| OLD | NEW |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "content/zygote/zygote_main.h" | 5 #include "content/zygote/zygote_main.h" |
| 6 | 6 |
| 7 #include <dlfcn.h> | 7 #include <dlfcn.h> |
| 8 #include <fcntl.h> | 8 #include <fcntl.h> |
| 9 #include <pthread.h> | 9 #include <pthread.h> |
| 10 #include <signal.h> | 10 #include <signal.h> |
| (...skipping 420 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 431 "You are using a wrong version of the setuid binary!\n" | 431 "You are using a wrong version of the setuid binary!\n" |
| 432 "Please read " | 432 "Please read " |
| 433 "https://chromium.googlesource.com/chromium/src/+/master/docs/linux_suid
_sandbox_development.md." | 433 "https://chromium.googlesource.com/chromium/src/+/master/docs/linux_suid
_sandbox_development.md." |
| 434 "\n\n"; | 434 "\n\n"; |
| 435 } | 435 } |
| 436 | 436 |
| 437 if (!setuid_sandbox->ChrootMe()) | 437 if (!setuid_sandbox->ChrootMe()) |
| 438 return false; | 438 return false; |
| 439 | 439 |
| 440 if (setuid_sandbox->IsInNewPIDNamespace()) { | 440 if (setuid_sandbox->IsInNewPIDNamespace()) { |
| 441 CHECK_EQ(1, getpid()) | 441 // The SUID sandbox created a new PID namespace but Zygote is not the init |
| 442 << "The SUID sandbox created a new PID namespace but Zygote " | 442 // process. Please, make sure the SUID binary is up to date. |
| 443 "is not the init process. Please, make sure the SUID " | 443 CHECK_EQ(1, getpid()); |
| 444 "binary is up to date."; | |
| 445 } | 444 } |
| 446 | 445 |
| 447 if (getpid() == 1) { | 446 if (getpid() == 1) { |
| 448 // The setuid sandbox has created a new PID namespace and we need | 447 // The setuid sandbox has created a new PID namespace and we need |
| 449 // to assume the role of init. | 448 // to assume the role of init. |
| 450 CHECK(CreateInitProcessReaper(post_fork_parent_callback)); | 449 CHECK(CreateInitProcessReaper(post_fork_parent_callback)); |
| 451 } | 450 } |
| 452 | 451 |
| 453 CHECK(SandboxDebugHandling::SetDumpableStatusAndHandlers()); | 452 CHECK(SandboxDebugHandling::SetDumpableStatusAndHandlers()); |
| 454 return true; | 453 return true; |
| (...skipping 95 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 550 ZygotePreSandboxInit(); | 549 ZygotePreSandboxInit(); |
| 551 | 550 |
| 552 // Check that the pre-sandbox initialization didn't spawn threads. | 551 // Check that the pre-sandbox initialization didn't spawn threads. |
| 553 #if !defined(THREAD_SANITIZER) | 552 #if !defined(THREAD_SANITIZER) |
| 554 DCHECK(sandbox::ThreadHelpers::IsSingleThreaded()); | 553 DCHECK(sandbox::ThreadHelpers::IsSingleThreaded()); |
| 555 #endif | 554 #endif |
| 556 | 555 |
| 557 sandbox::SetuidSandboxClient* setuid_sandbox = | 556 sandbox::SetuidSandboxClient* setuid_sandbox = |
| 558 linux_sandbox->setuid_sandbox_client(); | 557 linux_sandbox->setuid_sandbox_client(); |
| 559 if (setuid_sandbox->IsSuidSandboxChild()) { | 558 if (setuid_sandbox->IsSuidSandboxChild()) { |
| 560 CHECK(EnterSuidSandbox(setuid_sandbox, post_fork_parent_callback)) | 559 // Failed to enter setuid sandbox |
| 561 << "Failed to enter setuid sandbox"; | 560 CHECK(EnterSuidSandbox(setuid_sandbox, post_fork_parent_callback)); |
| 562 } else if (sandbox::NamespaceSandbox::InNewUserNamespace()) { | 561 } else if (sandbox::NamespaceSandbox::InNewUserNamespace()) { |
| 563 EnterNamespaceSandbox(linux_sandbox, post_fork_parent_callback); | 562 EnterNamespaceSandbox(linux_sandbox, post_fork_parent_callback); |
| 564 } else { | 563 } else { |
| 565 CHECK(!using_layer1_sandbox); | 564 CHECK(!using_layer1_sandbox); |
| 566 } | 565 } |
| 567 } | 566 } |
| 568 | 567 |
| 569 bool ZygoteMain(const MainFunctionParams& params, | 568 bool ZygoteMain(const MainFunctionParams& params, |
| 570 ScopedVector<ZygoteForkDelegate> fork_delegates) { | 569 ScopedVector<ZygoteForkDelegate> fork_delegates) { |
| 571 g_am_zygote_or_renderer = true; | 570 g_am_zygote_or_renderer = true; |
| (...skipping 93 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 665 const bool namespace_sandbox_engaged = sandbox_flags & kSandboxLinuxUserNS; | 664 const bool namespace_sandbox_engaged = sandbox_flags & kSandboxLinuxUserNS; |
| 666 CHECK_EQ(using_namespace_sandbox, namespace_sandbox_engaged); | 665 CHECK_EQ(using_namespace_sandbox, namespace_sandbox_engaged); |
| 667 | 666 |
| 668 Zygote zygote(sandbox_flags, std::move(fork_delegates), extra_children, | 667 Zygote zygote(sandbox_flags, std::move(fork_delegates), extra_children, |
| 669 extra_fds); | 668 extra_fds); |
| 670 // This function call can return multiple times, once per fork(). | 669 // This function call can return multiple times, once per fork(). |
| 671 return zygote.ProcessRequests(); | 670 return zygote.ProcessRequests(); |
| 672 } | 671 } |
| 673 | 672 |
| 674 } // namespace content | 673 } // namespace content |
| OLD | NEW |