Start all children in their own PID namespace.

sandbox/linux/services/namespace_sandbox.h

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef SANDBOX_LINUX_SERVICES_NAMESPACE_SANDBOX_H_
 #define SANDBOX_LINUX_SERVICES_NAMESPACE_SANDBOX_H_
 
+#include <sys/types.h>
+
 #include <string>
 #include <vector>
 
 #include "base/command_line.h"
 #include "base/macros.h"
 #include "base/process/launch.h"
 #include "base/process/process.h"
 #include "sandbox/sandbox_export.h"
 
 namespace sandbox {
@@ skipping 22 matching lines @@
   // supported (use Credentials::CanCreateProcessInNewUserNS to check this).
   //
   // pre_exec_delegate and clone_flags fields of LaunchOptions should be nullptr
   // and 0, respectively, since this function makes a copy of options and
   // overrides them.
   static base::Process LaunchProcess(const base::CommandLine& cmdline,
                                      const base::LaunchOptions& options);
   static base::Process LaunchProcess(const std::vector<std::string>& argv,
                                      const base::LaunchOptions& options);
 
+  // Forks a process in its own PID namespace. The child process is the init
+  // process inside of the PID namespace, so if the child needs to fork further,
+  // it should call CreateInitProcessReaper, which turns the init process into a
+  // reaper process.
+  //
+  // If the child does not call CreateInitProcessReaper, then there are some
+  // special considerations to be made for the fact that it is an init process
+  // in a PID namespace.
+  //
+  // Aside from SIGKILL and SIGSTOP, the init process in a PID namespace ignores
+  // signals for which it does not have an explicit signal handler. The child
+  // may call InstallTerminationSignalHandler to setup handlers for these
+  // signals that exit with a specific exit code. For most purposes, handlers
+  // should be installed for at least these signals:
+  //
+  // SIGHUP, SIGINT, SIGABRT, SIGQUIT, SIGPIPE, SIGTERM, SIGUSR1, SIGUSR2
+  //
+  // This function requries CAP_SYS_ADMIN. Callers are responsible for dropping
+  // capabilities in the child if desired.
+  static pid_t ForkInNewPidNamespace();
+
+  // Installs a signal handler for |sig| which exits with |exit_code|.
+  static void InstallTerminationSignalHandler(int sig, int exit_code);

[jln (very slow on Chromium), 2015/03/24 22:03:34]

I would like to make this API really easy to use for "new users" who don't
really want to care about details.

How about taking a const ref to a std::map<int, int> of signal to exit_code.

The API would be: for every catchable signal for which the default signal
disposition is to terminate the process, install a signal handler that exits
with |exit_code|, unless overriden by |signal_to_exit_code|.

That way, a caller that "doesn't" care can simply pass (std::map<int,int>(), 1).

I would also merge this with ForkInNewPidNamespace(). It gets rid of having to
do "if (getpid() == 1)" and makes it much easier to use.

Again, we should think of new users of these API who don't want to care too
much. I would love to be able to have simple steps like:
- Either start a new pid namespace with LaunchProcess
- Or start a new PID namespace with ForkInNewPidNamespace().

There are your two options (incidentally we will probably need the
ForKInNewPidNamespace() version for Mojo soon).

WDYT?

[jln (very slow on Chromium), 2015/03/24 22:57:40]

Meh: we still need to support a separate InstallTerminationSignalHandler() API
for processes that used the sandbox:: LaunchProcess.

So keeping it separate seems good.

[rickyz (no longer on Chrome), 2015/03/25 22:47:46]

Any opinions on whether this should take a map or be more free-form like this?
Ideally I'd have liked to have an option with some default values, but default
values are tough when people might want to know what signal caused their program
to die :-/

[jln (very slow on Chromium), 2015/03/25 23:47:50]

I was thinking this should take two arguments: a default value and a std::map
from signals to exit code to override that default.

It's a little ugly, but I don't have a better idea.

+
   // Returns whether the namespace sandbox created a new user, PID, and network
   // namespace. In particular, InNewUserNamespace should return true iff the
   // process was started via this class.
   static bool InNewUserNamespace();
   static bool InNewPidNamespace();
   static bool InNewNetNamespace();
 
  private:
   DISALLOW_IMPLICIT_CONSTRUCTORS(NamespaceSandbox);
 };
 
 }  // namespace sandbox
 
 #endif  // SANDBOX_LINUX_SERVICES_NAMESPACE_SANDBOX_H_