media: Verify CDM Host files

content/ppapi_plugin/ppapi_thread.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/ppapi_plugin/ppapi_thread.h"
 
 #include <stddef.h>
 
 #include <limits>
 
@@ skipping 11 matching lines @@
 #include "base/strings/stringprintf.h"
 #include "base/strings/utf_string_conversions.h"
 #include "base/threading/platform_thread.h"
 #include "base/time/time.h"
 #include "base/trace_event/trace_event.h"
 #include "build/build_config.h"
 #include "components/discardable_memory/client/client_discardable_shared_memory_manager.h"
 #include "content/child/browser_font_resource_trusted.h"
 #include "content/child/child_process.h"
 #include "content/common/child_process_messages.h"
+#include "content/common/media/cdm_host_files.h"
 #include "content/ppapi_plugin/broker_process_dispatcher.h"
 #include "content/ppapi_plugin/plugin_process_dispatcher.h"
 #include "content/ppapi_plugin/ppapi_blink_platform_impl.h"
 #include "content/public/common/content_client.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/common/pepper_plugin_info.h"
 #include "content/public/common/sandbox_init.h"
 #include "ipc/ipc_channel_handle.h"
 #include "ipc/ipc_platform_file.h"
 #include "ipc/ipc_sync_channel.h"
@@ skipping 305 matching lines @@
           reinterpret_cast<PP_InitializeModule_Func>(
               library.GetFunctionPointer("PPP_InitializeModule"));
       if (!plugin_entry_points_.initialize_module) {
         LOG(WARNING) << "No PPP_InitializeModule in plugin library";
         ReportLoadResult(path, ENTRY_POINT_MISSING);
         return;
       }
     }
   }
 
+  std::unique_ptr<CdmHostFiles> cdm_host_files;

[xhwang, 2016/12/16 01:23:03]

Use a local instance such that if we return early for any error, all files will
be closed automatically.

+// Open CDM host files before the process is sandboxed.
+#if defined(OS_WIN) || defined(OS_MACOSX)
+  if (!is_broker_ && IsCdm(path))
+    cdm_host_files = OpenCdmHostFiles(path);

[Greg K, 2016/12/16 22:10:41]

Am I missing something? Where is this defined?

[xhwang, 2016/12/16 22:30:15]

oops, this is some old code that I didn't update. This should be

cdm_host_files = CdmHostFiles::Create(path);

[Greg K, 2016/12/16 22:34:41]

Thanks, I'll take a look now.

[xhwang, 2017/01/18 06:03:59]

Done.

+#elif defined(OS_LINUX)
+  cdm_host_files = CdmHostFiles::TakeGlobalInstance();
+  if (is_broker_ || !IsCdm(path))
+    cdm_host_files.reset();  // Close all opened files.
+#endif
+
 #if defined(OS_WIN)
   // If code subsequently tries to exit using abort(), force a crash (since
   // otherwise these would be silent terminations and fly under the radar).
   base::win::SetAbortBehaviorForCrashReporting();
 
   // Once we lower the token the sandbox is locked down and no new modules
   // can be loaded. TODO(cpu): consider changing to the loading style of
   // regular plugins.
   if (g_target_services) {
     // Let Flash and Widevine CDM adapter load DXVA before lockdown on Vista+.
@@ skipping 66 matching lines @@
 #endif
 
     int32_t init_error = plugin_entry_points_.initialize_module(
         local_pp_module_,
         &ppapi::proxy::PluginDispatcher::GetBrowserInterface);
     if (init_error != PP_OK) {
       LOG(WARNING) << "InitModule failed with error " << init_error;
       ReportLoadResult(path, INIT_FAILED);
       return;
     }
+    // Now the process is sandboxed. Verify CDM host.
+    if (cdm_host_files) {
+      DCHECK(IsCdm(path));
+      cdm_host_files->VerifyFiles(library.get(), path);

[xhwang, 2016/12/16 01:08:27]

tinskip / hmchen: This will be called right after INITIALIZE_CDM_MODULE() and
before CreateCdmInstance().

[Haoming Chen, 2017/01/04 22:23:39]

Acknowledged.

[Haoming Chen, 2017/01/04 22:23:39]

The interface name on the design doc
(https://docs.google.com/document/d/1XXZzRqudB0fQC9q-ZKLUW7NksMMFV-CVzuwXjMhQb...)
is "InitVmp", not "VerifyFiles".

Which name should we use?

[xhwang, 2017/01/12 20:15:02]

Nobody would be able to understand what VMP is. So I'd like a simpler name to
describe what we do here.

+    }
   }
 
   // Initialization succeeded, so keep the plugin DLL loaded.
   library_.Reset(library.Release());
 
   ReportLoadResult(path, LOAD_SUCCESS);
 }
 
 void PpapiThread::OnCreateChannel(base::ProcessId renderer_pid,
                                   int renderer_child_id,
@@ skipping 134 matching lines @@
           GetHistogramName(is_broker_, "LoadTime", path),
           base::TimeDelta::FromMilliseconds(1),
           base::TimeDelta::FromSeconds(10),
           50,
           base::HistogramBase::kUmaTargetedHistogramFlag);
 
   histogram->AddTime(load_time);
 }
 
 }  // namespace content