Non-SFI Mode: Build ipc/ library by PNaCl toolchain for nacl_helper_nonsfi.

ipc/ipc_channel_posix.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "ipc/ipc_channel_posix.h"
 
 #include <errno.h>
 #include <fcntl.h>
 #include <stddef.h>
 #include <sys/socket.h>
 #include <sys/stat.h>
 #include <sys/types.h>
-#include <sys/un.h>
 #include <unistd.h>
 
 #if defined(OS_OPENBSD)
 #include <sys/uio.h>
 #endif
 
+#if !defined(__native_client_nonsfi__)
+#include <sys/un.h>
+#endif
+
 #include <map>
 #include <string>
 
 #include "base/command_line.h"
 #include "base/files/file_path.h"
 #include "base/files/file_util.h"
 #include "base/location.h"
 #include "base/logging.h"
 #include "base/memory/scoped_ptr.h"
 #include "base/memory/singleton.h"
@@ skipping 136 matching lines @@
 #if defined(OS_ANDROID)
 // When we fork for simple tests on Android, we can't 'exec', so we need to
 // reset these entries manually to get the expected testing behavior.
 void Channel::NotifyProcessForkedForTesting() {
   PipeMap::GetInstance()->map_.clear();
 }
 #endif
 
 //------------------------------------------------------------------------------
 
-#if defined(OS_LINUX)
+#if defined(OS_LINUX) || defined(__native_client_nonsfi__)
 int ChannelPosix::global_pid_ = 0;
-#endif  // OS_LINUX
+#endif
 
 ChannelPosix::ChannelPosix(const IPC::ChannelHandle& channel_handle,
                            Mode mode, Listener* listener)
     : ChannelReader(listener),
       mode_(mode),
       peer_pid_(base::kNullProcessId),
       is_blocked_on_write_(false),
       waiting_connect_(true),
       message_send_bytes_written_(0),
       pipe_name_(channel_handle.name),
@@ skipping 59 matching lines @@
     if (value == -1) {
       PLOG(ERROR) << "fcntl(F_GETFL) " << pipe_name_;
       return false;
     }
     if (!(value & O_NONBLOCK)) {
       LOG(ERROR) << "Socket " << pipe_name_ << " must be O_NONBLOCK";
       return false;
     }
 #endif   // IPC_USES_READWRITE
   } else if (mode_ & MODE_NAMED_FLAG) {
+#if defined(__native_client_nonsfi__)
+    // IPC channels in nacl_helper_nonsfi should not be NAMED mode.

[Mark Seaborn, 2014/10/22 00:35:51]

Nit: "in NAMED mode"?

[hidehiko, 2014/10/22 13:31:05]

Done.

+    NOTREACHED();

[Mark Seaborn, 2014/10/22 00:35:51]

How about CHECK(false)?  NOTREACHED is a no-op in release builds.

[hidehiko, 2014/10/22 13:31:05]

Done. Replaced by LOG(FATAL).

+    return false;
+#else
     // Case 2 from comment above.
     int local_pipe_fd = -1;
 
     if (mode_ & MODE_SERVER_FLAG) {
       if (!CreateServerUnixDomainSocket(base::FilePath(pipe_name_),
                                         &local_pipe_fd)) {
         return false;
       }
 
       must_unlink_ = true;
     } else if (mode_ & MODE_CLIENT_FLAG) {
       if (!CreateClientUnixDomainSocket(base::FilePath(pipe_name_),
                                         &local_pipe_fd)) {
         return false;
       }
     } else {
       LOG(ERROR) << "Bad mode: " << mode_;
       return false;
     }
 
     local_pipe.reset(local_pipe_fd);
+#endif  // !defined(__native_client_nonsfi__)
   } else {
     local_pipe.reset(PipeMap::GetInstance()->Lookup(pipe_name_));
     if (mode_ & MODE_CLIENT_FLAG) {
       if (local_pipe.is_valid()) {
         // Case 3 from comment above.
         // We only allow one connection.
         local_pipe.reset(HANDLE_EINTR(dup(local_pipe.release())));
         PipeMap::GetInstance()->Remove(pipe_name_);
       } else {
         // Case 4a from comment above.
@@ skipping 40 matching lines @@
     int fd_pipe_fd = 1, remote_fd_pipe_fd = -1;
     if (!SocketPair(&fd_pipe_fd, &remote_fd_pipe_fd)) {
       return false;
     }
 
     fd_pipe_.reset(fd_pipe_fd);
     remote_fd_pipe_.reset(remote_fd_pipe_fd);
   }
 #endif  // IPC_USES_READWRITE
 
-  if ((mode_ & MODE_SERVER_FLAG) && (mode_ & MODE_NAMED_FLAG))
+  if ((mode_ & MODE_SERVER_FLAG) && (mode_ & MODE_NAMED_FLAG)) {
+#if defined(__native_client_nonsfi__)
+    // IPC channels in nacl_helper_nonsfi should not be NAMED or SERVER mode.

[Mark Seaborn, 2014/10/22 00:35:51]

Nit: add "in", so "in NAMED or SERVER mode"?

[hidehiko, 2014/10/22 13:31:05]

Done.

+    NOTREACHED();

[Mark Seaborn, 2014/10/22 00:35:51]

Also CHECK(false)?  Same below...

It would be confusing for code paths to become no-ops that return success.

[hidehiko, 2014/10/22 13:31:06]

Done.

+#else
     server_listen_pipe_.reset(local_pipe.release());
-  else
+#endif
+  } else {
     pipe_.reset(local_pipe.release());
+  }
   return true;
 }
 
 bool ChannelPosix::Connect() {
   if (!server_listen_pipe_.is_valid() && !pipe_.is_valid()) {
     DLOG(WARNING) << "Channel creation failed: " << pipe_name_;
     return false;
   }
 
   bool did_connect = true;
   if (server_listen_pipe_.is_valid()) {
+#if defined(__native_client_nonsfi__)
+    // IPC channels in nacl_helper_nonsfi should always be client mode.
+    NOTREACHED();

[Mark Seaborn, 2014/10/22 00:35:51]

Also CHECK(false)?

Is Connect() used at all in nacl_helper_nonsfi?  If not, should the whole
function body have this #if?

[hidehiko, 2014/10/22 13:31:06]

Done.

Connect() is actually used from ChannelProxy, which is the based of SyncChannel
used from NonSfiListener and PPAPI IPC channel implementation.

+#else
     // Watch the pipe for connections, and turn any connections into
     // active sockets.
     base::MessageLoopForIO::current()->WatchFileDescriptor(
         server_listen_pipe_.get(),
         true,
         base::MessageLoopForIO::WATCH_READ,
         &server_listen_connection_watcher_,
         this);
+#endif
   } else {
     did_connect = AcceptConnection();
   }
   return did_connect;
 }
 
 void ChannelPosix::CloseFileDescriptors(Message* msg) {
 #if defined(OS_MACOSX)
   // There is a bug on OSX which makes it dangerous to close
   // a file descriptor while it is in transit. So instead we
@@ skipping 202 matching lines @@
 }
 
 bool ChannelPosix::AcceptsConnections() const {
   return server_listen_pipe_.is_valid();
 }
 
 bool ChannelPosix::HasAcceptedConnection() const {
   return AcceptsConnections() && pipe_.is_valid();
 }
 
+#if !defined(__native_client_nonsfi__)
+// GetPeerEuid is not supported in nacl_helper_nonsfi.
 bool ChannelPosix::GetPeerEuid(uid_t* peer_euid) const {
   DCHECK(!(mode_ & MODE_SERVER) || HasAcceptedConnection());
   return IPC::GetPeerEuid(pipe_.get(), peer_euid);
 }
+#endif
 
 void ChannelPosix::ResetToAcceptingConnectionState() {
   // Unregister libevent for the unix domain socket and close it.
   read_watcher_.StopWatchingFileDescriptor();
   write_watcher_.StopWatchingFileDescriptor();
   pipe_.reset();
 #if defined(IPC_USES_READWRITE)
   fd_pipe_.reset();
   remote_fd_pipe_.reset();
 #endif  // IPC_USES_READWRITE
@@ skipping 18 matching lines @@
   fds_to_close_.clear();
 #endif
 }
 
 // static
 bool ChannelPosix::IsNamedServerInitialized(
     const std::string& channel_id) {
   return base::PathExists(base::FilePath(channel_id));
 }
 
-#if defined(OS_LINUX)
+#if defined(OS_LINUX) || defined(__native_client_nonsfi__)

[Mark Seaborn, 2014/10/22 00:35:51]

Do we really need SetGlobalPid()?  It would be better if the sandboxed process
does not know its own PID.  Currently we disable getpid().

Does nacl_helper currently initialise global_pid_ before enabling the sandbox?

What does this PID value get used for?  Do the renderer/browser processes
complain if the Non-SFI process doesn't know its own PID?

[hidehiko, 2014/10/22 13:31:05]

We need "something" non-null PID for Hello message. It is used in host process's
ChanneProxy to check if the connection is actually established.

Current nacl_helper does not use global_pid, but getpid() (in libc) seems to
cache the pid, so that it works now.
Actually, invocation of getpid() in NonSfiListener::OnStart does not crash,
although it is not allowed in nonsfi_sandbox.

I'm planning to use SetGlobalPid() in nacl_helper_linux, regardless of whether
it is for nacl_helper or nacl_helper_nonsfi, in a following CL.

[Mark Seaborn, 2014/10/23 03:33:48]

Ah, you mean the "peer_pid_ == base::kNullProcessId" checks in OnAddFilter() and
OnRemoveFilter()?

Is the PID value passed into any place where its actual numeric value matters? 
I am doubtful that it is really needed.

Maybe (in a future change) you could pass a dummy value, like -1, for the PID? 
(We could use 1, but it's less good as a dummy value since it is a valid process
ID.)

 // static
 void ChannelPosix::SetGlobalPid(int pid) {
   global_pid_ = pid;
 }
-#endif  // OS_LINUX
+#endif
 
 // Called by libevent when we can read from the pipe without blocking.
 void ChannelPosix::OnFileCanReadWithoutBlocking(int fd) {
   if (fd == server_listen_pipe_.get()) {
+#if defined(__native_client_nonsfi__)
+    // IPC channels in nacl_helper_nonsfi should not be SERVER mode.
+    NOTREACHED();
+#else
     int new_pipe = 0;
     if (!ServerAcceptConnection(server_listen_pipe_.get(), &new_pipe) ||
         new_pipe < 0) {
       Close();
       listener()->OnChannelListenError();
     }
 
     if (pipe_.is_valid()) {
       // We already have a connection. We only handle one at a time.
       // close our new descriptor.
@@ skipping 18 matching lines @@
         DLOG(WARNING) << "Client euid is not authorised";
         ResetToAcceptingConnectionState();
         return;
       }
     }
 
     if (!AcceptConnection()) {
       NOTREACHED() << "AcceptConnection should not fail on server";
     }
     waiting_connect_ = false;
+#endif
   } else if (fd == pipe_) {
     if (waiting_connect_ && (mode_ & MODE_SERVER_FLAG)) {
       waiting_connect_ = false;
     }
     if (!ProcessIncomingMessages()) {
       // ClosePipeOnError may delete this object, so we mustn't call
       // ProcessOutgoingMessages.
       ClosePipeOnError();
       return;
     }
@@ skipping 53 matching lines @@
     Close();
     if (AcceptsConnections()) {
       listener()->OnChannelListenError();
     } else {
       listener()->OnChannelError();
     }
   }
 }
 
 int ChannelPosix::GetHelloMessageProcId() const {
-  int pid = base::GetCurrentProcId();
+  // Our process may be in a sandbox with a separate PID namespace.
+#if defined(__native_client_nonsfi__)
+  // In nacl_helper_nonsfi, our process should be always in the sandbox, unless
+  // --no-sandbox is set. In such a situation, calling GetCurrentProcId()
+  // would hit the sandbox restriction. global_pid_ should be initialize at
+  // the very beginning of the nacl_helper_nonsfi, regardless of the
+  // --no-sandbox flag.
+  CHECK(global_pid_);
+  return global_pid_;
+#else
 #if defined(OS_LINUX)
-  // Our process may be in a sandbox with a separate PID namespace.
   if (global_pid_) {
-    pid = global_pid_;
+    return global_pid_;
   }
-#endif
-  return pid;
+  // Fall through to below.
+#endif  // defined(OS_LINUX)
+  return base::GetCurrentProcId();
+#endif  // defined(__native_client_nonsfi__)
 }
 
 void ChannelPosix::QueueHelloMessage() {
   // Create the Hello message
   scoped_ptr<Message> msg(new Message(MSG_ROUTING_NONE,
                                       HELLO_MESSAGE_TYPE,
                                       IPC::Message::PRIORITY_NORMAL));
   if (!msg->WriteInt(GetHelloMessageProcId())) {
     NOTREACHED() << "Unable to pickle hello message proc id";
   }
@@ skipping 151 matching lines @@
        cmsg = CMSG_NXTHDR(msg, cmsg)) {
     if (cmsg->cmsg_level == SOL_SOCKET && cmsg->cmsg_type == SCM_RIGHTS) {
       unsigned payload_len = cmsg->cmsg_len - CMSG_LEN(0);
       DCHECK_EQ(0U, payload_len % sizeof(int));
       const int* file_descriptors = reinterpret_cast<int*>(CMSG_DATA(cmsg));
       unsigned num_file_descriptors = payload_len / 4;
       input_fds_.insert(input_fds_.end(),
                         file_descriptors,
                         file_descriptors + num_file_descriptors);
 
+#if !defined(__native_client_nonsfi__)
+      // The PNaCl toolchain for Non-SFI binary build does not support
+      // MSG_CTRUNC.
       // Check this after adding the FDs so we don't leak them.
       if (msg->msg_flags & MSG_CTRUNC) {
         ClearInputFDs();
         return false;
       }
+#endif
 
       return true;
     }
   }
 
   // No file descriptors found, but that's OK.
   return true;
 }
 
 void ChannelPosix::ClearInputFDs() {
@@ skipping 84 matching lines @@
   // idempotent.
 
   ResetToAcceptingConnectionState();
 
   if (must_unlink_) {
     unlink(pipe_name_.c_str());
     must_unlink_ = false;
   }
 
   if (server_listen_pipe_.is_valid()) {
+#if defined(__native_client_nonsfi__)
+    // IPC channels in nacl_helper_nonsfi should not be SERVER mode.
+    NOTREACHED();
+#else
     server_listen_pipe_.reset();
     // Unregister libevent for the listening socket and close it.
     server_listen_connection_watcher_.StopWatchingFileDescriptor();
+#endif
   }
 
   CloseClientFileDescriptor();
 }
 
 base::ProcessId ChannelPosix::GetPeerPID() const {
   return peer_pid_;
 }
 
 base::ProcessId ChannelPosix::GetSelfPID() const {
@@ skipping 20 matching lines @@
 
   return id.append(GenerateUniqueRandomChannelID());
 }
 
 
 bool Channel::IsNamedServerInitialized(
     const std::string& channel_id) {
   return ChannelPosix::IsNamedServerInitialized(channel_id);
 }
 
-#if defined(OS_LINUX)
+#if defined(OS_LINUX) || defined(__native_client_nonsfi__)
 // static
 void Channel::SetGlobalPid(int pid) {
   ChannelPosix::SetGlobalPid(pid);
 }
-#endif  // OS_LINUX
+#endif
 
 }  // namespace IPC