| OLD | NEW |
| 1 // Copyright 2015 The Chromium Authors. All rights reserved. | 1 // Copyright 2015 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "sandbox/linux/suid/client/setuid_sandbox_host.h" | 5 #include "sandbox/linux/suid/client/setuid_sandbox_host.h" |
| 6 | 6 |
| 7 #include <fcntl.h> | 7 #include <fcntl.h> |
| 8 #include <stddef.h> | 8 #include <stddef.h> |
| 9 #include <stdlib.h> | 9 #include <stdlib.h> |
| 10 #include <sys/stat.h> | 10 #include <sys/stat.h> |
| (...skipping 11 matching lines...) Expand all Loading... |
| 22 #include "base/logging.h" | 22 #include "base/logging.h" |
| 23 #include "base/macros.h" | 23 #include "base/macros.h" |
| 24 #include "base/path_service.h" | 24 #include "base/path_service.h" |
| 25 #include "base/posix/eintr_wrapper.h" | 25 #include "base/posix/eintr_wrapper.h" |
| 26 #include "base/process/launch.h" | 26 #include "base/process/launch.h" |
| 27 #include "base/process/process_metrics.h" | 27 #include "base/process/process_metrics.h" |
| 28 #include "base/strings/string_number_conversions.h" | 28 #include "base/strings/string_number_conversions.h" |
| 29 #include "sandbox/linux/suid/common/sandbox.h" | 29 #include "sandbox/linux/suid/common/sandbox.h" |
| 30 #include "sandbox/linux/suid/common/suid_unsafe_environment_variables.h" | 30 #include "sandbox/linux/suid/common/suid_unsafe_environment_variables.h" |
| 31 | 31 |
| 32 namespace sandbox { |
| 33 |
| 32 namespace { | 34 namespace { |
| 33 | 35 |
| 34 // Set an environment variable that reflects the API version we expect from the | 36 // Set an environment variable that reflects the API version we expect from the |
| 35 // setuid sandbox. Old versions of the sandbox will ignore this. | 37 // setuid sandbox. Old versions of the sandbox will ignore this. |
| 36 void SetSandboxAPIEnvironmentVariable(base::Environment* env) { | 38 void SetSandboxAPIEnvironmentVariable(base::Environment* env) { |
| 37 env->SetVar(sandbox::kSandboxEnvironmentApiRequest, | 39 env->SetVar(kSandboxEnvironmentApiRequest, |
| 38 base::IntToString(sandbox::kSUIDSandboxApiNumber)); | 40 base::IntToString(kSUIDSandboxApiNumber)); |
| 39 } | 41 } |
| 40 | 42 |
| 41 // Unset environment variables that are expected to be set by the setuid | 43 // Unset environment variables that are expected to be set by the setuid |
| 42 // sandbox. This is to allow nesting of one instance of the SUID sandbox | 44 // sandbox. This is to allow nesting of one instance of the SUID sandbox |
| 43 // inside another. | 45 // inside another. |
| 44 void UnsetExpectedEnvironmentVariables(base::EnvironmentMap* env_map) { | 46 void UnsetExpectedEnvironmentVariables(base::EnvironmentMap* env_map) { |
| 45 DCHECK(env_map); | 47 DCHECK(env_map); |
| 46 const base::NativeEnvironmentString environment_vars[] = { | 48 const base::NativeEnvironmentString environment_vars[] = { |
| 47 sandbox::kSandboxDescriptorEnvironmentVarName, | 49 kSandboxDescriptorEnvironmentVarName, kSandboxHelperPidEnvironmentVarName, |
| 48 sandbox::kSandboxHelperPidEnvironmentVarName, | 50 kSandboxEnvironmentApiProvides, kSandboxPIDNSEnvironmentVarName, |
| 49 sandbox::kSandboxEnvironmentApiProvides, | 51 kSandboxNETNSEnvironmentVarName, |
| 50 sandbox::kSandboxPIDNSEnvironmentVarName, | |
| 51 sandbox::kSandboxNETNSEnvironmentVarName, | |
| 52 }; | 52 }; |
| 53 | 53 |
| 54 for (size_t i = 0; i < arraysize(environment_vars); ++i) { | 54 for (size_t i = 0; i < arraysize(environment_vars); ++i) { |
| 55 // Setting values in EnvironmentMap to an empty-string will make | 55 // Setting values in EnvironmentMap to an empty-string will make |
| 56 // sure that they get unset from the environment via AlterEnvironment(). | 56 // sure that they get unset from the environment via AlterEnvironment(). |
| 57 (*env_map)[environment_vars[i]] = base::NativeEnvironmentString(); | 57 (*env_map)[environment_vars[i]] = base::NativeEnvironmentString(); |
| 58 } | 58 } |
| 59 } | 59 } |
| 60 | 60 |
| 61 // Wrapper around a shared C function. | 61 // Wrapper around a shared C function. |
| 62 // Returns the "saved" environment variable name corresponding to |envvar| | 62 // Returns the "saved" environment variable name corresponding to |envvar| |
| 63 // in a new string or NULL. | 63 // in a new string or NULL. |
| 64 std::string* CreateSavedVariableName(const char* env_var) { | 64 std::string* CreateSavedVariableName(const char* env_var) { |
| 65 char* const saved_env_var = SandboxSavedEnvironmentVariable(env_var); | 65 char* const saved_env_var = SandboxSavedEnvironmentVariable(env_var); |
| 66 if (!saved_env_var) | 66 if (!saved_env_var) |
| 67 return NULL; | 67 return nullptr; |
| 68 std::string* saved_env_var_copy = new std::string(saved_env_var); | 68 std::string* saved_env_var_copy = new std::string(saved_env_var); |
| 69 // SandboxSavedEnvironmentVariable is the C function that we wrap and uses | 69 // SandboxSavedEnvironmentVariable is the C function that we wrap and uses |
| 70 // malloc() to allocate memory. | 70 // malloc() to allocate memory. |
| 71 free(saved_env_var); | 71 free(saved_env_var); |
| 72 return saved_env_var_copy; | 72 return saved_env_var_copy; |
| 73 } | 73 } |
| 74 | 74 |
| 75 // The ELF loader will clear many environment variables so we save them to | 75 // The ELF loader will clear many environment variables so we save them to |
| 76 // different names here so that the SUID sandbox can resolve them for the | 76 // different names here so that the SUID sandbox can resolve them for the |
| 77 // renderer. | 77 // renderer. |
| 78 void SaveSUIDUnsafeEnvironmentVariables(base::Environment* env) { | 78 void SaveSUIDUnsafeEnvironmentVariables(base::Environment* env) { |
| 79 for (unsigned i = 0; kSUIDUnsafeEnvironmentVariables[i]; ++i) { | 79 for (unsigned i = 0; kSUIDUnsafeEnvironmentVariables[i]; ++i) { |
| 80 const char* env_var = kSUIDUnsafeEnvironmentVariables[i]; | 80 const char* env_var = kSUIDUnsafeEnvironmentVariables[i]; |
| 81 // Get the saved environment variable corresponding to envvar. | 81 // Get the saved environment variable corresponding to envvar. |
| 82 std::unique_ptr<std::string> saved_env_var( | 82 std::unique_ptr<std::string> saved_env_var( |
| 83 CreateSavedVariableName(env_var)); | 83 CreateSavedVariableName(env_var)); |
| 84 if (saved_env_var == NULL) | 84 if (!saved_env_var) |
| 85 continue; | 85 continue; |
| 86 | 86 |
| 87 std::string value; | 87 std::string value; |
| 88 if (env->GetVar(env_var, &value)) | 88 if (env->GetVar(env_var, &value)) |
| 89 env->SetVar(saved_env_var->c_str(), value); | 89 env->SetVar(saved_env_var->c_str(), value); |
| 90 else | 90 else |
| 91 env->UnSetVar(saved_env_var->c_str()); | 91 env->UnSetVar(saved_env_var->c_str()); |
| 92 } | 92 } |
| 93 } | 93 } |
| 94 | 94 |
| 95 const char* GetDevelSandboxPath() { | 95 const char* GetDevelSandboxPath() { |
| 96 return getenv("CHROME_DEVEL_SANDBOX"); | 96 return getenv("CHROME_DEVEL_SANDBOX"); |
| 97 } | 97 } |
| 98 | 98 |
| 99 } // namespace | 99 } // namespace |
| 100 | 100 |
| 101 namespace sandbox { | |
| 102 | |
| 103 SetuidSandboxHost* SetuidSandboxHost::Create() { | 101 SetuidSandboxHost* SetuidSandboxHost::Create() { |
| 104 base::Environment* environment(base::Environment::Create()); | 102 return new SetuidSandboxHost(base::Environment::Create()); |
| 105 CHECK(environment); | |
| 106 return new SetuidSandboxHost(environment); | |
| 107 } | 103 } |
| 108 | 104 |
| 109 SetuidSandboxHost::SetuidSandboxHost(base::Environment* env) : env_(env) { | 105 SetuidSandboxHost::SetuidSandboxHost(std::unique_ptr<base::Environment> env) |
| 106 : env_(std::move(env)) { |
| 107 DCHECK(env_); |
| 110 } | 108 } |
| 111 | 109 |
| 112 SetuidSandboxHost::~SetuidSandboxHost() { | 110 SetuidSandboxHost::~SetuidSandboxHost() { |
| 113 } | 111 } |
| 114 | 112 |
| 115 // Check if CHROME_DEVEL_SANDBOX is set but empty. This currently disables | 113 // Check if CHROME_DEVEL_SANDBOX is set but empty. This currently disables |
| 116 // the setuid sandbox. TODO(jln): fix this (crbug.com/245376). | 114 // the setuid sandbox. TODO(jln): fix this (crbug.com/245376). |
| 117 bool SetuidSandboxHost::IsDisabledViaEnvironment() { | 115 bool SetuidSandboxHost::IsDisabledViaEnvironment() { |
| 118 const char* devel_sandbox_path = GetDevelSandboxPath(); | 116 const char* devel_sandbox_path = GetDevelSandboxPath(); |
| 119 if (devel_sandbox_path && '\0' == *devel_sandbox_path) { | 117 return devel_sandbox_path && (*devel_sandbox_path == '\0'); |
| 120 return true; | |
| 121 } | |
| 122 return false; | |
| 123 } | 118 } |
| 124 | 119 |
| 125 base::FilePath SetuidSandboxHost::GetSandboxBinaryPath() { | 120 base::FilePath SetuidSandboxHost::GetSandboxBinaryPath() { |
| 126 base::FilePath sandbox_binary; | 121 base::FilePath sandbox_binary; |
| 127 base::FilePath exe_dir; | 122 base::FilePath exe_dir; |
| 128 if (PathService::Get(base::DIR_EXE, &exe_dir)) { | 123 if (PathService::Get(base::DIR_EXE, &exe_dir)) { |
| 129 base::FilePath sandbox_candidate = exe_dir.AppendASCII("chrome-sandbox"); | 124 base::FilePath sandbox_candidate = exe_dir.AppendASCII("chrome-sandbox"); |
| 130 if (base::PathExists(sandbox_candidate)) | 125 if (base::PathExists(sandbox_candidate)) |
| 131 sandbox_binary = sandbox_candidate; | 126 sandbox_binary = sandbox_candidate; |
| 132 } | 127 } |
| (...skipping 57 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 190 // kZygoteIdFd. Fixing this requires a sandbox API change. :( | 185 // kZygoteIdFd. Fixing this requires a sandbox API change. :( |
| 191 fds_to_remap->push_back(std::make_pair(dummy_fd->get(), kZygoteIdFd)); | 186 fds_to_remap->push_back(std::make_pair(dummy_fd->get(), kZygoteIdFd)); |
| 192 } | 187 } |
| 193 | 188 |
| 194 void SetuidSandboxHost::SetupLaunchEnvironment() { | 189 void SetuidSandboxHost::SetupLaunchEnvironment() { |
| 195 SaveSUIDUnsafeEnvironmentVariables(env_.get()); | 190 SaveSUIDUnsafeEnvironmentVariables(env_.get()); |
| 196 SetSandboxAPIEnvironmentVariable(env_.get()); | 191 SetSandboxAPIEnvironmentVariable(env_.get()); |
| 197 } | 192 } |
| 198 | 193 |
| 199 } // namespace sandbox | 194 } // namespace sandbox |
| OLD | NEW |