sandbox: Extend BrokerPolicy to support file creation

sandbox/linux/syscall_broker/broker_host.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sandbox/linux/syscall_broker/broker_host.h"
 
 #include <fcntl.h>
 #include <sys/socket.h>
 #include <sys/stat.h>
 #include <sys/syscall.h>
@@ skipping 20 matching lines @@
 namespace {
 
 bool IsRunningOnValgrind() {
   return RUNNING_ON_VALGRIND;
 }
 
 // A little open(2) wrapper to handle some oddities for us. In the general case
 // make a direct system call since we want to keep in control of the broker
 // process' system calls profile to be able to loosely sandbox it.
 int sys_open(const char* pathname, int flags) {
-  // Always pass a defined |mode| in case flags mistakenly contains O_CREAT.
-  const int mode = 0;
+  // Hardcode mode to rw------- when creating files.
+  int mode;
+  if (flags & O_CREAT)
+    mode = 0600;
+  else
+    mode = 0;
   if (IsRunningOnValgrind()) {
     // Valgrind does not support AT_FDCWD, just use libc's open() in this case.
     return open(pathname, flags, mode);
   } else {
     return syscall(__NR_openat, AT_FDCWD, pathname, flags, mode);
   }
 }
 
 // Open |requested_filename| with |flags| if allowed by our policy.
 // Write the syscall return value (-errno) to |write_pickle| and append
 // a file descriptor to |opened_files| if relevant.
 void OpenFileForIPC(const BrokerPolicy& policy,
                     const std::string& requested_filename,
                     int flags,
                     Pickle* write_pickle,
                     std::vector<int>* opened_files) {
   DCHECK(write_pickle);
   DCHECK(opened_files);
   const char* file_to_open = NULL;
+  bool unlink_after_open = false;
   const bool safe_to_open_file = policy.GetFileNameIfAllowedToOpen(
-      requested_filename.c_str(), flags, &file_to_open);
+      requested_filename.c_str(), flags, &file_to_open, &unlink_after_open);

[Jorge Lucangeli Obes, 2014/11/14 18:48:07]

When do you think we're gonna need this? I thought we were going to allow
unlink() in the broker.

[leecam, 2014/11/18 21:40:54]

We do allow unlink but we dont have an IPC for the client to unlink any file. We
just have an API that will unlink a file after its openned/created by the
BrokerHost. 

 
   if (safe_to_open_file) {
     CHECK(file_to_open);
     int opened_fd = sys_open(file_to_open, flags);
     if (opened_fd < 0) {
       write_pickle->WriteInt(-errno);
     } else {
       // Success.
+      if (unlink_after_open) {
+        unlink(file_to_open);
+      }
       opened_files->push_back(opened_fd);
       write_pickle->WriteInt(0);
     }
   } else {
     write_pickle->WriteInt(-policy.denied_errno());
   }
 }
 
 // Perform access(2) on |requested_filename| with mode |mode| if allowed by our
 // policy. Write the syscall return value (-errno) to |write_pickle|.
@@ skipping 134 matching lines @@
     NOTREACHED();
   }
 
   LOG(ERROR) << "Error parsing IPC request";
   return RequestStatus::FAILURE;
 }
 
 }  // namespace syscall_broker
 
 }  // namespace sandbox