| OLD | NEW |
| 1 // Copyright 2013 The Chromium Authors. All rights reserved. | 1 // Copyright 2013 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 // A mini-zygote specifically for Native Client. | 5 // A mini-zygote specifically for Native Client. |
| 6 | 6 |
| 7 #include "components/nacl/loader/nacl_helper_linux.h" | 7 #include "components/nacl/loader/nacl_helper_linux.h" |
| 8 | 8 |
| 9 #include <errno.h> | 9 #include <errno.h> |
| 10 #include <fcntl.h> | 10 #include <fcntl.h> |
| (...skipping 18 matching lines...) Expand all Loading... |
| 29 #include "base/posix/eintr_wrapper.h" | 29 #include "base/posix/eintr_wrapper.h" |
| 30 #include "base/posix/global_descriptors.h" | 30 #include "base/posix/global_descriptors.h" |
| 31 #include "base/posix/unix_domain_socket_linux.h" | 31 #include "base/posix/unix_domain_socket_linux.h" |
| 32 #include "base/process/kill.h" | 32 #include "base/process/kill.h" |
| 33 #include "base/process/process_handle.h" | 33 #include "base/process/process_handle.h" |
| 34 #include "base/rand_util.h" | 34 #include "base/rand_util.h" |
| 35 #include "build/build_config.h" | 35 #include "build/build_config.h" |
| 36 #include "components/nacl/common/nacl_switches.h" | 36 #include "components/nacl/common/nacl_switches.h" |
| 37 #include "components/nacl/loader/sandbox_linux/nacl_sandbox_linux.h" | 37 #include "components/nacl/loader/sandbox_linux/nacl_sandbox_linux.h" |
| 38 #include "content/public/common/content_descriptors.h" | 38 #include "content/public/common/content_descriptors.h" |
| 39 #include "content/public/common/mojo_channel_switches.h" |
| 39 #include "content/public/common/send_zygote_child_ping_linux.h" | 40 #include "content/public/common/send_zygote_child_ping_linux.h" |
| 40 #include "content/public/common/zygote_fork_delegate_linux.h" | 41 #include "content/public/common/zygote_fork_delegate_linux.h" |
| 41 #include "ipc/ipc_descriptors.h" | 42 #include "ipc/ipc_descriptors.h" |
| 42 #include "ipc/ipc_switches.h" | 43 #include "ipc/ipc_switches.h" |
| 43 #include "mojo/edk/embedder/embedder.h" | 44 #include "mojo/edk/embedder/embedder.h" |
| 44 #include "sandbox/linux/services/credentials.h" | 45 #include "sandbox/linux/services/credentials.h" |
| 45 #include "sandbox/linux/services/namespace_sandbox.h" | 46 #include "sandbox/linux/services/namespace_sandbox.h" |
| 46 | 47 |
| 47 #if defined(OS_NACL_NONSFI) | 48 #if defined(OS_NACL_NONSFI) |
| 48 #include "components/nacl/loader/nonsfi/nonsfi_listener.h" | 49 #include "components/nacl/loader/nonsfi/nonsfi_listener.h" |
| (...skipping 60 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 109 // because some IPC code, such as sync_socket_posix.cc, requires this. | 110 // because some IPC code, such as sync_socket_posix.cc, requires this. |
| 110 // We do this before seccomp-bpf is initialized. | 111 // We do this before seccomp-bpf is initialized. |
| 111 PCHECK(signal(SIGPIPE, SIG_IGN) != SIG_ERR); | 112 PCHECK(signal(SIGPIPE, SIG_IGN) != SIG_ERR); |
| 112 | 113 |
| 113 // Finish layer-1 sandbox initialization and initialize the layer-2 sandbox. | 114 // Finish layer-1 sandbox initialization and initialize the layer-2 sandbox. |
| 114 CHECK(!nacl_sandbox->HasOpenDirectory()); | 115 CHECK(!nacl_sandbox->HasOpenDirectory()); |
| 115 nacl_sandbox->InitializeLayerTwoSandbox(uses_nonsfi_mode); | 116 nacl_sandbox->InitializeLayerTwoSandbox(uses_nonsfi_mode); |
| 116 nacl_sandbox->SealLayerOneSandbox(); | 117 nacl_sandbox->SealLayerOneSandbox(); |
| 117 nacl_sandbox->CheckSandboxingStateWithPolicy(); | 118 nacl_sandbox->CheckSandboxingStateWithPolicy(); |
| 118 | 119 |
| 119 base::GlobalDescriptors::GetInstance()->Set(kPrimaryIPCChannel, | 120 base::GlobalDescriptors::GetInstance()->Set(kMojoIPCChannel, |
| 120 browser_fd.release()); | 121 browser_fd.release()); |
| 121 | 122 |
| 122 // The Mojo EDK must be initialized before using IPC. | 123 // The Mojo EDK must be initialized before using IPC. |
| 123 mojo::edk::Init(); | 124 mojo::edk::Init(); |
| 124 | 125 |
| 125 base::MessageLoopForIO main_message_loop; | 126 base::MessageLoopForIO main_message_loop; |
| 126 #if defined(OS_NACL_NONSFI) | 127 #if defined(OS_NACL_NONSFI) |
| 127 CHECK(uses_nonsfi_mode); | 128 CHECK(uses_nonsfi_mode); |
| 128 nacl::nonsfi::NonSfiListener listener; | 129 nacl::nonsfi::NonSfiListener listener; |
| 129 listener.Listen(); | 130 listener.Listen(); |
| (...skipping 15 matching lines...) Expand all Loading... |
| 145 const std::string& channel_id) { | 146 const std::string& channel_id) { |
| 146 DCHECK(child_fds.size() > | 147 DCHECK(child_fds.size() > |
| 147 std::max(content::ZygoteForkDelegate::kPIDOracleFDIndex, | 148 std::max(content::ZygoteForkDelegate::kPIDOracleFDIndex, |
| 148 content::ZygoteForkDelegate::kBrowserFDIndex)); | 149 content::ZygoteForkDelegate::kBrowserFDIndex)); |
| 149 | 150 |
| 150 // Ping the PID oracle socket. | 151 // Ping the PID oracle socket. |
| 151 CHECK(content::SendZygoteChildPing( | 152 CHECK(content::SendZygoteChildPing( |
| 152 child_fds[content::ZygoteForkDelegate::kPIDOracleFDIndex].get())); | 153 child_fds[content::ZygoteForkDelegate::kPIDOracleFDIndex].get())); |
| 153 | 154 |
| 154 base::CommandLine::ForCurrentProcess()->AppendSwitchASCII( | 155 base::CommandLine::ForCurrentProcess()->AppendSwitchASCII( |
| 155 switches::kProcessChannelID, channel_id); | 156 switches::kMojoChannelToken, channel_id); |
| 156 | 157 |
| 157 // Save the browser socket and close the rest. | 158 // Save the browser socket and close the rest. |
| 158 base::ScopedFD browser_fd( | 159 base::ScopedFD browser_fd( |
| 159 std::move(child_fds[content::ZygoteForkDelegate::kBrowserFDIndex])); | 160 std::move(child_fds[content::ZygoteForkDelegate::kBrowserFDIndex])); |
| 160 child_fds.clear(); | 161 child_fds.clear(); |
| 161 | 162 |
| 162 BecomeNaClLoader(std::move(browser_fd), system_info, uses_nonsfi_mode, | 163 BecomeNaClLoader(std::move(browser_fd), system_info, uses_nonsfi_mode, |
| 163 nacl_sandbox); | 164 nacl_sandbox); |
| 164 _exit(1); | 165 _exit(1); |
| 165 } | 166 } |
| (...skipping 301 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 467 // Now handle requests from the Zygote. | 468 // Now handle requests from the Zygote. |
| 468 while (true) { | 469 while (true) { |
| 469 bool request_handled = HandleZygoteRequest( | 470 bool request_handled = HandleZygoteRequest( |
| 470 kNaClZygoteDescriptor, system_info, nacl_sandbox.get()); | 471 kNaClZygoteDescriptor, system_info, nacl_sandbox.get()); |
| 471 // Do not turn this into a CHECK() without thinking about robustness | 472 // Do not turn this into a CHECK() without thinking about robustness |
| 472 // against malicious IPC requests. | 473 // against malicious IPC requests. |
| 473 DCHECK(request_handled); | 474 DCHECK(request_handled); |
| 474 } | 475 } |
| 475 NOTREACHED(); | 476 NOTREACHED(); |
| 476 } | 477 } |
| OLD | NEW |