Allow the seccomp sandbox to be enabled, even if the suid sandbox has...

chrome/browser/zygote_main_linux.cc

 // Copyright (c) 2009 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <dlfcn.h>
+#include <fcntl.h>
 #include <sys/epoll.h>
 #include <sys/prctl.h>
 #include <sys/signal.h>
 #include <sys/socket.h>
+#include <sys/stat.h>
 #include <sys/types.h>
 #include <sys/wait.h>
 #include <unistd.h>
 
 #if defined(CHROMIUM_SELINUX)
 #include <selinux/selinux.h>
 #include <selinux/context.h>
 #endif
 
 #include "base/basictypes.h"
@@ skipping 23 matching lines @@
 #include "sandbox/linux/seccomp/sandbox.h"
 
 #include "unicode/timezone.h"
 
 // http://code.google.com/p/chromium/wiki/LinuxZygote
 
 static const int kBrowserDescriptor = 3;
 static const int kMagicSandboxIPCDescriptor = 5;
 static const int kZygoteIdDescriptor = 7;
 static bool g_suid_sandbox_active = false;
+static int g_proc_fd = -1;
 
 // This is the object which implements the zygote. The ZygoteMain function,
 // which is called from ChromeMain, at the the bottom and simple constructs one
 // of these objects and runs it.
 class Zygote {
  public:
   bool ProcessRequests() {
     // A SOCK_SEQPACKET socket is installed in fd 3. We get commands from the
     // browser on it.
     // A SOCK_DGRAM is installed in fd 5. This is the sandbox IPC channel.
@@ skipping 164 matching lines @@
       if (dummy_fd < 0)
         goto error;
 
       if (!base::FileDescriptorGetInode(&dummy_inode, dummy_fd))
         goto error;
     }
 
     child = fork();
 
     if (!child) {
+      // Try to open /proc/self/maps as the seccomp sandbox needs access to it
+      if (g_proc_fd >= 0) {
+        int proc_self_maps = openat(g_proc_fd, "self/maps", O_RDONLY);
+        if (proc_self_maps >= 0) {
+          SeccompSandboxSetProcSelfMaps(proc_self_maps);
+        }
+        close(g_proc_fd);
+        g_proc_fd = -1;
+      }
+
       close(kBrowserDescriptor);  // our socket from the browser
       close(kZygoteIdDescriptor);  // another socket from the browser
       Singleton<base::GlobalDescriptors>()->Reset(mapping);
 
       // Reset the process-wide command line to our new command line.
       CommandLine::Reset();
       CommandLine::Init(0, NULL);
       CommandLine::ForCurrentProcess()->InitFromArgv(args);
       CommandLine::SetProcTitle();
       return true;
@@ skipping 329 matching lines @@
   return true;
 }
 
 #endif  // CHROMIUM_SELINUX
 
 bool ZygoteMain(const MainFunctionParams& params) {
 #if !defined(CHROMIUM_SELINUX)
   g_am_zygote_or_renderer = true;
 #endif
 
+  // The seccomp sandbox needs access to files in /proc, which might be denied
+  // after one of the other sandboxes have been started. So, obtain a suitable
+  // file handle in advance.
   if (CommandLine::ForCurrentProcess()->HasSwitch(
           switches::kEnableSeccompSandbox)) {
-    if (!SupportsSeccompSandbox()) {
+    g_proc_fd = open("/proc", O_DIRECTORY | O_RDONLY);
+    if (g_proc_fd < 0) {
+      LOG(ERROR) << "WARNING! Cannot access \"/proc\". Disabling seccomp "
+                    "sandboxing.";
+    }
+  }
+
+  // Turn on the SELinux or SUID sandbox
+  if (!EnterSandbox()) {
+    LOG(FATAL) << "Failed to enter sandbox. Fail safe abort. (errno: "
+               << errno << ")";
+    return false;
+  }
+
+  // The seccomp sandbox will be turned on when the renderers start. But we can
+  // already check if sufficient support is available so that we only need to
+  // print one error message for the entire browser session.
+  if (g_proc_fd >= 0 &&
+      CommandLine::ForCurrentProcess()->HasSwitch(
+          switches::kEnableSeccompSandbox)) {
+    if (!SupportsSeccompSandbox(g_proc_fd)) {
       // There are a good number of users who cannot use the seccomp sandbox
       // (e.g. because their distribution does not enable seccomp mode by
       // default). While we would prefer to deny execution in this case, it
       // seems more realistic to continue in degraded mode.
       LOG(ERROR) << "WARNING! This machine lacks support needed for the "
                     "Seccomp sandbox. Running renderers with Seccomp "
                     "sandboxing disabled.";
     } else {
       LOG(INFO) << "Enabling experimental Seccomp sandbox.";
     }
   }
 
-  if (!EnterSandbox()) {
-    LOG(FATAL) << "Failed to enter sandbox. Fail safe abort. (errno: "
-               << errno << ")";
-    return false;
-  }
-
   Zygote zygote;
   return zygote.ProcessRequests();
 }