OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 // http://code.google.com/p/chromium/wiki/LinuxSUIDSandbox | 5 // http://code.google.com/p/chromium/wiki/LinuxSUIDSandbox |
6 | 6 |
7 #include "sandbox/linux/suid/common/sandbox.h" | 7 #include "sandbox/linux/suid/common/sandbox.h" |
8 | 8 |
9 #define _GNU_SOURCE | 9 #define _GNU_SOURCE |
10 #include <asm/unistd.h> | 10 #include <asm/unistd.h> |
(...skipping 415 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
426 fprintf(stderr, "Usage: %s <renderer process> <args...>\n", argv[0]); | 426 fprintf(stderr, "Usage: %s <renderer process> <args...>\n", argv[0]); |
427 return 1; | 427 return 1; |
428 } | 428 } |
429 | 429 |
430 // Allow someone to query our API version | 430 // Allow someone to query our API version |
431 if (argc == 2 && 0 == strcmp(argv[1], kSuidSandboxGetApiSwitch)) { | 431 if (argc == 2 && 0 == strcmp(argv[1], kSuidSandboxGetApiSwitch)) { |
432 printf("%ld\n", kSUIDSandboxApiNumber); | 432 printf("%ld\n", kSUIDSandboxApiNumber); |
433 return 0; | 433 return 0; |
434 } | 434 } |
435 | 435 |
436 // In the SUID sandbox, if we succeed in calling MoveToNewNamespaces() | 436 // We cannot adjust /proc/pid/oom_adj for sandboxed renderers |
437 // below, then the zygote and all the renderers are in an alternate PID | 437 // because those files are owned by root. So we need a helper here. |
438 // namespace and do not know their real PIDs. As such, they report the wrong | |
439 // PIDs to the task manager. | |
440 // | |
441 // To fix this, when the zygote spawns a new renderer, it gives the renderer | |
442 // a dummy socket, which has a unique inode number. Then it asks the sandbox | |
443 // host to find the PID of the process holding that fd by searching /proc. | |
444 // | |
445 // Since the zygote and renderers are all spawned by this setuid executable, | |
446 // their entries in /proc are owned by root and only readable by root. In | |
447 // order to search /proc for the fd we want, this setuid executable has to | |
448 // double as a helper and perform the search. The code block below does this | |
449 // when you call it with --find-inode INODE_NUMBER. | |
450 if (argc == 3 && (0 == strcmp(argv[1], kFindInodeSwitch))) { | |
451 pid_t pid; | |
452 char* endptr = NULL; | |
453 errno = 0; | |
454 ino_t inode = strtoull(argv[2], &endptr, 10); | |
455 if (inode == ULLONG_MAX || !endptr || *endptr || errno != 0) | |
456 return 1; | |
457 if (!FindProcessHoldingSocket(&pid, inode)) | |
458 return 1; | |
459 printf("%d\n", pid); | |
460 return 0; | |
461 } | |
462 // Likewise, we cannot adjust /proc/pid/oom_adj for sandboxed renderers | |
463 // because those files are owned by root. So we need another helper here. | |
464 if (argc == 4 && (0 == strcmp(argv[1], kAdjustOOMScoreSwitch))) { | 438 if (argc == 4 && (0 == strcmp(argv[1], kAdjustOOMScoreSwitch))) { |
465 char* endptr = NULL; | 439 char* endptr = NULL; |
466 long score; | 440 long score; |
467 errno = 0; | 441 errno = 0; |
468 unsigned long pid_ul = strtoul(argv[2], &endptr, 10); | 442 unsigned long pid_ul = strtoul(argv[2], &endptr, 10); |
469 if (pid_ul == ULONG_MAX || !endptr || *endptr || errno != 0) | 443 if (pid_ul == ULONG_MAX || !endptr || *endptr || errno != 0) |
470 return 1; | 444 return 1; |
471 pid_t pid = pid_ul; | 445 pid_t pid = pid_ul; |
472 endptr = NULL; | 446 endptr = NULL; |
473 errno = 0; | 447 errno = 0; |
(...skipping 24 matching lines...) Expand all Loading... |
498 if (!DropRoot()) | 472 if (!DropRoot()) |
499 return 1; | 473 return 1; |
500 if (!SetupChildEnvironment()) | 474 if (!SetupChildEnvironment()) |
501 return 1; | 475 return 1; |
502 | 476 |
503 execv(argv[1], &argv[1]); | 477 execv(argv[1], &argv[1]); |
504 FatalError("execv failed"); | 478 FatalError("execv failed"); |
505 | 479 |
506 return 1; | 480 return 1; |
507 } | 481 } |
OLD | NEW |