Linux Sandbox: show Yama status in about:sandbox

content/common/sandbox_linux/sandbox_linux.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <dirent.h>
 #include <fcntl.h>
 #include <sys/resource.h>
 #include <sys/stat.h>
 #include <sys/time.h>
 #include <sys/types.h>
@@ skipping 10 matching lines @@
 #include "base/posix/eintr_wrapper.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/time/time.h"
 #include "build/build_config.h"
 #include "content/common/sandbox_linux/sandbox_linux.h"
 #include "content/common/sandbox_linux/sandbox_seccomp_bpf_linux.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/common/sandbox_linux.h"
 #include "sandbox/linux/services/credentials.h"
 #include "sandbox/linux/services/thread_helpers.h"
+#include "sandbox/linux/services/yama.h"
 #include "sandbox/linux/suid/client/setuid_sandbox_client.h"
 
+using sandbox::Yama;
+
 namespace {
 
 struct FDCloser {
   inline void operator()(int* fd) const {
     DCHECK(fd);
     PCHECK(0 == IGNORE_EINTR(close(*fd)));
     *fd = -1;
   }
 };
 
@@ skipping 54 matching lines @@
 }  // namespace
 
 namespace content {
 
 LinuxSandbox::LinuxSandbox()
     : proc_fd_(-1),
       seccomp_bpf_started_(false),
       sandbox_status_flags_(kSandboxLinuxInvalid),
       pre_initialized_(false),
       seccomp_bpf_supported_(false),
+      yama_is_enforcing_(false),
       setuid_sandbox_client_(sandbox::SetuidSandboxClient::Create()) {
   if (setuid_sandbox_client_ == NULL) {
     LOG(FATAL) << "Failed to instantiate the setuid sandbox client.";
   }
 }
 
 LinuxSandbox::~LinuxSandbox() {
 }
 
 LinuxSandbox* LinuxSandbox::GetInstance() {
   LinuxSandbox* instance = Singleton<LinuxSandbox>::get();
   CHECK(instance);
   return instance;
 }
 
 #if defined(ADDRESS_SANITIZER) && defined(OS_LINUX)
 // ASan API call to notify the tool the sandbox is going to be turned on.
 extern "C" void __sanitizer_sandbox_on_notify(void *reserved);
 #endif
 
 void LinuxSandbox::PreinitializeSandbox() {
   CHECK(!pre_initialized_);
   seccomp_bpf_supported_ = false;
 #if defined(ADDRESS_SANITIZER) && defined(OS_LINUX)
   // ASan needs to open some resources before the sandbox is enabled.
   // This should not fork, not launch threads, not open a directory.
-  __sanitizer_sandbox_on_notify(/*reserved*/NULL);
+  __sanitizer_sandbox_on_notify(/*reserved*/ NULL);
 #endif
 
 #if !defined(NDEBUG)
   // Open proc_fd_ only in Debug mode so that forgetting to close it doesn't
   // produce a sandbox escape in Release mode.
   proc_fd_ = open("/proc", O_DIRECTORY | O_RDONLY);
   CHECK_GE(proc_fd_, 0);
 #endif  // !defined(NDEBUG)
   // We "pre-warm" the code that detects supports for seccomp BPF.
   if (SandboxSeccompBPF::IsSeccompBPFDesired()) {
     if (!SandboxSeccompBPF::SupportsSandbox()) {
       VLOG(1) << "Lacking support for seccomp-bpf sandbox.";
     } else {
       seccomp_bpf_supported_ = true;
     }
   }
+
+  // Yama is a "global", system-level status. We assume it will not regress
+  // after startup.
+  const int yama_status = Yama::GetStatus();
+  yama_is_enforcing_ = (yama_status & Yama::STATUS_PRESENT) &&
+                       (yama_status & Yama::STATUS_ENFORCING);
   pre_initialized_ = true;
 }
 
 bool LinuxSandbox::InitializeSandbox() {
   LinuxSandbox* linux_sandbox = LinuxSandbox::GetInstance();
   return linux_sandbox->InitializeSandboxImpl();
 }
 
 void LinuxSandbox::StopThread(base::Thread* thread) {
   LinuxSandbox* linux_sandbox = LinuxSandbox::GetInstance();
@@ skipping 12 matching lines @@
       if (setuid_sandbox_client_->IsInNewNETNamespace())
         sandbox_status_flags_ |= kSandboxLinuxNetNS;
     }
 
     // We report whether the sandbox will be activated when renderers, workers
     // and PPAPI plugins go through sandbox initialization.
     if (seccomp_bpf_supported() &&
         SandboxSeccompBPF::ShouldEnableSeccompBPF(switches::kRendererProcess)) {
       sandbox_status_flags_ |= kSandboxLinuxSeccompBPF;
     }
+
+    if (yama_is_enforcing_) {
+      sandbox_status_flags_ |= kSandboxLinuxYama;
+    }
   }
 
   return sandbox_status_flags_;
 }
 
 // Threads are counted via /proc/self/task. This is a little hairy because of
 // PID namespaces and existing sandboxes, so "self" must really be used instead
 // of using the pid.
 bool LinuxSandbox::IsSingleThreaded() const {
   bool is_single_threaded = false;
@@ skipping 174 matching lines @@
 void LinuxSandbox::StopThreadAndEnsureNotCounted(base::Thread* thread) const {
   DCHECK(thread);
   int proc_self_task = OpenProcTaskFd(proc_fd_);
   PCHECK(proc_self_task >= 0);
   SafeScopedFD task_closer(&proc_self_task);
   CHECK(
       sandbox::ThreadHelpers::StopThreadAndWatchProcFS(proc_self_task, thread));
 }
 
 }  // namespace content