Initial implementation of the Mac Bootstrap Sandbox.

sandbox/mac/os_compatibility.cc

+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "sandbox/mac/os_compatibility.h"
+
+#include <servers/bootstrap.h>
+#include <unistd.h>
+
+#include "base/mac/mac_util.h"
+
+namespace sandbox {
+
+namespace {
+
+// Verified from launchd-329.3.3 (10.6.8).
+struct look_up2_request_10_6 {
+  mach_msg_header_t Head;
+  NDR_record_t NDR;
+  name_t servicename;
+  pid_t targetpid;
+  uint64_t flags;
+};
+
+struct look_up2_reply_10_6 {
+  mach_msg_header_t Head;
+  mach_msg_body_t msgh_body;
+  mach_msg_port_descriptor_t service_port;
+};
+
+// Verified from:
+//   launchd-392.39 (10.7.5)
+//   launchd-442.26.2 (10.8.5)
+//   launchd-842.1.4 (10.9.0)
+struct look_up2_request_10_7 {
+  mach_msg_header_t Head;
+  NDR_record_t NDR;
+  name_t servicename;
+  pid_t targetpid;
+  uuid_t instanceid;
+  uint64_t flags;
+};
+
+// look_up2_reply_10_7 is the same as the 10_6 version.
+
+// TODO(rsesek): Libc provides strnlen() staring in 10.7.

[Avi (use Gerrit), 2014/05/09 21:02:06]

typo: starting

[Robert Sesek, 2014/05/09 22:04:03]

Done.

+size_t strnlen(const char* str, size_t maxlen) {
+  size_t len = 0;
+  for (; len < maxlen; ++len, ++str) {
+    if (*str == '\0')
+      break;
+  }
+  return len;
+}
+
+template <typename R>
+std::string LaunchdLookUp2GetRequestName(const mach_msg_header_t* header) {
+  DCHECK_EQ(sizeof(R), header->msgh_size);
+  const R* request = reinterpret_cast<const R*>(header);
+  // Make sure the name is properly NUL-terminated.
+  const size_t name_length =
+      strnlen(request->servicename, BOOTSTRAP_MAX_NAME_LEN);
+  std::string name = std::string(request->servicename, name_length);
+  name[name_length] = '\0';

[Mark Mentovai, 2014/05/09 20:11:19]

Not necessary, std::string guarantees NUL-termination.

Also not really legal, you’re not supposed to write past [.length() - 1].

[Robert Sesek, 2014/05/09 22:04:03]

Done. For posterity, C++ § 21.4.5.

+  return name;
+}
+
+template <typename R>
+void LaunchdLookUp2FillReply(mach_msg_header_t* header, mach_port_t port) {
+  R* reply = reinterpret_cast<R*>(header);
+  reply->Head.msgh_size = sizeof(R);
+  reply->Head.msgh_bits =
+      MACH_MSGH_BITS_REMOTE(MACH_MSG_TYPE_MOVE_SEND_ONCE) |
+      MACH_MSGH_BITS_COMPLEX;
+  reply->msgh_body.msgh_descriptor_count = 1;
+  reply->service_port.name = port;
+  reply->service_port.disposition = MACH_MSG_TYPE_PORT_SEND;
+  reply->service_port.type = MACH_MSG_PORT_DESCRIPTOR;
+}
+
+}  // namespace
+
+const LaunchdCompatibilityShim GetLaunchdCompatibilityShim() {
+  LaunchdCompatibilityShim shim = {
+    .msg_id_look_up2 = 404,
+    .msg_id_swap_integer = 416,
+    .look_up2_fill_reply = &LaunchdLookUp2FillReply<look_up2_reply_10_6>
+  };
+
+  if (base::mac::IsOSSnowLeopard()) {
+    shim.look_up2_get_request_name =
+        &LaunchdLookUp2GetRequestName<look_up2_request_10_6>;
+  } else if (base::mac::IsOSLionOrLater() &&
+             !base::mac::IsOSLaterThanMavericks_DontCallThis()) {
+    shim.look_up2_get_request_name =
+        &LaunchdLookUp2GetRequestName<look_up2_request_10_7>;
+  } else {
+    LOG(ERROR) << "Unknown OS, using launchd compatibility shim from 10.7.";
+    shim.look_up2_get_request_name =
+        &LaunchdLookUp2GetRequestName<look_up2_request_10_7>;

[Avi (use Gerrit), 2014/05/09 21:02:06]

In the past when we blindly patched CFAllocator in unknown systems, it caused
crashes. So we made a policy decision to not blindly patch things that are known
to change across system versions, knowing that it means that we take a slight
security hit until we can get our hands on an OS seed to verify.

See CanGetContextForCFAllocator.

I'm surprised that we aren't going to do the same here.

---

Also, from experience, doing a LOG(ERROR) like you do above is a mistake. If
things _aren't_ compatible, you'll get crash reports in which it is obvious what
the problem is. If things _are_ compatible, you will have every yokel who gets
their hands on an OS seed log bugs against you for every weird thing they see
because you have made yourself a target.

Don't do it. :)

[Robert Sesek, 2014/05/09 22:04:03]

Launchd hasn't changed these messages since 10.7, so they appear much more
stable than the allocator internals. The user of the sandbox could decide to not
turn it on for FutureCat; that way the //sandbox/mac code doesn't have to know
about whether or not it should be turned on.
Oh, right. Switched to DLOG so that I'll see it in debug mode at least.

+  }
+
+  return shim;
+}
+
+}  // namespace sandbox