Index: sandbox/linux/services/namespace_sandbox.cc |
diff --git a/sandbox/linux/services/namespace_sandbox.cc b/sandbox/linux/services/namespace_sandbox.cc |
index 0f371ebfd3198e77d697e25ece5cfec4e141d164..18dd7a07cb84deac8e91f26d728b211dbf6d24ab 100644 |
--- a/sandbox/linux/services/namespace_sandbox.cc |
+++ b/sandbox/linux/services/namespace_sandbox.cc |
@@ -5,6 +5,7 @@ |
#include "sandbox/linux/services/namespace_sandbox.h" |
#include <sched.h> |
+#include <signal.h> |
#include <stdlib.h> |
#include <sys/types.h> |
#include <unistd.h> |
@@ -17,9 +18,11 @@ |
#include "base/environment.h" |
#include "base/files/scoped_file.h" |
#include "base/logging.h" |
+#include "base/macros.h" |
#include "base/posix/eintr_wrapper.h" |
#include "base/process/launch.h" |
#include "base/process/process.h" |
+#include "sandbox/linux/services/credentials.h" |
#include "sandbox/linux/services/namespace_utils.h" |
namespace sandbox { |
@@ -62,6 +65,20 @@ const char kSandboxUSERNSEnvironmentVarName[] = "SBX_USER_NS"; |
const char kSandboxPIDNSEnvironmentVarName[] = "SBX_PID_NS"; |
const char kSandboxNETNSEnvironmentVarName[] = "SBX_NET_NS"; |
+// Linux supports up to 64 signals. This should be updated if that ever changes. |
+int g_signal_exit_codes[64]; |
+ |
+void TerminationSignalHandler(int sig) { |
+ // Return a special exit code so that the process is detected as terminated by |
+ // a signal. |
+ const size_t sig_idx = static_cast<size_t>(sig); |
+ if (sig_idx < arraysize(g_signal_exit_codes)) { |
+ _exit(g_signal_exit_codes[sig_idx]); |
+ } |
+ |
+ _exit(1); |
+} |
+ |
} // namespace |
// static |
@@ -111,6 +128,42 @@ base::Process NamespaceSandbox::LaunchProcess( |
} |
// static |
+pid_t NamespaceSandbox::ForkInNewPidNamespace(bool drop_capabilities_in_child) { |
+ const pid_t pid = |
+ base::ForkWithFlags(CLONE_NEWPID | SIGCHLD, nullptr, nullptr); |
+ if (pid < 0) { |
+ return pid; |
+ } |
+ |
+ if (pid == 0) { |
+ DCHECK_EQ(1, getpid()); |
+ if (drop_capabilities_in_child) { |
+ // Since we just forked, we are single-threaded, so this should be safe. |
+ CHECK(Credentials::DropAllCapabilitiesOnCurrentThread()); |
+ } |
+ return 0; |
+ } |
+ |
+ return pid; |
+} |
+ |
+// static |
+void NamespaceSandbox::InstallTerminationSignalHandler(int sig, int exit_code) { |
+ const size_t sig_idx = static_cast<size_t>(sig); |
+ DCHECK_LT(sig_idx, arraysize(g_signal_exit_codes)); |
+ |
+ DCHECK_GE(exit_code, 0); |
+ DCHECK_LT(exit_code, 256); |
+ |
+ g_signal_exit_codes[sig_idx] = exit_code; |
+ |
+ struct sigaction action; |
+ memset(&action, 0, sizeof(action)); |
+ action.sa_handler = &TerminationSignalHandler; |
+ PCHECK(sigaction(sig, &action, nullptr) == 0); |
+} |
+ |
+// static |
bool NamespaceSandbox::InNewUserNamespace() { |
return getenv(kSandboxUSERNSEnvironmentVarName) != nullptr; |
} |