Add namespace sandbox class.

sandbox/linux/services/namespace_sandbox.h

Index: sandbox/linux/services/namespace_sandbox.h
diff --git a/sandbox/linux/services/namespace_sandbox.h b/sandbox/linux/services/namespace_sandbox.h
new file mode 100644
index 0000000000000000000000000000000000000000..19d0970b2c6dbf1eae9c65b7bc3172516a46e92b
--- /dev/null
+++ b/sandbox/linux/services/namespace_sandbox.h
@@ -0,0 +1,81 @@
+// Copyright 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef SANDBOX_LINUX_SERVICES_NAMESPACE_SANDBOX_H_
+#define SANDBOX_LINUX_SERVICES_NAMESPACE_SANDBOX_H_
+
+#include <sys/types.h>
+
+#include "base/command_line.h"
+#include "base/files/scoped_file.h"
+#include "base/process/launch.h"
+#include "base/process/process_handle.h"
+#include "sandbox/sandbox_export.h"
+
+namespace sandbox {
+
+// Helper class for starting a process inside a new user, PID, and network
+// namespace. Before using a namespace sandbox, check for namespaces support
+// using Credentials::CanCreateProcessInNewUserNS.
+//
+// A typical use for "A" launching a sandboxed process "B" would be:
+// 1. A sets up a command line for process B.
+// 2. A sets up launch options and fd mappings for B using AddFdMapping and
+//    mutable_launch_options.
+// 3. A launches B with Launch.
+// 4. B should be prepared to assume the role of init(1). In particular, apart
+//    from SIGKILL and SIGSTOP, B cannot receive any signal for which it does
+//    not have an explicit signal handler registered.
+//    If B dies, all the processes in the namespace will die.
+//    B can fork() and the parent can assume the role of init(1), by using
+//    CreateInitProcessReaper().
+// 5. B chroots using Credentials::MoveToNewUserNS() and
+//    Credentials::DropFileSystemAccess().
+//
+// An instance of this class may only be used once.
+class SANDBOX_EXPORT NamespaceSandbox {
+ public:
+  NamespaceSandbox();
+  ~NamespaceSandbox();
+
+  // Launch a new process inside its own user/PID/network namespaces (depending
+  // on kernel support). Requires at a minimum that user namespaces are
+  // supported (use Credentials::CanCreateProcessInNewUserNS to check this).
+  base::Process Launch(const base::CommandLine& cmdline);
+
+  // Adds an fd mapping in the new process. This should be used instead of
+  // modifying fds_to_remap in the launch options.
+  void AddFdMapping(int from_fd, int to_fd);
+
+  // Returns a pointer to the launch options for the sandboxed process. The
+  // following fields of LaunchOptions should not be modified:
+  // pre_exec_delegate, fds_to_remap, clone_flags. Any pointers added to
+  // launch_options must be valid at the time that Launch is called.
+  base::LaunchOptions* mutable_launch_options() { return &launch_options_; }

[jln (very slow on Chromium), 2015/01/30 20:12:28]

I don't have a good memory of what the future callers will look like.

But is it not possible to have callers:

1. Build their LaunchOptions
2. pass it to NameSpaceSandbox::Launch() which would then patch-up options as
needed?

[rickyz (no longer on Chrome), 2015/01/31 02:33:54]

I wasn't crazy about the patching up part, because in order to truly own the
LaunchOptions, we would have to go every pointer field of LaunchOptions and
maintain our own copy of it. Right now, I think the only other ones on Linux are
maximize_rlimits and pre_exec_delegate (which we'd disallow), but we'd need to
add handling for any pointer fields added in the future. I think what we should
eventually do is switch all these pointer fields just embedding the objects
(with the exception of pre_exec_delegate). Then we could just make Launch take a
LaunchOptions, make a copy, and modify it.

+
+  // Returns whether the namespace sandbox created a new user, PID, and network
+  // namespace. In particular, InNewUserNamespace should return true iff the
+  // process was started via this class.
+  static bool InNewUserNamespace();
+  static bool InNewPidNamespace();
+  static bool InNewNetNamespace();
+
+ private:
+  void WriteUidGidMapAndUnblockProcess(pid_t pid);
+
+  // Whether Launch has been called.
+  bool launch_called_;
+
+  // Pipe fds used to communicate with the child process.
+  base::ScopedFD read_fd_;
+  base::ScopedFD write_fd_;
+
+  // FD mappings and launch options for the child process.
+  base::FileHandleMappingVector fds_to_remap_;
+  base::LaunchOptions launch_options_;
+};

[jln (very slow on Chromium), 2015/01/30 20:12:28]

DISABLE_COPY_AND_ASSIGN

[rickyz (no longer on Chrome), 2015/01/31 02:33:54]

Done.

+
+}  // namespace sandbox
+
+#endif  // SANDBOX_LINUX_SERVICES_NAMESPACE_SANDBOX_H_