| OLD | NEW |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 // http://code.google.com/p/chromium/wiki/LinuxSUIDSandbox | 5 // http://code.google.com/p/chromium/wiki/LinuxSUIDSandbox |
| 6 | 6 |
| 7 #include "sandbox/linux/suid/common/sandbox.h" | 7 #include "sandbox/linux/suid/common/sandbox.h" |
| 8 | 8 |
| 9 #define _GNU_SOURCE | 9 #define _GNU_SOURCE |
| 10 #include <asm/unistd.h> | 10 #include <asm/unistd.h> |
| (...skipping 415 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 426 fprintf(stderr, "Usage: %s <renderer process> <args...>\n", argv[0]); | 426 fprintf(stderr, "Usage: %s <renderer process> <args...>\n", argv[0]); |
| 427 return 1; | 427 return 1; |
| 428 } | 428 } |
| 429 | 429 |
| 430 // Allow someone to query our API version | 430 // Allow someone to query our API version |
| 431 if (argc == 2 && 0 == strcmp(argv[1], kSuidSandboxGetApiSwitch)) { | 431 if (argc == 2 && 0 == strcmp(argv[1], kSuidSandboxGetApiSwitch)) { |
| 432 printf("%ld\n", kSUIDSandboxApiNumber); | 432 printf("%ld\n", kSUIDSandboxApiNumber); |
| 433 return 0; | 433 return 0; |
| 434 } | 434 } |
| 435 | 435 |
| 436 // In the SUID sandbox, if we succeed in calling MoveToNewNamespaces() | 436 // We cannot adjust /proc/pid/oom_adj for sandboxed renderers |
| 437 // below, then the zygote and all the renderers are in an alternate PID | 437 // because those files are owned by root. So we need a helper here. |
| 438 // namespace and do not know their real PIDs. As such, they report the wrong | |
| 439 // PIDs to the task manager. | |
| 440 // | |
| 441 // To fix this, when the zygote spawns a new renderer, it gives the renderer | |
| 442 // a dummy socket, which has a unique inode number. Then it asks the sandbox | |
| 443 // host to find the PID of the process holding that fd by searching /proc. | |
| 444 // | |
| 445 // Since the zygote and renderers are all spawned by this setuid executable, | |
| 446 // their entries in /proc are owned by root and only readable by root. In | |
| 447 // order to search /proc for the fd we want, this setuid executable has to | |
| 448 // double as a helper and perform the search. The code block below does this | |
| 449 // when you call it with --find-inode INODE_NUMBER. | |
| 450 if (argc == 3 && (0 == strcmp(argv[1], kFindInodeSwitch))) { | |
| 451 pid_t pid; | |
| 452 char* endptr = NULL; | |
| 453 errno = 0; | |
| 454 ino_t inode = strtoull(argv[2], &endptr, 10); | |
| 455 if (inode == ULLONG_MAX || !endptr || *endptr || errno != 0) | |
| 456 return 1; | |
| 457 if (!FindProcessHoldingSocket(&pid, inode)) | |
| 458 return 1; | |
| 459 printf("%d\n", pid); | |
| 460 return 0; | |
| 461 } | |
| 462 // Likewise, we cannot adjust /proc/pid/oom_adj for sandboxed renderers | |
| 463 // because those files are owned by root. So we need another helper here. | |
| 464 if (argc == 4 && (0 == strcmp(argv[1], kAdjustOOMScoreSwitch))) { | 438 if (argc == 4 && (0 == strcmp(argv[1], kAdjustOOMScoreSwitch))) { |
| 465 char* endptr = NULL; | 439 char* endptr = NULL; |
| 466 long score; | 440 long score; |
| 467 errno = 0; | 441 errno = 0; |
| 468 unsigned long pid_ul = strtoul(argv[2], &endptr, 10); | 442 unsigned long pid_ul = strtoul(argv[2], &endptr, 10); |
| 469 if (pid_ul == ULONG_MAX || !endptr || *endptr || errno != 0) | 443 if (pid_ul == ULONG_MAX || !endptr || *endptr || errno != 0) |
| 470 return 1; | 444 return 1; |
| 471 pid_t pid = pid_ul; | 445 pid_t pid = pid_ul; |
| 472 endptr = NULL; | 446 endptr = NULL; |
| 473 errno = 0; | 447 errno = 0; |
| (...skipping 24 matching lines...) Expand all Loading... |
| 498 if (!DropRoot()) | 472 if (!DropRoot()) |
| 499 return 1; | 473 return 1; |
| 500 if (!SetupChildEnvironment()) | 474 if (!SetupChildEnvironment()) |
| 501 return 1; | 475 return 1; |
| 502 | 476 |
| 503 execv(argv[1], &argv[1]); | 477 execv(argv[1], &argv[1]); |
| 504 FatalError("execv failed"); | 478 FatalError("execv failed"); |
| 505 | 479 |
| 506 return 1; | 480 return 1; |
| 507 } | 481 } |
| OLD | NEW |