OLD | NEW |
---|---|
(Empty) | |
1 // Copyright 2015 The Chromium Authors. All rights reserved. | |
2 // Use of this source code is governed by a BSD-style license that can be | |
3 // found in the LICENSE file. | |
4 | |
5 #ifndef SANDBOX_LINUX_SERVICES_NAMESPACE_SANDBOX_H_ | |
6 #define SANDBOX_LINUX_SERVICES_NAMESPACE_SANDBOX_H_ | |
7 | |
8 #include <sys/types.h> | |
9 | |
10 #include "base/command_line.h" | |
11 #include "base/files/scoped_file.h" | |
12 #include "base/macros.h" | |
13 #include "base/process/launch.h" | |
14 #include "base/process/process_handle.h" | |
15 #include "sandbox/sandbox_export.h" | |
16 | |
17 namespace sandbox { | |
18 | |
19 // Helper class for starting a process inside a new user, PID, and network | |
20 // namespace. Before using a namespace sandbox, check for namespaces support | |
21 // using Credentials::CanCreateProcessInNewUserNS. | |
22 // | |
23 // A typical use for "A" launching a sandboxed process "B" would be: | |
24 // 1. A sets up a command line for process B. | |
25 // 2. A sets up launch options and fd mappings for B using AddFdMapping and | |
26 // mutable_launch_options. | |
27 // 3. A launches B with Launch. | |
28 // 4. B should be prepared to assume the role of init(1). In particular, apart | |
29 // from SIGKILL and SIGSTOP, B cannot receive any signal for which it does | |
30 // not have an explicit signal handler registered. | |
31 // If B dies, all the processes in the namespace will die. | |
32 // B can fork() and the parent can assume the role of init(1), by using | |
33 // CreateInitProcessReaper(). | |
34 // 5. B chroots using Credentials::MoveToNewUserNS() and | |
35 // Credentials::DropFileSystemAccess(). | |
36 // | |
37 // An instance of this class may only be used once. The namespace sandbox cannot | |
38 // be nested. | |
39 // | |
40 // Warning: After a process has entered a new PID namespace, /proc/pid still | |
jln (very slow on Chromium)
2015/02/02 18:54:45
Wasn't it nestable before? I don't remember, but d
rickyz (no longer on Chrome)
2015/02/02 21:35:31
Changed it to write the uid/gid map in the pre_exe
| |
41 // refers to process ids outside of the PID namespace. As a result, the | |
42 // namespace sandbox cannot be nested. | |
43 class SANDBOX_EXPORT NamespaceSandbox { | |
44 public: | |
45 NamespaceSandbox(); | |
46 ~NamespaceSandbox(); | |
47 | |
48 // Launch a new process inside its own user/PID/network namespaces (depending | |
49 // on kernel support). Requires at a minimum that user namespaces are | |
50 // supported (use Credentials::CanCreateProcessInNewUserNS to check this). | |
51 base::Process Launch(const base::CommandLine& cmdline); | |
52 | |
53 // Adds an fd mapping in the new process. This should be used instead of | |
54 // modifying fds_to_remap in the launch options. | |
55 void AddFdMapping(int from_fd, int to_fd); | |
56 | |
57 // Returns a pointer to the launch options for the sandboxed process. The | |
58 // following fields of LaunchOptions should not be modified: | |
59 // pre_exec_delegate, fds_to_remap, clone_flags. Any pointers added to | |
60 // launch_options must be valid at the time that Launch is called. | |
61 base::LaunchOptions* mutable_launch_options() { return &launch_options_; } | |
62 | |
63 // Returns whether the namespace sandbox created a new user, PID, and network | |
64 // namespace. In particular, InNewUserNamespace should return true iff the | |
65 // process was started via this class. | |
66 static bool InNewUserNamespace(); | |
67 static bool InNewPidNamespace(); | |
68 static bool InNewNetNamespace(); | |
69 | |
70 private: | |
71 // Writes an mappings for the process's uid/gid to /proc/|pid|/{uid,gid}_map, | |
72 // then unblocks the process by writing to |fd|. | |
73 void WriteUidGidMapAndUnblockProcess(pid_t pid, base::ScopedFD fd); | |
74 | |
75 // Whether Launch has been called. | |
76 bool launch_called_; | |
77 | |
78 // FD mappings and launch options for the child process. | |
79 base::FileHandleMappingVector fds_to_remap_; | |
80 base::LaunchOptions launch_options_; | |
81 | |
82 DISALLOW_COPY_AND_ASSIGN(NamespaceSandbox); | |
83 }; | |
84 | |
85 } // namespace sandbox | |
86 | |
87 #endif // SANDBOX_LINUX_SERVICES_NAMESPACE_SANDBOX_H_ | |
OLD | NEW |