD_ONCE_INIT; |
42 static FopenFunction g_libc_fopen; | 43 static FopenFunction g_libc_fopen = NULL; |
43 static FopenFunction g_libc_fopen64; | 44 static FopenFunction g_libc_fopen64 = NULL; |
44 static XstatFunction g_libc_xstat; | 45 static XstatFunction g_libc_xstat = NULL; |
45 static Xstat64Function g_libc_xstat64; | 46 static Xstat64Function g_libc_xstat64 = NULL; |
47 static StatFunction g_libc_stat = NULL; | |
48 static Stat64Function g_libc_stat64 = NULL; | |
49 static FxstatFunction g_libc_fxstat = NULL; | |
50 static Fxstat64Function g_libc_fxstat64 = NULL; | |
51 | |
52 void InitLibcUrandomOverrides() { | |
53 // Make sure /dev/urandom is open. | |
jln (very slow on Chromium)
2013/06/25 23:00:03
Calling InitLibcFileIOFunctions() here would guara
Mostyn Bramley-Moore
2013/06/26 10:30:18
Done.
| |
54 base::GetUrandomFD(); | |
55 g_override_urandom = true; | |
56 } | |
46 | 57 |
47 static void InitLibcFileIOFunctions() { | 58 static void InitLibcFileIOFunctions() { |
59 // find the libc's real fopen* and *stat* functions | |
jln (very slow on Chromium)
2013/06/25 23:00:03
Nit: comment above the function, start with a capi
Mostyn Bramley-Moore
2013/06/26 00:09:57
Done.
| |
60 | |
61 // TODO(mostynb): call this once near the start of the init sequence, don't | |
62 // call it repeatedly with pthread_once() - ZygoteMain is not early enough. | |
jln (very slow on Chromium)
2013/06/25 23:00:03
In practice it'll only be called once, right?
If
Mostyn Bramley-Moore
2013/06/25 23:40:41
This function is only called once, what I was tryi
jln (very slow on Chromium)
2013/06/26 01:57:21
Yeah, I'm not worried about mutiple calls to pthre
Mostyn Bramley-Moore
2013/06/26 10:30:18
Done in patchset 11.
| |
63 | |
48 g_libc_fopen = reinterpret_cast<FopenFunction>( | 64 g_libc_fopen = reinterpret_cast<FopenFunction>( |
49 dlsym(RTLD_NEXT, "fopen")); | 65 dlsym(RTLD_NEXT, "fopen")); |
50 g_libc_fopen64 = reinterpret_cast<FopenFunction>( | 66 g_libc_fopen64 = reinterpret_cast<FopenFunction>( |
51 dlsym(RTLD_NEXT, "fopen64")); | 67 dlsym(RTLD_NEXT, "fopen64")); |
52 | 68 |
53 if (!g_libc_fopen) { | 69 if (!g_libc_fopen) { |
54 LOG(FATAL) << "Failed to get fopen() from libc."; | 70 LOG(FATAL) << "Failed to get fopen() from libc."; |
55 } else if (!g_libc_fopen64) { | 71 } else if (!g_libc_fopen64) { |
56 #if !defined(OS_OPENBSD) && !defined(OS_FREEBSD) | 72 #if !defined(OS_OPENBSD) && !defined(OS_FREEBSD) |
57 LOG(WARNING) << "Failed to get fopen64() from libc. Using fopen() instead."; | 73 LOG(WARNING) << "Failed to get fopen64() from libc. Using fopen() instead."; |
58 #endif // !defined(OS_OPENBSD) && !defined(OS_FREEBSD) | 74 #endif // !defined(OS_OPENBSD) && !defined(OS_FREEBSD) |
59 g_libc_fopen64 = g_libc_fopen; | 75 g_libc_fopen64 = g_libc_fopen; |
60 } | 76 } |
61 | 77 |
62 #if defined(LIBC_GLIBC) | 78 // Note: we attempt to dlsym both stat and __xstat but only expect one |
63 // TODO(sergeyu): This works only on systems with glibc. Fix it to | 79 // of the calls to succeed (and similarly for the *64 versions). This |
64 // work properly on other systems if necessary. | 80 // should work with both glibc and uClibc, and hopefully other libc's. |
81 // Background: glibc headers inline stat into __xstat which it exports, | |
82 // while uClibc exports stat and does not implement __xstat. | |
83 | |
65 g_libc_xstat = reinterpret_cast<XstatFunction>( | 84 g_libc_xstat = reinterpret_cast<XstatFunction>( |
66 dlsym(RTLD_NEXT, "__xstat")); | 85 dlsym(RTLD_NEXT, "__xstat")); |
67 g_libc_xstat64 = reinterpret_cast<Xstat64Function>( | 86 g_libc_xstat64 = reinterpret_cast<Xstat64Function>( |
68 dlsym(RTLD_NEXT, "__xstat64")); | 87 dlsym(RTLD_NEXT, "__xstat64")); |
88 g_libc_stat = reinterpret_cast<StatFunction>( | |
89 dlsym(RTLD_NEXT, "stat")); | |
90 g_libc_stat64 = reinterpret_cast<Stat64Function>( | |
91 dlsym(RTLD_NEXT, "stat64")); | |
92 g_libc_fxstat = reinterpret_cast<FxstatFunction>( | |
93 dlsym(RTLD_NEXT, "__fxstat")); | |
94 g_libc_fxstat64 = reinterpret_cast<Fxstat64Function>( | |
95 dlsym(RTLD_NEXT, "__fxstat64")); | |
69 | 96 |
70 if (!g_libc_xstat) { | 97 if (!g_libc_xstat && !g_libc_stat) { |
71 LOG(FATAL) << "Failed to get __xstat() from libc."; | 98 LOG(FATAL) << "Neither __xstat nor stat found."; |
72 } | 99 } |
73 if (!g_libc_xstat64) { | 100 if (!g_libc_xstat64 && !g_libc_stat64) { |
74 LOG(WARNING) << "Failed to get __xstat64() from libc."; | 101 LOG(FATAL) << "Neither __xstat64 nor stat64 found."; |
75 } | 102 } |
103 | |
104 // Note: it's OK if __fxstat and __fxstat64 aren't found, | |
105 // we can map them to fstat and fstat64. | |
jln (very slow on Chromium)
2013/06/25 23:00:03
This makes everything way too complicated.
In wha
Mostyn Bramley-Moore
2013/06/25 23:40:41
In practice, probably none. As mentioned in my co
Mostyn Bramley-Moore
2013/06/26 10:30:18
Done (removed the fstat* dlsym's now).
| |
76 } | 106 } |
77 | 107 |
78 // fopen() and fopen64() are intercepted here so that NSS can open | 108 // fopen() and fopen64() are intercepted here so that NSS can open |
79 // /dev/urandom to seed its random number generator. NSS is used by | 109 // /dev/urandom to seed its random number generator. NSS is used by |
80 // remoting in the sendbox. | 110 // remoting in the sendbox. |
81 | 111 |
82 // fopen() call may be redirected to fopen64() in stdio.h using | 112 // fopen() call may be redirected to fopen64() in stdio.h using |
83 // __REDIRECT(), which sets asm name for fopen() to "fopen64". This | 113 // __REDIRECT(), which sets asm name for fopen() to "fopen64". This |
84 // means that we cannot override fopen() directly here. Instead the | 114 // means that we cannot override fopen() directly here. Instead the |
85 // the code below defines fopen_override() function with asm name | 115 // the code below defines fopen_override() function with asm name |
(...skipping 27 matching lines...) Expand all Loading... | |
113 return NULL; | 143 return NULL; |
114 } | 144 } |
115 return fdopen(fd, mode); | 145 return fdopen(fd, mode); |
116 } else { | 146 } else { |
117 CHECK_EQ(0, pthread_once(&g_libc_file_io_funcs_guard, | 147 CHECK_EQ(0, pthread_once(&g_libc_file_io_funcs_guard, |
118 InitLibcFileIOFunctions)); | 148 InitLibcFileIOFunctions)); |
119 return g_libc_fopen64(path, mode); | 149 return g_libc_fopen64(path, mode); |
120 } | 150 } |
121 } | 151 } |
122 | 152 |
123 // stat() is subject to the same problem as fopen(), so we have to use | 153 // The stat() family of functions are subject to the same problem as |
124 // the same trick to override it. | 154 // fopen(), so we have to use the same trick to override them. |
155 | |
125 __attribute__ ((__visibility__("default"))) | 156 __attribute__ ((__visibility__("default"))) |
126 int xstat_override(int version, | 157 int xstat_override(int version, |
127 const char *path, | 158 const char *path, |
128 struct stat *buf) __asm__ ("__xstat"); | 159 struct stat *buf) __asm__ ("__xstat"); |
129 | 160 |
130 __attribute__ ((__visibility__("default"))) | 161 __attribute__ ((__visibility__("default"))) |
131 int xstat_override(int version, const char *path, struct stat *buf) { | 162 int xstat_override(int version, const char *path, struct stat *buf) { |
163 CHECK_EQ(0, pthread_once(&g_libc_file_io_funcs_guard, | |
164 InitLibcFileIOFunctions)); | |
165 | |
132 if (g_override_urandom && strcmp(path, kUrandomDevPath) == 0) { | 166 if (g_override_urandom && strcmp(path, kUrandomDevPath) == 0) { |
133 int result = __fxstat(version, base::GetUrandomFD(), buf); | 167 if (g_libc_fxstat) { |
134 return result; | 168 int result = g_libc_fxstat(version, base::GetUrandomFD(), buf); |
169 return result; | |
170 } else { | |
171 int result = fstat(base::GetUrandomFD(), buf); | |
172 return result; | |
jln (very slow on Chromium)
2013/06/25 23:00:03
See my above comment, the logic becomes way too co
Mostyn Bramley-Moore
2013/06/25 23:40:41
It should be safe to simply use fstat directly her
Mostyn Bramley-Moore
2013/06/26 10:30:18
Done (reverted).
| |
173 } | |
174 } | |
175 else if (!g_libc_xstat) { | |
176 return g_libc_stat(path, buf); | |
135 } else { | 177 } else { |
136 CHECK_EQ(0, pthread_once(&g_libc_file_io_funcs_guard, | |
137 InitLibcFileIOFunctions)); | |
138 return g_libc_xstat(version, path, buf); | 178 return g_libc_xstat(version, path, buf); |
139 } | 179 } |
140 } | 180 } |
141 | 181 |
142 __attribute__ ((__visibility__("default"))) | 182 __attribute__ ((__visibility__("default"))) |
143 int xstat64_override(int version, | 183 int xstat64_override(int version, |
144 const char *path, | 184 const char *path, |
145 struct stat64 *buf) __asm__ ("__xstat64"); | 185 struct stat64 *buf) __asm__ ("__xstat64"); |
146 | 186 |
147 __attribute__ ((__visibility__("default"))) | 187 __attribute__ ((__visibility__("default"))) |
148 int xstat64_override(int version, const char *path, struct stat64 *buf) { | 188 int xstat64_override(int version, const char *path, struct stat64 *buf) { |
189 CHECK_EQ(0, pthread_once(&g_libc_file_io_funcs_guard, | |
190 InitLibcFileIOFunctions)); | |
191 | |
149 if (g_override_urandom && strcmp(path, kUrandomDevPath) == 0) { | 192 if (g_override_urandom && strcmp(path, kUrandomDevPath) == 0) { |
150 int result = __fxstat64(version, base::GetUrandomFD(), buf); | 193 if (g_libc_fxstat64) { |
151 return result; | 194 int result = g_libc_fxstat64(version, base::GetUrandomFD(), buf); |
195 return result; | |
196 } else { | |
197 int result = fstat64(base::GetUrandomFD(), buf); | |
198 return result; | |
199 } | |
200 } | |
201 else if (!g_libc_xstat64) { | |
202 return g_libc_stat64(path, buf); | |
152 } else { | 203 } else { |
153 CHECK_EQ(0, pthread_once(&g_libc_file_io_funcs_guard, | |
154 InitLibcFileIOFunctions)); | |
155 CHECK(g_libc_xstat64); | |
156 return g_libc_xstat64(version, path, buf); | 204 return g_libc_xstat64(version, path, buf); |
157 } | 205 } |
158 } | 206 } |
159 #endif // defined(LIBC_GLIBC) | 207 |
208 __attribute__ ((__visibility__("default"))) | |
209 int stat_override(const char *path, | |
210 struct stat *buf) __asm__ ("stat"); | |
211 | |
212 __attribute__ ((__visibility__("default"))) | |
213 int stat_override(const char *path, struct stat *buf) { | |
214 if (g_override_urandom && strcmp(path, kUrandomDevPath) == 0) { | |
215 int result = fstat(base::GetUrandomFD(), buf); | |
216 return result; | |
217 } | |
218 | |
219 CHECK_EQ(0, pthread_once(&g_libc_file_io_funcs_guard, | |
220 InitLibcFileIOFunctions)); | |
221 | |
222 if (!g_libc_stat) { | |
223 return g_libc_xstat(XSTAT_VERSION, path, buf); | |
224 } else { | |
225 return g_libc_stat(path, buf); | |
226 } | |
227 } | |
228 | |
229 __attribute__ ((__visibility__("default"))) | |
230 int stat64_override(const char *path, | |
231 struct stat64 *buf) __asm__ ("stat64"); | |
232 | |
233 __attribute__ ((__visibility__("default"))) | |
234 int stat64_override(const char *path, struct stat64 *buf) { | |
235 if (g_override_urandom && strcmp(path, kUrandomDevPath) == 0) { | |
236 int result = fstat64(base::GetUrandomFD(), buf); | |
237 return result; | |
238 } | |
239 | |
240 CHECK_EQ(0, pthread_once(&g_libc_file_io_funcs_guard, | |
241 InitLibcFileIOFunctions)); | |
242 | |
243 if (!g_libc_stat64) { | |
244 return g_libc_xstat64(XSTAT_VERSION, path, buf); | |
245 } else { | |
246 return g_libc_stat64(path, buf); | |
247 } | |
248 } | |
160 | 249 |
161 #endif // !defined(ADDRESS_SANITIZER) | 250 #endif // !defined(ADDRESS_SANITIZER) |
162 | 251 |
163 } // namespace content | 252 } // namespace content |
OLD | NEW |