Add sandbox support for AsanCoverage.

content/zygote/zygote_main_linux.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/zygote/zygote_main.h"
 
 #include <dlfcn.h>
+#include <fcntl.h>
 #include <pthread.h>
 #include <string.h>
+#include <sys/socket.h>
 #include <sys/types.h>
 #include <unistd.h>
 
 #include "base/basictypes.h"
 #include "base/bind.h"
 #include "base/command_line.h"
 #include "base/compiler_specific.h"
 #include "base/memory/scoped_vector.h"
 #include "base/native_library.h"
 #include "base/pickle.h"
+#include "base/posix/eintr_wrapper.h"
 #include "base/posix/unix_domain_socket_linux.h"
 #include "base/rand_util.h"
 #include "base/sys_info.h"
 #include "build/build_config.h"
 #include "content/common/child_process_sandbox_support_impl_linux.h"
 #include "content/common/font_config_ipc_linux.h"
 #include "content/common/pepper_plugin_list.h"
 #include "content/common/sandbox_linux/sandbox_linux.h"
 #include "content/common/zygote_commands_linux.h"
 #include "content/public/common/content_switches.h"
@@ skipping 10 matching lines @@
 #include "third_party/skia/include/ports/SkFontConfigInterface.h"
 
 #if defined(OS_LINUX)
 #include <sys/prctl.h>
 #endif
 
 #if defined(ENABLE_WEBRTC)
 #include "third_party/libjingle/overrides/init_webrtc.h"
 #endif
 
+#if defined(ADDRESS_SANITIZER)
+#include <sanitizer/asan_interface.h>
+#endif
+
 namespace content {
 
 // See http://code.google.com/p/chromium/wiki/LinuxZygote
 
 static void ProxyLocaltimeCallToBrowser(time_t input, struct tm* output,
                                         char* timezone_out,
                                         size_t timezone_out_len) {
   Pickle request;
   request.WriteInt(LinuxSandbox::METHOD_LOCALTIME);
   request.WriteString(
@@ skipping 256 matching lines @@
   // Ensure access to the Pepper plugins before the sandbox is turned on.
   PreloadPepperPlugins();
 #endif
 #if defined(ENABLE_WEBRTC)
   InitializeWebRtcModule();
 #endif
   SkFontConfigInterface::SetGlobal(
       new FontConfigIPC(GetSandboxFD()))->unref();
 }
 
-static bool CreateInitProcessReaper() {
+static bool CreateInitProcessReaper(base::Closure* post_fork_parent_callback) {
   // The current process becomes init(1), this function returns from a
   // newly created process.
-  const bool init_created = sandbox::CreateInitProcessReaper(NULL);
+  const bool init_created =
+      sandbox::CreateInitProcessReaper(post_fork_parent_callback);
   if (!init_created) {
     LOG(ERROR) << "Error creating an init process to reap zombies";
     return false;
   }
   return true;
 }
 
 // Enter the setuid sandbox. This requires the current process to have been
 // created through the setuid sandbox.
-static bool EnterSuidSandbox(sandbox::SetuidSandboxClient* setuid_sandbox) {
+static bool EnterSuidSandbox(sandbox::SetuidSandboxClient* setuid_sandbox,
+                             base::Closure* post_fork_parent_callback) {
   DCHECK(setuid_sandbox);
   DCHECK(setuid_sandbox->IsSuidSandboxChild());
 
   // Use the SUID sandbox.  This still allows the seccomp sandbox to
   // be enabled by the process later.
 
   if (!setuid_sandbox->IsSuidSandboxUpToDate()) {
     LOG(WARNING) <<
         "You are using a wrong version of the setuid binary!\n"
         "Please read "
         "https://code.google.com/p/chromium/wiki/LinuxSUIDSandboxDevelopment."
         "\n\n";
   }
 
   if (!setuid_sandbox->ChrootMe())
     return false;
 
   if (setuid_sandbox->IsInNewPIDNamespace()) {
     CHECK_EQ(1, getpid())
         << "The SUID sandbox created a new PID namespace but Zygote "
            "is not the init process. Please, make sure the SUID "
            "binary is up to date.";
   }
 
   if (getpid() == 1) {
     // The setuid sandbox has created a new PID namespace and we need
     // to assume the role of init.
-    CHECK(CreateInitProcessReaper());
+    CHECK(CreateInitProcessReaper(post_fork_parent_callback));
   }
 
 #if !defined(OS_OPENBSD)
   // Previously, we required that the binary be non-readable. This causes the
   // kernel to mark the process as non-dumpable at startup. The thinking was
   // that, although we were putting the renderers into a PID namespace (with
   // the SUID sandbox), they would nonetheless be in the /same/ PID
   // namespace. So they could ptrace each other unless they were non-dumpable.
   //
   // If the binary was readable, then there would be a window between process
@@ skipping 13 matching lines @@
     if (prctl(PR_GET_DUMPABLE, 0, 0, 0, 0)) {
       LOG(ERROR) << "Failed to set non-dumpable flag";
       return false;
     }
   }
 #endif
 
   return true;
 }
 
+#if defined(ADDRESS_SANITIZER)
+const size_t kSanitizerMaxMessageLength = 1 * 1024 * 1024;
+
+// A helper process which collects code coverage data from the renderers over a
+// socket and dumps it to a file. See http://crbug.com/336212 for discussion.
+static void SanitizerCoverageHelper(int socket_fd, int file_fd) {
+  scoped_ptr<char[]> buffer(new char[kSanitizerMaxMessageLength]);
+  while (true) {
+    ssize_t received_size = HANDLE_EINTR(
+        recv(socket_fd, buffer.get(), kSanitizerMaxMessageLength, 0));
+    PCHECK(received_size >= 0);
+    if (received_size == 0)
+      // All clients have closed the socket. We should die.
+      _exit(0);
+    PCHECK(file_fd >= 0);
+    ssize_t written_size = 0;
+    while (written_size < received_size) {
+      ssize_t write_res =
+          HANDLE_EINTR(write(file_fd, buffer.get() + written_size,
+                             received_size - written_size));
+      PCHECK(write_res >= 0);
+      written_size += write_res;
+    }
+    PCHECK(0 == HANDLE_EINTR(fsync(file_fd)));
+  }
+}
+
+// fds[0] is the read end, fds[1] is the write end.
+static void CreateSanitizerCoverageSocketPair(int fds[2]) {
+  PCHECK(0 == socketpair(AF_UNIX, SOCK_SEQPACKET, 0, fds));
+  PCHECK(0 == shutdown(fds[0], SHUT_WR));
+  PCHECK(0 == shutdown(fds[1], SHUT_RD));
+}
+
+static pid_t ForkSanitizerCoverageHelper(int child_fd, int parent_fd,
+                                        base::ScopedFD file_fd) {
+  pid_t pid = fork();
+  PCHECK(pid >= 0);
+  if (pid == 0) {
+    // In the child.
+    PCHECK(0 == IGNORE_EINTR(close(parent_fd)));
+    SanitizerCoverageHelper(child_fd, file_fd.get());
+    _exit(0);
+  } else {
+    // In the parent.
+    PCHECK(0 == IGNORE_EINTR(close(child_fd)));
+    return pid;
+  }
+}
+
+void CloseFdPair(const int fds[2]) {
+  PCHECK(0 == IGNORE_EINTR(close(fds[0])));
+  PCHECK(0 == IGNORE_EINTR(close(fds[1])));
+}
+#endif  // defined(ADDRESS_SANITIZER)
+
 // If |is_suid_sandbox_child|, then make sure that the setuid sandbox is
 // engaged.
 static void EnterLayerOneSandbox(LinuxSandbox* linux_sandbox,
-                                 bool is_suid_sandbox_child) {
+                                 bool is_suid_sandbox_child,
+                                 base::Closure* post_fork_parent_callback) {
   DCHECK(linux_sandbox);
 
   ZygotePreSandboxInit();
 
   // Check that the pre-sandbox initialization didn't spawn threads.
 #if !defined(THREAD_SANITIZER)
   DCHECK(linux_sandbox->IsSingleThreaded());
 #endif
 
   sandbox::SetuidSandboxClient* setuid_sandbox =
       linux_sandbox->setuid_sandbox_client();
 
   if (is_suid_sandbox_child) {
-    CHECK(EnterSuidSandbox(setuid_sandbox)) << "Failed to enter setuid sandbox";
+    CHECK(EnterSuidSandbox(setuid_sandbox, post_fork_parent_callback))
+        << "Failed to enter setuid sandbox";
   }
 }
 
 bool ZygoteMain(const MainFunctionParams& params,
                 ScopedVector<ZygoteForkDelegate> fork_delegates) {
   g_am_zygote_or_renderer = true;
   sandbox::InitLibcUrandomOverrides();
 
+  base::Closure *post_fork_parent_callback = NULL;
+
   LinuxSandbox* linux_sandbox = LinuxSandbox::GetInstance();
+
+#if defined(ADDRESS_SANITIZER)
+  base::ScopedFD sancov_file_fd(__sanitizer_maybe_open_cov_file("zygote"));
+  int sancov_socket_fds[2] = {-1, -1};
+  CreateSanitizerCoverageSocketPair(sancov_socket_fds);
+  linux_sandbox->sanitizer_args()->coverage_sandboxed = 1;
+  linux_sandbox->sanitizer_args()->coverage_fd = sancov_socket_fds[1];
+  linux_sandbox->sanitizer_args()->coverage_max_block_size =
+      kSanitizerMaxMessageLength;
+  // Zygote termination will block until the helper process exits, which will
+  // not happen until the write end of the socket is closed everywhere. Make
+  // sure the init process does not hold on to it.
+  base::Closure close_sancov_socket_fds =
+      base::Bind(&CloseFdPair, sancov_socket_fds);
+  post_fork_parent_callback = &close_sancov_socket_fds;
+#endif
+
   // This will pre-initialize the various sandboxes that need it.
   linux_sandbox->PreinitializeSandbox();
 
   const bool must_enable_setuid_sandbox =
       linux_sandbox->setuid_sandbox_client()->IsSuidSandboxChild();
   if (must_enable_setuid_sandbox) {
     linux_sandbox->setuid_sandbox_client()->CloseDummyFile();
 
     // Let the ZygoteHost know we're booting up.
     CHECK(UnixDomainSocket::SendMsg(kZygoteSocketPairFd,
                                     kZygoteBootMessage,
                                     sizeof(kZygoteBootMessage),
                                     std::vector<int>()));
   }
 
   VLOG(1) << "ZygoteMain: initializing " << fork_delegates.size()
           << " fork delegates";
   for (ScopedVector<ZygoteForkDelegate>::iterator i = fork_delegates.begin();
        i != fork_delegates.end();
        ++i) {
     (*i)->Init(GetSandboxFD(), must_enable_setuid_sandbox);
   }
 
   // Turn on the first layer of the sandbox if the configuration warrants it.
-  EnterLayerOneSandbox(linux_sandbox, must_enable_setuid_sandbox);
+  EnterLayerOneSandbox(linux_sandbox, must_enable_setuid_sandbox,
+                       post_fork_parent_callback);
+
+  std::vector<pid_t> extra_children;
+  std::vector<int> extra_fds;
+
+#if defined(ADDRESS_SANITIZER)
+  pid_t sancov_helper_pid = ForkSanitizerCoverageHelper(
+      sancov_socket_fds[0], sancov_socket_fds[1], sancov_file_fd.Pass());
+  // It's important that the zygote reaps the helper before dying. Otherwise,
+  // the destruction of the PID namespace could kill the helper before it
+  // completes its I/O tasks.

[jln (very slow on Chromium), 2014/05/27 23:15:00]

Let's add more information about the lifetime of sancov_helper_pid.

Something along the lines of: "|sancov_helper_pid| will exit once the last
renderer holding the write end of sancov_socket_fds closes it."

[earthdok, 2014/05/28 16:44:51]

Done.

+  extra_children.push_back(sancov_helper_pid);
+  // Sanitizer code in the renderers will inherit the write end of the socket
+  // from the zygote. We must keep it open until the very end of the zygote's
+  // lifetime, even though we don't explicitly use it.
+  extra_fds.push_back(sancov_socket_fds[1]);
+#endif
 
   int sandbox_flags = linux_sandbox->GetStatus();
   bool setuid_sandbox_engaged = sandbox_flags & kSandboxLinuxSUID;
   CHECK_EQ(must_enable_setuid_sandbox, setuid_sandbox_engaged);
 
-  Zygote zygote(sandbox_flags, fork_delegates.Pass());
+  Zygote zygote(sandbox_flags, fork_delegates.Pass(), extra_children,
+                extra_fds);
   // This function call can return multiple times, once per fork().
   return zygote.ProcessRequests();
 }
 
 }  // namespace content