OLD | NEW |
1 // Copyright 2015 The Chromium Authors. All rights reserved. | 1 // Copyright 2015 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "sandbox/linux/services/namespace_sandbox.h" | 5 #include "sandbox/linux/services/namespace_sandbox.h" |
6 | 6 |
7 #include <sched.h> | 7 #include <sched.h> |
| 8 #include <signal.h> |
8 #include <stdlib.h> | 9 #include <stdlib.h> |
9 #include <sys/types.h> | 10 #include <sys/types.h> |
10 #include <unistd.h> | 11 #include <unistd.h> |
11 | 12 |
12 #include <string> | 13 #include <string> |
13 #include <utility> | 14 #include <utility> |
14 #include <vector> | 15 #include <vector> |
15 | 16 |
16 #include "base/command_line.h" | 17 #include "base/command_line.h" |
17 #include "base/environment.h" | 18 #include "base/environment.h" |
18 #include "base/files/scoped_file.h" | 19 #include "base/files/scoped_file.h" |
19 #include "base/logging.h" | 20 #include "base/logging.h" |
| 21 #include "base/macros.h" |
20 #include "base/posix/eintr_wrapper.h" | 22 #include "base/posix/eintr_wrapper.h" |
21 #include "base/process/launch.h" | 23 #include "base/process/launch.h" |
22 #include "base/process/process.h" | 24 #include "base/process/process.h" |
| 25 #include "sandbox/linux/services/credentials.h" |
23 #include "sandbox/linux/services/namespace_utils.h" | 26 #include "sandbox/linux/services/namespace_utils.h" |
24 | 27 |
25 namespace sandbox { | 28 namespace sandbox { |
26 | 29 |
27 namespace { | 30 namespace { |
28 | 31 |
29 class WriteUidGidMapDelegate : public base::LaunchOptions::PreExecDelegate { | 32 class WriteUidGidMapDelegate : public base::LaunchOptions::PreExecDelegate { |
30 public: | 33 public: |
31 WriteUidGidMapDelegate() | 34 WriteUidGidMapDelegate() |
32 : uid_(getuid()), | 35 : uid_(getuid()), |
(...skipping 22 matching lines...) Expand all Loading... |
55 base::NativeEnvironmentString env_var, | 58 base::NativeEnvironmentString env_var, |
56 bool value) { | 59 bool value) { |
57 // An empty string causes the env var to be unset in the child process. | 60 // An empty string causes the env var to be unset in the child process. |
58 (*environ)[env_var] = value ? "1" : ""; | 61 (*environ)[env_var] = value ? "1" : ""; |
59 } | 62 } |
60 | 63 |
61 const char kSandboxUSERNSEnvironmentVarName[] = "SBX_USER_NS"; | 64 const char kSandboxUSERNSEnvironmentVarName[] = "SBX_USER_NS"; |
62 const char kSandboxPIDNSEnvironmentVarName[] = "SBX_PID_NS"; | 65 const char kSandboxPIDNSEnvironmentVarName[] = "SBX_PID_NS"; |
63 const char kSandboxNETNSEnvironmentVarName[] = "SBX_NET_NS"; | 66 const char kSandboxNETNSEnvironmentVarName[] = "SBX_NET_NS"; |
64 | 67 |
| 68 // Linux supports up to 64 signals. This should be updated if that ever changes. |
| 69 int g_signal_exit_codes[64]; |
| 70 |
| 71 void TerminationSignalHandler(int sig) { |
| 72 // Return a special exit code so that the process is detected as terminated by |
| 73 // a signal. |
| 74 const size_t sig_idx = static_cast<size_t>(sig); |
| 75 if (sig_idx < arraysize(g_signal_exit_codes)) { |
| 76 _exit(g_signal_exit_codes[sig_idx]); |
| 77 } |
| 78 |
| 79 _exit(1); |
| 80 } |
| 81 |
65 } // namespace | 82 } // namespace |
66 | 83 |
67 // static | 84 // static |
68 base::Process NamespaceSandbox::LaunchProcess( | 85 base::Process NamespaceSandbox::LaunchProcess( |
69 const base::CommandLine& cmdline, | 86 const base::CommandLine& cmdline, |
70 const base::LaunchOptions& options) { | 87 const base::LaunchOptions& options) { |
71 return LaunchProcess(cmdline.argv(), options); | 88 return LaunchProcess(cmdline.argv(), options); |
72 } | 89 } |
73 | 90 |
74 // static | 91 // static |
(...skipping 29 matching lines...) Expand all Loading... |
104 for (const auto& entry : clone_flag_environ) { | 121 for (const auto& entry : clone_flag_environ) { |
105 const int flag = entry.first; | 122 const int flag = entry.first; |
106 const char* environ_name = entry.second; | 123 const char* environ_name = entry.second; |
107 SetEnvironForNamespaceType(environ, environ_name, clone_flags & flag); | 124 SetEnvironForNamespaceType(environ, environ_name, clone_flags & flag); |
108 } | 125 } |
109 | 126 |
110 return base::LaunchProcess(argv, launch_options); | 127 return base::LaunchProcess(argv, launch_options); |
111 } | 128 } |
112 | 129 |
113 // static | 130 // static |
| 131 pid_t NamespaceSandbox::ForkInNewPidNamespace(bool drop_capabilities_in_child) { |
| 132 const pid_t pid = |
| 133 base::ForkWithFlags(CLONE_NEWPID | SIGCHLD, nullptr, nullptr); |
| 134 if (pid < 0) { |
| 135 return pid; |
| 136 } |
| 137 |
| 138 if (pid == 0) { |
| 139 DCHECK_EQ(1, getpid()); |
| 140 if (drop_capabilities_in_child) { |
| 141 // Since we just forked, we are single-threaded, so this should be safe. |
| 142 CHECK(Credentials::DropAllCapabilitiesOnCurrentThread()); |
| 143 } |
| 144 return 0; |
| 145 } |
| 146 |
| 147 return pid; |
| 148 } |
| 149 |
| 150 // static |
| 151 void NamespaceSandbox::InstallTerminationSignalHandler(int sig, int exit_code) { |
| 152 const size_t sig_idx = static_cast<size_t>(sig); |
| 153 DCHECK_LT(sig_idx, arraysize(g_signal_exit_codes)); |
| 154 |
| 155 DCHECK_GE(exit_code, 0); |
| 156 DCHECK_LT(exit_code, 256); |
| 157 |
| 158 g_signal_exit_codes[sig_idx] = exit_code; |
| 159 |
| 160 struct sigaction action; |
| 161 memset(&action, 0, sizeof(action)); |
| 162 action.sa_handler = &TerminationSignalHandler; |
| 163 PCHECK(sigaction(sig, &action, nullptr) == 0); |
| 164 } |
| 165 |
| 166 // static |
114 bool NamespaceSandbox::InNewUserNamespace() { | 167 bool NamespaceSandbox::InNewUserNamespace() { |
115 return getenv(kSandboxUSERNSEnvironmentVarName) != nullptr; | 168 return getenv(kSandboxUSERNSEnvironmentVarName) != nullptr; |
116 } | 169 } |
117 | 170 |
118 // static | 171 // static |
119 bool NamespaceSandbox::InNewPidNamespace() { | 172 bool NamespaceSandbox::InNewPidNamespace() { |
120 return getenv(kSandboxPIDNSEnvironmentVarName) != nullptr; | 173 return getenv(kSandboxPIDNSEnvironmentVarName) != nullptr; |
121 } | 174 } |
122 | 175 |
123 // static | 176 // static |
124 bool NamespaceSandbox::InNewNetNamespace() { | 177 bool NamespaceSandbox::InNewNetNamespace() { |
125 return getenv(kSandboxNETNSEnvironmentVarName) != nullptr; | 178 return getenv(kSandboxNETNSEnvironmentVarName) != nullptr; |
126 } | 179 } |
127 | 180 |
128 } // namespace sandbox | 181 } // namespace sandbox |
OLD | NEW |