Start all children in their own PID namespace.

content/zygote/zygote_main_linux.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/zygote/zygote_main.h"
 
 #include <dlfcn.h>
 #include <fcntl.h>
 #include <pthread.h>
 #include <signal.h>
@@ skipping 447 matching lines @@
 }
 
 static void EnterNamespaceSandbox(base::Closure* post_fork_parent_callback) {
   pid_t pid = getpid();
   if (sandbox::NamespaceSandbox::InNewPidNamespace()) {
     CHECK_EQ(1, pid);
   }
 
   CHECK(sandbox::Credentials::MoveToNewUserNS());
   CHECK(sandbox::Credentials::DropFileSystemAccess());
-  CHECK(sandbox::Credentials::DropAllCapabilities());

[rickyz (no longer on Chrome), 2015/02/07 05:14:03]

Like I mentioned in that last change, we need CAP_SYS_ADMIN in order to start
children in their own PID namespaces. We should probably discuss whether the
gains of isolating renderers is worth the additional attack surface of the
syscalls exposed by these capabilities on the zygote.

[mdempsky, 2015/02/09 06:28:12]

Couple thoughts I have:

  1. Would it be worthwhile to drop everything else except for CAP_SYS_ADMIN if
that's all we need?  (Do we even have other capabilities?)
  2. I think the init process reaper now will have unneeded capabilities too;
that's probably not a risk, but might as well drop the capabilities there too so
only the actual zygote process needs to reap?

[rickyz (no longer on Chrome), 2015/02/24 06:11:34]

Done - I didn't look too much into how much attack surface this takes away -
CAP_SYS_ADMIN seems to be used as a catch-all in a lot of places.
Done.

+  // We do not drop capabilities because we will use CAP_SYS_ADMIN to place each
+  // child process in its own PID namespace later on.
 
   // This needs to happen after moving to a new user NS, since doing so involves
   // writing the UID/GID map.
   CHECK(MaybeSetProcessNonDumpable());
 
   if (pid == 1) {
     CHECK(CreateInitProcessReaper(post_fork_parent_callback));
   }
 }
 
@@ skipping 171 matching lines @@
   bool setuid_sandbox_engaged = sandbox_flags & kSandboxLinuxSUID;
   CHECK_EQ(using_setuid_sandbox, setuid_sandbox_engaged);
 
   Zygote zygote(sandbox_flags, fork_delegates.Pass(), extra_children,
                 extra_fds);
   // This function call can return multiple times, once per fork().
   return zygote.ProcessRequests();
 }
 
 }  // namespace content