OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include <dirent.h> | 5 #include <dirent.h> |
6 #include <fcntl.h> | 6 #include <fcntl.h> |
7 #include <sys/resource.h> | 7 #include <sys/resource.h> |
8 #include <sys/stat.h> | 8 #include <sys/stat.h> |
9 #include <sys/time.h> | 9 #include <sys/time.h> |
10 #include <sys/types.h> | 10 #include <sys/types.h> |
(...skipping 14 matching lines...) Expand all Loading... |
25 #include "base/memory/singleton.h" | 25 #include "base/memory/singleton.h" |
26 #include "base/posix/eintr_wrapper.h" | 26 #include "base/posix/eintr_wrapper.h" |
27 #include "base/strings/string_number_conversions.h" | 27 #include "base/strings/string_number_conversions.h" |
28 #include "base/sys_info.h" | 28 #include "base/sys_info.h" |
29 #include "base/time/time.h" | 29 #include "base/time/time.h" |
30 #include "build/build_config.h" | 30 #include "build/build_config.h" |
31 #include "content/common/sandbox_linux/sandbox_linux.h" | 31 #include "content/common/sandbox_linux/sandbox_linux.h" |
32 #include "content/common/sandbox_linux/sandbox_seccomp_bpf_linux.h" | 32 #include "content/common/sandbox_linux/sandbox_seccomp_bpf_linux.h" |
33 #include "content/public/common/content_switches.h" | 33 #include "content/public/common/content_switches.h" |
34 #include "content/public/common/sandbox_linux.h" | 34 #include "content/public/common/sandbox_linux.h" |
35 #include "sandbox/linux/services/namespace_sandbox.h" | |
36 #include "sandbox/linux/services/proc_util.h" | 35 #include "sandbox/linux/services/proc_util.h" |
37 #include "sandbox/linux/services/thread_helpers.h" | 36 #include "sandbox/linux/services/thread_helpers.h" |
38 #include "sandbox/linux/services/yama.h" | 37 #include "sandbox/linux/services/yama.h" |
39 #include "sandbox/linux/suid/client/setuid_sandbox_client.h" | 38 #include "sandbox/linux/suid/client/setuid_sandbox_client.h" |
40 | 39 |
41 #if defined(ANY_OF_AMTLU_SANITIZER) | 40 #if defined(ANY_OF_AMTLU_SANITIZER) |
42 #include <sanitizer/common_interface_defs.h> | 41 #include <sanitizer/common_interface_defs.h> |
43 #endif | 42 #endif |
44 | 43 |
45 using sandbox::Yama; | 44 using sandbox::Yama; |
(...skipping 63 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
109 | 108 |
110 LinuxSandbox::LinuxSandbox() | 109 LinuxSandbox::LinuxSandbox() |
111 : proc_fd_(-1), | 110 : proc_fd_(-1), |
112 seccomp_bpf_started_(false), | 111 seccomp_bpf_started_(false), |
113 sandbox_status_flags_(kSandboxLinuxInvalid), | 112 sandbox_status_flags_(kSandboxLinuxInvalid), |
114 pre_initialized_(false), | 113 pre_initialized_(false), |
115 seccomp_bpf_supported_(false), | 114 seccomp_bpf_supported_(false), |
116 seccomp_bpf_with_tsync_supported_(false), | 115 seccomp_bpf_with_tsync_supported_(false), |
117 yama_is_enforcing_(false), | 116 yama_is_enforcing_(false), |
118 initialize_sandbox_ran_(false), | 117 initialize_sandbox_ran_(false), |
119 setuid_sandbox_client_(sandbox::SetuidSandboxClient::Create()) { | 118 setuid_sandbox_client_(sandbox::SetuidSandboxClient::Create()) |
| 119 { |
120 if (setuid_sandbox_client_ == NULL) { | 120 if (setuid_sandbox_client_ == NULL) { |
121 LOG(FATAL) << "Failed to instantiate the setuid sandbox client."; | 121 LOG(FATAL) << "Failed to instantiate the setuid sandbox client."; |
122 } | 122 } |
123 #if defined(ANY_OF_AMTLU_SANITIZER) | 123 #if defined(ANY_OF_AMTLU_SANITIZER) |
124 sanitizer_args_ = make_scoped_ptr(new __sanitizer_sandbox_arguments); | 124 sanitizer_args_ = make_scoped_ptr(new __sanitizer_sandbox_arguments); |
125 *sanitizer_args_ = {0}; | 125 *sanitizer_args_ = {0}; |
126 #endif | 126 #endif |
127 } | 127 } |
128 | 128 |
129 LinuxSandbox::~LinuxSandbox() { | 129 LinuxSandbox::~LinuxSandbox() { |
(...skipping 76 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
206 } | 206 } |
207 if (kSandboxLinuxInvalid == sandbox_status_flags_) { | 207 if (kSandboxLinuxInvalid == sandbox_status_flags_) { |
208 // Initialize sandbox_status_flags_. | 208 // Initialize sandbox_status_flags_. |
209 sandbox_status_flags_ = 0; | 209 sandbox_status_flags_ = 0; |
210 if (setuid_sandbox_client_->IsSandboxed()) { | 210 if (setuid_sandbox_client_->IsSandboxed()) { |
211 sandbox_status_flags_ |= kSandboxLinuxSUID; | 211 sandbox_status_flags_ |= kSandboxLinuxSUID; |
212 if (setuid_sandbox_client_->IsInNewPIDNamespace()) | 212 if (setuid_sandbox_client_->IsInNewPIDNamespace()) |
213 sandbox_status_flags_ |= kSandboxLinuxPIDNS; | 213 sandbox_status_flags_ |= kSandboxLinuxPIDNS; |
214 if (setuid_sandbox_client_->IsInNewNETNamespace()) | 214 if (setuid_sandbox_client_->IsInNewNETNamespace()) |
215 sandbox_status_flags_ |= kSandboxLinuxNetNS; | 215 sandbox_status_flags_ |= kSandboxLinuxNetNS; |
216 } else if (sandbox::NamespaceSandbox::InNewUserNamespace()) { | |
217 sandbox_status_flags_ |= kSandboxLinuxUserNS; | |
218 if (sandbox::NamespaceSandbox::InNewPidNamespace()) | |
219 sandbox_status_flags_ |= kSandboxLinuxPIDNS; | |
220 if (sandbox::NamespaceSandbox::InNewNetNamespace()) | |
221 sandbox_status_flags_ |= kSandboxLinuxNetNS; | |
222 } | 216 } |
223 | 217 |
224 // We report whether the sandbox will be activated when renderers, workers | 218 // We report whether the sandbox will be activated when renderers, workers |
225 // and PPAPI plugins go through sandbox initialization. | 219 // and PPAPI plugins go through sandbox initialization. |
226 if (seccomp_bpf_supported() && | 220 if (seccomp_bpf_supported() && |
227 SandboxSeccompBPF::ShouldEnableSeccompBPF(switches::kRendererProcess)) { | 221 SandboxSeccompBPF::ShouldEnableSeccompBPF(switches::kRendererProcess)) { |
228 sandbox_status_flags_ |= kSandboxLinuxSeccompBPF; | 222 sandbox_status_flags_ |= kSandboxLinuxSeccompBPF; |
229 } | 223 } |
230 | 224 |
231 if (seccomp_bpf_with_tsync_supported() && | 225 if (seccomp_bpf_with_tsync_supported() && |
(...skipping 209 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
441 | 435 |
442 void LinuxSandbox::StopThreadAndEnsureNotCounted(base::Thread* thread) const { | 436 void LinuxSandbox::StopThreadAndEnsureNotCounted(base::Thread* thread) const { |
443 DCHECK(thread); | 437 DCHECK(thread); |
444 base::ScopedFD proc_self_task(OpenProcTaskFd(proc_fd_)); | 438 base::ScopedFD proc_self_task(OpenProcTaskFd(proc_fd_)); |
445 PCHECK(proc_self_task.is_valid()); | 439 PCHECK(proc_self_task.is_valid()); |
446 CHECK(sandbox::ThreadHelpers::StopThreadAndWatchProcFS(proc_self_task.get(), | 440 CHECK(sandbox::ThreadHelpers::StopThreadAndWatchProcFS(proc_self_task.get(), |
447 thread)); | 441 thread)); |
448 } | 442 } |
449 | 443 |
450 } // namespace content | 444 } // namespace content |
OLD | NEW |