OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "content/zygote/zygote_main.h" | 5 #include "content/zygote/zygote_main.h" |
6 | 6 |
7 #include <dlfcn.h> | 7 #include <dlfcn.h> |
8 #include <errno.h> | 8 #include <errno.h> |
9 #include <fcntl.h> | 9 #include <fcntl.h> |
10 #include <pthread.h> | 10 #include <pthread.h> |
11 #include <stdio.h> | 11 #include <stdio.h> |
12 #include <sys/socket.h> | 12 #include <sys/socket.h> |
13 #include <sys/stat.h> | 13 #include <sys/stat.h> |
14 #include <sys/types.h> | 14 #include <sys/types.h> |
15 #include <sys/wait.h> | 15 #include <sys/wait.h> |
16 #include <unistd.h> | 16 #include <unistd.h> |
17 | 17 |
18 #include "base/basictypes.h" | 18 #include "base/basictypes.h" |
19 #include "base/bind.h" | 19 #include "base/bind.h" |
20 #include "base/callback.h" | 20 #include "base/callback.h" |
21 #include "base/command_line.h" | 21 #include "base/command_line.h" |
22 #include "base/compiler_specific.h" | 22 #include "base/compiler_specific.h" |
23 #include "base/linux_util.h" | 23 #include "base/linux_util.h" |
24 #include "base/native_library.h" | 24 #include "base/native_library.h" |
25 #include "base/pickle.h" | 25 #include "base/pickle.h" |
| 26 #include "base/posix/eintr_wrapper.h" |
26 #include "base/posix/unix_domain_socket_linux.h" | 27 #include "base/posix/unix_domain_socket_linux.h" |
27 #include "base/rand_util.h" | 28 #include "base/rand_util.h" |
28 #include "base/sys_info.h" | 29 #include "base/sys_info.h" |
29 #include "build/build_config.h" | 30 #include "build/build_config.h" |
30 #include "content/common/child_process_sandbox_support_impl_linux.h" | 31 #include "content/common/child_process_sandbox_support_impl_linux.h" |
31 #include "content/common/font_config_ipc_linux.h" | 32 #include "content/common/font_config_ipc_linux.h" |
32 #include "content/common/pepper_plugin_list.h" | 33 #include "content/common/pepper_plugin_list.h" |
33 #include "content/common/sandbox_linux/sandbox_linux.h" | 34 #include "content/common/sandbox_linux/sandbox_linux.h" |
34 #include "content/common/zygote_commands_linux.h" | 35 #include "content/common/zygote_commands_linux.h" |
35 #include "content/public/common/content_switches.h" | 36 #include "content/public/common/content_switches.h" |
(...skipping 301 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
337 // Ensure access to the Pepper plugins before the sandbox is turned on. | 338 // Ensure access to the Pepper plugins before the sandbox is turned on. |
338 PreloadPepperPlugins(); | 339 PreloadPepperPlugins(); |
339 #endif | 340 #endif |
340 #if defined(ENABLE_WEBRTC) | 341 #if defined(ENABLE_WEBRTC) |
341 InitializeWebRtcModule(); | 342 InitializeWebRtcModule(); |
342 #endif | 343 #endif |
343 SkFontConfigInterface::SetGlobal( | 344 SkFontConfigInterface::SetGlobal( |
344 new FontConfigIPC(GetSandboxFD()))->unref(); | 345 new FontConfigIPC(GetSandboxFD()))->unref(); |
345 } | 346 } |
346 | 347 |
347 static void CloseFdAndHandleEintr(int fd) { | |
348 close(fd); | |
349 } | |
350 | |
351 static bool CreateInitProcessReaper() { | 348 static bool CreateInitProcessReaper() { |
352 // This "magic" socket must only appear in one process, so make sure | |
353 // it gets closed in the parent after fork(). | |
354 base::Closure zygoteid_fd_closer = | |
355 base::Bind(CloseFdAndHandleEintr, kZygoteIdFd); | |
356 // The current process becomes init(1), this function returns from a | 349 // The current process becomes init(1), this function returns from a |
357 // newly created process. | 350 // newly created process. |
358 const bool init_created = | 351 const bool init_created = sandbox::CreateInitProcessReaper(NULL); |
359 sandbox::CreateInitProcessReaper(&zygoteid_fd_closer); | |
360 if (!init_created) { | 352 if (!init_created) { |
361 LOG(ERROR) << "Error creating an init process to reap zombies"; | 353 LOG(ERROR) << "Error creating an init process to reap zombies"; |
362 return false; | 354 return false; |
363 } | 355 } |
364 return true; | 356 return true; |
365 } | 357 } |
366 | 358 |
367 // Enter the setuid sandbox. This requires the current process to have been | 359 // Enter the setuid sandbox. This requires the current process to have been |
368 // created through the setuid sandbox. | 360 // created through the setuid sandbox. |
369 static bool EnterSuidSandbox(sandbox::SetuidSandboxClient* setuid_sandbox) { | 361 static bool EnterSuidSandbox(sandbox::SetuidSandboxClient* setuid_sandbox) { |
(...skipping 83 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
453 ZygoteForkDelegate* forkdelegate) { | 445 ZygoteForkDelegate* forkdelegate) { |
454 g_am_zygote_or_renderer = true; | 446 g_am_zygote_or_renderer = true; |
455 sandbox::InitLibcUrandomOverrides(); | 447 sandbox::InitLibcUrandomOverrides(); |
456 | 448 |
457 LinuxSandbox* linux_sandbox = LinuxSandbox::GetInstance(); | 449 LinuxSandbox* linux_sandbox = LinuxSandbox::GetInstance(); |
458 // This will pre-initialize the various sandboxes that need it. | 450 // This will pre-initialize the various sandboxes that need it. |
459 linux_sandbox->PreinitializeSandbox(); | 451 linux_sandbox->PreinitializeSandbox(); |
460 | 452 |
461 const bool must_enable_setuid_sandbox = | 453 const bool must_enable_setuid_sandbox = |
462 linux_sandbox->setuid_sandbox_client()->IsSuidSandboxChild(); | 454 linux_sandbox->setuid_sandbox_client()->IsSuidSandboxChild(); |
| 455 if (must_enable_setuid_sandbox) { |
| 456 // When we're launched through the setuid sandbox, ZygoteHostImpl::Init |
| 457 // arranges for kZygoteIdFd to be a dummy file descriptor to satisfy an |
| 458 // ancient setuid sandbox ABI requirement. However, the descriptor is no |
| 459 // longer needed, so we can simply close it right away now. |
| 460 CHECK_EQ(0, IGNORE_EINTR(close(kZygoteIdFd))); |
| 461 } |
463 | 462 |
464 if (forkdelegate != NULL) { | 463 if (forkdelegate != NULL) { |
465 VLOG(1) << "ZygoteMain: initializing fork delegate"; | 464 VLOG(1) << "ZygoteMain: initializing fork delegate"; |
466 forkdelegate->Init(GetSandboxFD(), must_enable_setuid_sandbox); | 465 forkdelegate->Init(GetSandboxFD(), must_enable_setuid_sandbox); |
467 } else { | 466 } else { |
468 VLOG(1) << "ZygoteMain: fork delegate is NULL"; | 467 VLOG(1) << "ZygoteMain: fork delegate is NULL"; |
469 } | 468 } |
470 | 469 |
471 // Turn on the first layer of the sandbox if the configuration warrants it. | 470 // Turn on the first layer of the sandbox if the configuration warrants it. |
472 EnterLayerOneSandbox(linux_sandbox, must_enable_setuid_sandbox); | 471 EnterLayerOneSandbox(linux_sandbox, must_enable_setuid_sandbox); |
473 | 472 |
474 int sandbox_flags = linux_sandbox->GetStatus(); | 473 int sandbox_flags = linux_sandbox->GetStatus(); |
475 bool setuid_sandbox_engaged = sandbox_flags & kSandboxLinuxSUID; | 474 bool setuid_sandbox_engaged = sandbox_flags & kSandboxLinuxSUID; |
476 CHECK_EQ(must_enable_setuid_sandbox, setuid_sandbox_engaged); | 475 CHECK_EQ(must_enable_setuid_sandbox, setuid_sandbox_engaged); |
477 | 476 |
478 Zygote zygote(sandbox_flags, forkdelegate); | 477 Zygote zygote(sandbox_flags, forkdelegate); |
479 // This function call can return multiple times, once per fork(). | 478 // This function call can return multiple times, once per fork(). |
480 return zygote.ProcessRequests(); | 479 return zygote.ProcessRequests(); |
481 } | 480 } |
482 | 481 |
483 } // namespace content | 482 } // namespace content |
OLD | NEW |