NaCl Linux: create NaClSandbox class

NaCl Linux: create NaClSandbox class

We create a new NaClSandbox class, with InitializeLayerOneSandbox() and
InitializeLayerTwoSandbox() methods.

This class centralizes existing code and adds important security checks as
to whether or not threads are running or directory file descriptors are open.

BUG=359230, 358719
R=mseaborn@chromium.org

Committed: https://src.chromium.org/viewvc/chrome?view=rev&revision=266735

[jln (very slow on Chromium), 2014-04-25 01:39:33]

Mark: PTAL!

hamaji, elijahtaylor1: FYI

It would probably make sense to move nonsfi/nonsfi_sandbox* to sandbox_linux
probably, but I can do this in a later CL: these are files under active
development and it would make for unnecessary rebasing.

[jln (very slow on Chromium), 2014-04-28 23:08:38]

Friendly ping?

This CL should be quick to review, it's mostly moving code around.

[Mark Seaborn, 2014-04-29 00:28:22]

LGTM.  It was a bit difficult to follow the moving around of code, but I think I
checked it OK.

https://codereview.chromium.org/250773003/diff/150001/components/nacl/loader/...
File components/nacl/loader/sandbox_linux/nacl_sandbox_linux.cc (right):

https://codereview.chromium.org/250773003/diff/150001/components/nacl/loader/...
components/nacl/loader/sandbox_linux/nacl_sandbox_linux.cc:119: static const
char kItIsDangerousMsg[] = " it is dangerous.";
How about "this is dangerous", otherwise it seems like it's saying the sandbox
is dangerous.

https://codereview.chromium.org/250773003/diff/150001/components/nacl/loader/...
components/nacl/loader/sandbox_linux/nacl_sandbox_linux.cc:130: static const
char kNoSuidMsg[] = "The SUID sandbox is not engaged,";
Nit: comma splice, use ":" or ";" instead of ",". :-)

Can you mention NaCl in these messages?  The old message did.  e.g. "not engaged
for NaCl".

https://codereview.chromium.org/250773003/diff/150001/components/nacl/loader/...
File components/nacl/loader/sandbox_linux/nacl_sandbox_linux.h (right):

https://codereview.chromium.org/250773003/diff/150001/components/nacl/loader/...
components/nacl/loader/sandbox_linux/nacl_sandbox_linux.h:13: // NaClSandbox
supports two independant layers of sandboxing.
"independent"

https://codereview.chromium.org/250773003/diff/150001/components/nacl/loader/...
components/nacl/loader/sandbox_linux/nacl_sandbox_linux.h:25: // 3. Do some more
initializations (it ok to fork() here).
Missing "is" ("it is OK")

https://codereview.chromium.org/250773003/diff/150001/components/nacl/loader/...
components/nacl/loader/sandbox_linux/nacl_sandbox_linux.h:28: //    new
directory descriptor to exist after (2) has been called is via IPC).
Nit: ".)"

https://codereview.chromium.org/250773003/diff/150001/components/nacl/loader/...
components/nacl/loader/sandbox_linux/nacl_sandbox_linux.h:40: // Check whether
the current process owns any directory file descriptor. This
Nit: "descriptors" plural

https://codereview.chromium.org/250773003/diff/150001/components/nacl/loader/...
components/nacl/loader/sandbox_linux/nacl_sandbox_linux.h:42: // that will be
closed after SealLayerOneSandbox() is called.
Missing ")"

https://codereview.chromium.org/250773003/diff/150001/components/nacl/loader/...
components/nacl/loader/sandbox_linux/nacl_sandbox_linux.h:54: // Seal the
layer-one sandbox, making it enforcing.
Nit: "layer-1" for consistency

https://codereview.chromium.org/250773003/diff/150001/components/nacl/loader/...
components/nacl/loader/sandbox_linux/nacl_sandbox_linux.h:67: bool
layer_two_is_non_sfi_;
Can you make this "nonsfi" for consistency with existing names?

[jln (very slow on Chromium), 2014-04-29 01:28:31]

Thanks Mark!

https://chromiumcodereview.appspot.com/250773003/diff/150001/components/nacl/...
File components/nacl/loader/sandbox_linux/nacl_sandbox_linux.cc (right):

https://chromiumcodereview.appspot.com/250773003/diff/150001/components/nacl/...
components/nacl/loader/sandbox_linux/nacl_sandbox_linux.cc:119: static const
char kItIsDangerousMsg[] = " it is dangerous.";
On 2014/04/29 00:28:22, Mark Seaborn wrote:
> How about "this is dangerous", otherwise it seems like it's saying the sandbox
> is dangerous.

Done.

https://chromiumcodereview.appspot.com/250773003/diff/150001/components/nacl/...
components/nacl/loader/sandbox_linux/nacl_sandbox_linux.cc:130: static const
char kNoSuidMsg[] = "The SUID sandbox is not engaged,";
On 2014/04/29 00:28:22, Mark Seaborn wrote:
> Nit: comma splice, use ":" or ";" instead of ",". :-)
> 
> Can you mention NaCl in these messages?  The old message did.  e.g. "not
engaged
> for NaCl".

Done.

https://chromiumcodereview.appspot.com/250773003/diff/150001/components/nacl/...
File components/nacl/loader/sandbox_linux/nacl_sandbox_linux.h (right):

https://chromiumcodereview.appspot.com/250773003/diff/150001/components/nacl/...
components/nacl/loader/sandbox_linux/nacl_sandbox_linux.h:13: // NaClSandbox
supports two independant layers of sandboxing.
On 2014/04/29 00:28:22, Mark Seaborn wrote:
> "independent"

Done.

https://chromiumcodereview.appspot.com/250773003/diff/150001/components/nacl/...
components/nacl/loader/sandbox_linux/nacl_sandbox_linux.h:25: // 3. Do some more
initializations (it ok to fork() here).
On 2014/04/29 00:28:22, Mark Seaborn wrote:
> Missing "is" ("it is OK")

Done.

https://chromiumcodereview.appspot.com/250773003/diff/150001/components/nacl/...
components/nacl/loader/sandbox_linux/nacl_sandbox_linux.h:28: //    new
directory descriptor to exist after (2) has been called is via IPC).
On 2014/04/29 00:28:22, Mark Seaborn wrote:
> Nit: ".)"

Done.

https://chromiumcodereview.appspot.com/250773003/diff/150001/components/nacl/...
components/nacl/loader/sandbox_linux/nacl_sandbox_linux.h:40: // Check whether
the current process owns any directory file descriptor. This
On 2014/04/29 00:28:22, Mark Seaborn wrote:
> Nit: "descriptors" plural

Done.

https://chromiumcodereview.appspot.com/250773003/diff/150001/components/nacl/...
components/nacl/loader/sandbox_linux/nacl_sandbox_linux.h:42: // that will be
closed after SealLayerOneSandbox() is called.
On 2014/04/29 00:28:22, Mark Seaborn wrote:
> Missing ")"

Done.

https://chromiumcodereview.appspot.com/250773003/diff/150001/components/nacl/...
components/nacl/loader/sandbox_linux/nacl_sandbox_linux.h:54: // Seal the
layer-one sandbox, making it enforcing.
On 2014/04/29 00:28:22, Mark Seaborn wrote:
> Nit: "layer-1" for consistency

Done.

https://chromiumcodereview.appspot.com/250773003/diff/150001/components/nacl/...
components/nacl/loader/sandbox_linux/nacl_sandbox_linux.h:67: bool
layer_two_is_non_sfi_;
On 2014/04/29 00:28:22, Mark Seaborn wrote:
> Can you make this "nonsfi" for consistency with existing names?

Done.

[jln (very slow on Chromium), 2014-04-29 01:38:27]

The CQ bit was checked by jln@chromium.org

[commit-bot: I haz the power, 2014-04-29 01:40:23]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/jln@chromium.org/250773003/160001

[jln (very slow on Chromium), 2014-04-29 01:54:03]

Committed patchset #7 manually as r266735 (presubmit successful).