OLD | NEW |
1 // Copyright 2015 The Chromium Authors. All rights reserved. | 1 // Copyright 2015 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "sandbox/linux/suid/client/setuid_sandbox_host.h" | 5 #include "sandbox/linux/suid/client/setuid_sandbox_host.h" |
6 | 6 |
7 #include <fcntl.h> | 7 #include <fcntl.h> |
8 #include <stddef.h> | 8 #include <stddef.h> |
9 #include <stdlib.h> | 9 #include <stdlib.h> |
10 #include <sys/stat.h> | 10 #include <sys/stat.h> |
(...skipping 11 matching lines...) Expand all Loading... |
22 #include "base/logging.h" | 22 #include "base/logging.h" |
23 #include "base/macros.h" | 23 #include "base/macros.h" |
24 #include "base/path_service.h" | 24 #include "base/path_service.h" |
25 #include "base/posix/eintr_wrapper.h" | 25 #include "base/posix/eintr_wrapper.h" |
26 #include "base/process/launch.h" | 26 #include "base/process/launch.h" |
27 #include "base/process/process_metrics.h" | 27 #include "base/process/process_metrics.h" |
28 #include "base/strings/string_number_conversions.h" | 28 #include "base/strings/string_number_conversions.h" |
29 #include "sandbox/linux/suid/common/sandbox.h" | 29 #include "sandbox/linux/suid/common/sandbox.h" |
30 #include "sandbox/linux/suid/common/suid_unsafe_environment_variables.h" | 30 #include "sandbox/linux/suid/common/suid_unsafe_environment_variables.h" |
31 | 31 |
| 32 namespace sandbox { |
| 33 |
32 namespace { | 34 namespace { |
33 | 35 |
34 // Set an environment variable that reflects the API version we expect from the | 36 // Set an environment variable that reflects the API version we expect from the |
35 // setuid sandbox. Old versions of the sandbox will ignore this. | 37 // setuid sandbox. Old versions of the sandbox will ignore this. |
36 void SetSandboxAPIEnvironmentVariable(base::Environment* env) { | 38 void SetSandboxAPIEnvironmentVariable(base::Environment* env) { |
37 env->SetVar(sandbox::kSandboxEnvironmentApiRequest, | 39 env->SetVar(kSandboxEnvironmentApiRequest, |
38 base::IntToString(sandbox::kSUIDSandboxApiNumber)); | 40 base::IntToString(kSUIDSandboxApiNumber)); |
39 } | 41 } |
40 | 42 |
41 // Unset environment variables that are expected to be set by the setuid | 43 // Unset environment variables that are expected to be set by the setuid |
42 // sandbox. This is to allow nesting of one instance of the SUID sandbox | 44 // sandbox. This is to allow nesting of one instance of the SUID sandbox |
43 // inside another. | 45 // inside another. |
44 void UnsetExpectedEnvironmentVariables(base::EnvironmentMap* env_map) { | 46 void UnsetExpectedEnvironmentVariables(base::EnvironmentMap* env_map) { |
45 DCHECK(env_map); | 47 DCHECK(env_map); |
46 const base::NativeEnvironmentString environment_vars[] = { | 48 const base::NativeEnvironmentString environment_vars[] = { |
47 sandbox::kSandboxDescriptorEnvironmentVarName, | 49 kSandboxDescriptorEnvironmentVarName, kSandboxHelperPidEnvironmentVarName, |
48 sandbox::kSandboxHelperPidEnvironmentVarName, | 50 kSandboxEnvironmentApiProvides, kSandboxPIDNSEnvironmentVarName, |
49 sandbox::kSandboxEnvironmentApiProvides, | 51 kSandboxNETNSEnvironmentVarName, |
50 sandbox::kSandboxPIDNSEnvironmentVarName, | |
51 sandbox::kSandboxNETNSEnvironmentVarName, | |
52 }; | 52 }; |
53 | 53 |
54 for (size_t i = 0; i < arraysize(environment_vars); ++i) { | 54 for (size_t i = 0; i < arraysize(environment_vars); ++i) { |
55 // Setting values in EnvironmentMap to an empty-string will make | 55 // Setting values in EnvironmentMap to an empty-string will make |
56 // sure that they get unset from the environment via AlterEnvironment(). | 56 // sure that they get unset from the environment via AlterEnvironment(). |
57 (*env_map)[environment_vars[i]] = base::NativeEnvironmentString(); | 57 (*env_map)[environment_vars[i]] = base::NativeEnvironmentString(); |
58 } | 58 } |
59 } | 59 } |
60 | 60 |
61 // Wrapper around a shared C function. | 61 // Wrapper around a shared C function. |
62 // Returns the "saved" environment variable name corresponding to |envvar| | 62 // Returns the "saved" environment variable name corresponding to |envvar| |
63 // in a new string or NULL. | 63 // in a new string or NULL. |
64 std::string* CreateSavedVariableName(const char* env_var) { | 64 std::string* CreateSavedVariableName(const char* env_var) { |
65 char* const saved_env_var = SandboxSavedEnvironmentVariable(env_var); | 65 char* const saved_env_var = SandboxSavedEnvironmentVariable(env_var); |
66 if (!saved_env_var) | 66 if (!saved_env_var) |
67 return NULL; | 67 return nullptr; |
68 std::string* saved_env_var_copy = new std::string(saved_env_var); | 68 std::string* saved_env_var_copy = new std::string(saved_env_var); |
69 // SandboxSavedEnvironmentVariable is the C function that we wrap and uses | 69 // SandboxSavedEnvironmentVariable is the C function that we wrap and uses |
70 // malloc() to allocate memory. | 70 // malloc() to allocate memory. |
71 free(saved_env_var); | 71 free(saved_env_var); |
72 return saved_env_var_copy; | 72 return saved_env_var_copy; |
73 } | 73 } |
74 | 74 |
75 // The ELF loader will clear many environment variables so we save them to | 75 // The ELF loader will clear many environment variables so we save them to |
76 // different names here so that the SUID sandbox can resolve them for the | 76 // different names here so that the SUID sandbox can resolve them for the |
77 // renderer. | 77 // renderer. |
78 void SaveSUIDUnsafeEnvironmentVariables(base::Environment* env) { | 78 void SaveSUIDUnsafeEnvironmentVariables(base::Environment* env) { |
79 for (unsigned i = 0; kSUIDUnsafeEnvironmentVariables[i]; ++i) { | 79 for (unsigned i = 0; kSUIDUnsafeEnvironmentVariables[i]; ++i) { |
80 const char* env_var = kSUIDUnsafeEnvironmentVariables[i]; | 80 const char* env_var = kSUIDUnsafeEnvironmentVariables[i]; |
81 // Get the saved environment variable corresponding to envvar. | 81 // Get the saved environment variable corresponding to envvar. |
82 std::unique_ptr<std::string> saved_env_var( | 82 std::unique_ptr<std::string> saved_env_var( |
83 CreateSavedVariableName(env_var)); | 83 CreateSavedVariableName(env_var)); |
84 if (saved_env_var == NULL) | 84 if (!saved_env_var) |
85 continue; | 85 continue; |
86 | 86 |
87 std::string value; | 87 std::string value; |
88 if (env->GetVar(env_var, &value)) | 88 if (env->GetVar(env_var, &value)) |
89 env->SetVar(saved_env_var->c_str(), value); | 89 env->SetVar(saved_env_var->c_str(), value); |
90 else | 90 else |
91 env->UnSetVar(saved_env_var->c_str()); | 91 env->UnSetVar(saved_env_var->c_str()); |
92 } | 92 } |
93 } | 93 } |
94 | 94 |
95 const char* GetDevelSandboxPath() { | 95 const char* GetDevelSandboxPath() { |
96 return getenv("CHROME_DEVEL_SANDBOX"); | 96 return getenv("CHROME_DEVEL_SANDBOX"); |
97 } | 97 } |
98 | 98 |
99 } // namespace | 99 } // namespace |
100 | 100 |
101 namespace sandbox { | |
102 | |
103 SetuidSandboxHost* SetuidSandboxHost::Create() { | 101 SetuidSandboxHost* SetuidSandboxHost::Create() { |
104 base::Environment* environment(base::Environment::Create()); | 102 return new SetuidSandboxHost(base::Environment::Create()); |
105 CHECK(environment); | |
106 return new SetuidSandboxHost(environment); | |
107 } | 103 } |
108 | 104 |
109 SetuidSandboxHost::SetuidSandboxHost(base::Environment* env) : env_(env) { | 105 SetuidSandboxHost::SetuidSandboxHost(std::unique_ptr<base::Environment> env) |
| 106 : env_(std::move(env)) { |
| 107 DCHECK(env_); |
110 } | 108 } |
111 | 109 |
112 SetuidSandboxHost::~SetuidSandboxHost() { | 110 SetuidSandboxHost::~SetuidSandboxHost() { |
113 } | 111 } |
114 | 112 |
115 // Check if CHROME_DEVEL_SANDBOX is set but empty. This currently disables | 113 // Check if CHROME_DEVEL_SANDBOX is set but empty. This currently disables |
116 // the setuid sandbox. TODO(jln): fix this (crbug.com/245376). | 114 // the setuid sandbox. TODO(jln): fix this (crbug.com/245376). |
117 bool SetuidSandboxHost::IsDisabledViaEnvironment() { | 115 bool SetuidSandboxHost::IsDisabledViaEnvironment() { |
118 const char* devel_sandbox_path = GetDevelSandboxPath(); | 116 const char* devel_sandbox_path = GetDevelSandboxPath(); |
119 if (devel_sandbox_path && '\0' == *devel_sandbox_path) { | 117 return devel_sandbox_path && (*devel_sandbox_path == '\0'); |
120 return true; | |
121 } | |
122 return false; | |
123 } | 118 } |
124 | 119 |
125 base::FilePath SetuidSandboxHost::GetSandboxBinaryPath() { | 120 base::FilePath SetuidSandboxHost::GetSandboxBinaryPath() { |
126 base::FilePath sandbox_binary; | 121 base::FilePath sandbox_binary; |
127 base::FilePath exe_dir; | 122 base::FilePath exe_dir; |
128 if (PathService::Get(base::DIR_EXE, &exe_dir)) { | 123 if (PathService::Get(base::DIR_EXE, &exe_dir)) { |
129 base::FilePath sandbox_candidate = exe_dir.AppendASCII("chrome-sandbox"); | 124 base::FilePath sandbox_candidate = exe_dir.AppendASCII("chrome-sandbox"); |
130 if (base::PathExists(sandbox_candidate)) | 125 if (base::PathExists(sandbox_candidate)) |
131 sandbox_binary = sandbox_candidate; | 126 sandbox_binary = sandbox_candidate; |
132 } | 127 } |
(...skipping 57 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
190 // kZygoteIdFd. Fixing this requires a sandbox API change. :( | 185 // kZygoteIdFd. Fixing this requires a sandbox API change. :( |
191 fds_to_remap->push_back(std::make_pair(dummy_fd->get(), kZygoteIdFd)); | 186 fds_to_remap->push_back(std::make_pair(dummy_fd->get(), kZygoteIdFd)); |
192 } | 187 } |
193 | 188 |
194 void SetuidSandboxHost::SetupLaunchEnvironment() { | 189 void SetuidSandboxHost::SetupLaunchEnvironment() { |
195 SaveSUIDUnsafeEnvironmentVariables(env_.get()); | 190 SaveSUIDUnsafeEnvironmentVariables(env_.get()); |
196 SetSandboxAPIEnvironmentVariable(env_.get()); | 191 SetSandboxAPIEnvironmentVariable(env_.get()); |
197 } | 192 } |
198 | 193 |
199 } // namespace sandbox | 194 } // namespace sandbox |
OLD | NEW |