OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
| 5 #include <dirent.h> |
5 #include <fcntl.h> | 6 #include <fcntl.h> |
6 #include <sys/resource.h> | 7 #include <sys/resource.h> |
7 #include <sys/stat.h> | 8 #include <sys/stat.h> |
8 #include <sys/time.h> | 9 #include <sys/time.h> |
9 #include <sys/types.h> | 10 #include <sys/types.h> |
10 | 11 |
11 #include <limits> | 12 #include <limits> |
12 | 13 |
13 #include "base/bind.h" | 14 #include "base/bind.h" |
14 #include "base/callback_helpers.h" | 15 #include "base/callback_helpers.h" |
15 #include "base/command_line.h" | 16 #include "base/command_line.h" |
16 #include "base/logging.h" | 17 #include "base/logging.h" |
17 #include "base/memory/singleton.h" | 18 #include "base/memory/singleton.h" |
18 #include "base/posix/eintr_wrapper.h" | 19 #include "base/posix/eintr_wrapper.h" |
| 20 #include "base/strings/string_number_conversions.h" |
19 #include "base/time/time.h" | 21 #include "base/time/time.h" |
20 #include "content/common/sandbox_linux.h" | 22 #include "content/common/sandbox_linux.h" |
21 #include "content/common/sandbox_seccomp_bpf_linux.h" | 23 #include "content/common/sandbox_seccomp_bpf_linux.h" |
22 #include "content/public/common/content_switches.h" | 24 #include "content/public/common/content_switches.h" |
23 #include "content/public/common/sandbox_linux.h" | 25 #include "content/public/common/sandbox_linux.h" |
24 #include "sandbox/linux/suid/client/setuid_sandbox_client.h" | 26 #include "sandbox/linux/suid/client/setuid_sandbox_client.h" |
25 | 27 |
26 namespace { | 28 namespace { |
27 | 29 |
28 void LogSandboxStarted(const std::string& sandbox_name) { | 30 void LogSandboxStarted(const std::string& sandbox_name) { |
(...skipping 24 matching lines...) Expand all Loading... |
53 } | 55 } |
54 | 56 |
55 bool IsRunningTSAN() { | 57 bool IsRunningTSAN() { |
56 #if defined(THREAD_SANITIZER) | 58 #if defined(THREAD_SANITIZER) |
57 return true; | 59 return true; |
58 #else | 60 #else |
59 return false; | 61 return false; |
60 #endif | 62 #endif |
61 } | 63 } |
62 | 64 |
| 65 struct DIRDeleter { |
| 66 void operator()(DIR* d) { |
| 67 PCHECK(closedir(d) == 0); |
| 68 } |
| 69 }; |
| 70 |
63 } // namespace | 71 } // namespace |
64 | 72 |
65 namespace content { | 73 namespace content { |
66 | 74 |
67 LinuxSandbox::LinuxSandbox() | 75 LinuxSandbox::LinuxSandbox() |
68 : proc_fd_(-1), | 76 : proc_fd_(-1), |
69 seccomp_bpf_started_(false), | 77 seccomp_bpf_started_(false), |
70 pre_initialized_(false), | 78 pre_initialized_(false), |
71 seccomp_bpf_supported_(false), | 79 seccomp_bpf_supported_(false), |
72 setuid_sandbox_client_(sandbox::SetuidSandboxClient::Create()) { | 80 setuid_sandbox_client_(sandbox::SetuidSandboxClient::Create()) { |
(...skipping 63 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
136 if (IsRunningTSAN()) | 144 if (IsRunningTSAN()) |
137 return false; | 145 return false; |
138 // The GPU process is allowed to call InitializeSandbox() with threads for | 146 // The GPU process is allowed to call InitializeSandbox() with threads for |
139 // now, because it loads third party libraries. | 147 // now, because it loads third party libraries. |
140 if (process_type != switches::kGpuProcess) | 148 if (process_type != switches::kGpuProcess) |
141 CHECK(false) << error_message; | 149 CHECK(false) << error_message; |
142 LOG(ERROR) << error_message; | 150 LOG(ERROR) << error_message; |
143 return false; | 151 return false; |
144 } | 152 } |
145 | 153 |
| 154 if (linux_sandbox->HasOpenDirectories()) { |
| 155 LOG(FATAL) << "InitializeSandbox() called after unexpected directories " |
| 156 "have been opened- this breaks the security of the setuid " |
| 157 "sandbox."; |
| 158 } |
| 159 |
146 // Attempt to limit the future size of the address space of the process. | 160 // Attempt to limit the future size of the address space of the process. |
147 linux_sandbox->LimitAddressSpace(process_type); | 161 linux_sandbox->LimitAddressSpace(process_type); |
148 | 162 |
149 // First, try to enable seccomp-bpf. | 163 // First, try to enable seccomp-bpf. |
150 seccomp_bpf_started = linux_sandbox->StartSeccompBpf(process_type); | 164 seccomp_bpf_started = linux_sandbox->StartSeccompBpf(process_type); |
151 | 165 |
152 return seccomp_bpf_started; | 166 return seccomp_bpf_started; |
153 } | 167 } |
154 | 168 |
155 int LinuxSandbox::GetStatus() const { | 169 int LinuxSandbox::GetStatus() const { |
(...skipping 45 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
201 } | 215 } |
202 | 216 |
203 // At least "..", "." and the current thread should be present. | 217 // At least "..", "." and the current thread should be present. |
204 CHECK_LE(3UL, task_stat.st_nlink); | 218 CHECK_LE(3UL, task_stat.st_nlink); |
205 // Counting threads via /proc/self/task could be racy. For the purpose of | 219 // Counting threads via /proc/self/task could be racy. For the purpose of |
206 // determining if the current proces is monothreaded it works: if at any | 220 // determining if the current proces is monothreaded it works: if at any |
207 // time it becomes monothreaded, it'll stay so. | 221 // time it becomes monothreaded, it'll stay so. |
208 return task_stat.st_nlink == 3; | 222 return task_stat.st_nlink == 3; |
209 } | 223 } |
210 | 224 |
| 225 bool LinuxSandbox::HasOpenDirectories() { |
| 226 int proc_self_fd = -1; |
| 227 if (proc_fd_ >= 0) { |
| 228 proc_self_fd = openat(proc_fd_, "self/fd", O_DIRECTORY | O_RDONLY); |
| 229 } else { |
| 230 proc_self_fd = openat(AT_FDCWD, "/proc/self/fd", O_DIRECTORY | O_RDONLY); |
| 231 if (proc_self_fd < 0) { |
| 232 // Guess false. |
| 233 // TODO(mostynb@opera.com): errno == ENOENT is ok, but figure out what |
| 234 // other situations fail here. http://crbug.com/314985 |
| 235 return false; |
| 236 } |
| 237 } |
| 238 CHECK_GE(proc_self_fd, 0); |
| 239 |
| 240 // Ownership of proc_self_fd is transferred here, it must not be closed |
| 241 // or modified afterwards except via dir. |
| 242 scoped_ptr<DIR, DIRDeleter> dir(fdopendir(proc_self_fd)); |
| 243 CHECK(dir); |
| 244 |
| 245 struct dirent e; |
| 246 struct dirent* de; |
| 247 while (!readdir_r(dir.get(), &e, &de) && de) { |
| 248 if (strcmp(e.d_name, ".") == 0 || strcmp(e.d_name, "..") == 0) |
| 249 continue; |
| 250 |
| 251 int fd_num; |
| 252 CHECK(base::StringToInt(e.d_name, &fd_num)); |
| 253 if (fd_num == proc_fd_ || fd_num == proc_self_fd) { |
| 254 continue; |
| 255 } |
| 256 |
| 257 struct stat s; |
| 258 // It's OK to use proc_self_fd here, fstatat won't modify it. |
| 259 CHECK(fstatat(proc_self_fd, e.d_name, &s, 0) == 0); |
| 260 if (S_ISDIR(s.st_mode)) { |
| 261 return true; |
| 262 } |
| 263 } |
| 264 |
| 265 // No open unmanaged directories found. \o/ |
| 266 return false; |
| 267 } |
| 268 |
211 bool LinuxSandbox::seccomp_bpf_started() const { | 269 bool LinuxSandbox::seccomp_bpf_started() const { |
212 return seccomp_bpf_started_; | 270 return seccomp_bpf_started_; |
213 } | 271 } |
214 | 272 |
215 sandbox::SetuidSandboxClient* | 273 sandbox::SetuidSandboxClient* |
216 LinuxSandbox::setuid_sandbox_client() const { | 274 LinuxSandbox::setuid_sandbox_client() const { |
217 return setuid_sandbox_client_.get(); | 275 return setuid_sandbox_client_.get(); |
218 } | 276 } |
219 | 277 |
220 // For seccomp-bpf, we use the SandboxSeccompBpf class. | 278 // For seccomp-bpf, we use the SandboxSeccompBpf class. |
(...skipping 58 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
279 void LinuxSandbox::SealSandbox() { | 337 void LinuxSandbox::SealSandbox() { |
280 if (proc_fd_ >= 0) { | 338 if (proc_fd_ >= 0) { |
281 int ret = HANDLE_EINTR(close(proc_fd_)); | 339 int ret = HANDLE_EINTR(close(proc_fd_)); |
282 CHECK_EQ(0, ret); | 340 CHECK_EQ(0, ret); |
283 proc_fd_ = -1; | 341 proc_fd_ = -1; |
284 } | 342 } |
285 } | 343 } |
286 | 344 |
287 } // namespace content | 345 } // namespace content |
288 | 346 |
OLD | NEW |