OLD | NEW |
1 // Copyright 2014 The Chromium Authors. All rights reserved. | 1 // Copyright 2014 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "components/nacl/loader/sandbox_linux/nacl_sandbox_linux.h" | 5 #include "components/nacl/loader/sandbox_linux/nacl_sandbox_linux.h" |
6 | 6 |
7 #include <errno.h> | 7 #include <errno.h> |
8 #include <fcntl.h> | 8 #include <fcntl.h> |
9 #include <sys/stat.h> | 9 #include <sys/stat.h> |
10 #include <sys/types.h> | 10 #include <sys/types.h> |
11 #include <unistd.h> | 11 #include <unistd.h> |
12 | 12 |
13 #include "base/basictypes.h" | 13 #include "base/basictypes.h" |
14 #include "base/callback.h" | 14 #include "base/callback.h" |
15 #include "base/command_line.h" | 15 #include "base/command_line.h" |
16 #include "base/compiler_specific.h" | 16 #include "base/compiler_specific.h" |
17 #include "base/files/scoped_file.h" | 17 #include "base/files/scoped_file.h" |
18 #include "base/logging.h" | 18 #include "base/logging.h" |
19 #include "base/memory/scoped_ptr.h" | 19 #include "base/memory/scoped_ptr.h" |
20 #include "base/posix/eintr_wrapper.h" | 20 #include "base/posix/eintr_wrapper.h" |
21 #include "build/build_config.h" | 21 #include "build/build_config.h" |
22 #include "components/nacl/common/nacl_switches.h" | 22 #include "components/nacl/common/nacl_switches.h" |
23 #include "components/nacl/loader/nonsfi/nonsfi_sandbox.h" | 23 #include "components/nacl/loader/nonsfi/nonsfi_sandbox.h" |
24 #include "components/nacl/loader/sandbox_linux/nacl_bpf_sandbox_linux.h" | 24 #include "components/nacl/loader/sandbox_linux/nacl_bpf_sandbox_linux.h" |
25 #include "sandbox/linux/seccomp-bpf/sandbox_bpf.h" | 25 #include "sandbox/linux/seccomp-bpf/sandbox_bpf.h" |
| 26 #include "sandbox/linux/services/credentials.h" |
| 27 #include "sandbox/linux/services/namespace_sandbox.h" |
26 #include "sandbox/linux/services/proc_util.h" | 28 #include "sandbox/linux/services/proc_util.h" |
27 #include "sandbox/linux/services/thread_helpers.h" | 29 #include "sandbox/linux/services/thread_helpers.h" |
28 #include "sandbox/linux/suid/client/setuid_sandbox_client.h" | 30 #include "sandbox/linux/suid/client/setuid_sandbox_client.h" |
29 | 31 |
30 namespace nacl { | 32 namespace nacl { |
31 | 33 |
32 namespace { | 34 namespace { |
33 | 35 |
34 // This is a poor man's check on whether we are sandboxed. | 36 // This is a poor man's check on whether we are sandboxed. |
35 bool IsSandboxed() { | 37 bool IsSandboxed() { |
(...skipping 50 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
86 setuid_sandbox_client_->CloseDummyFile(); | 88 setuid_sandbox_client_->CloseDummyFile(); |
87 | 89 |
88 // Make sure that no directory file descriptor is open, as it would bypass | 90 // Make sure that no directory file descriptor is open, as it would bypass |
89 // the setuid sandbox model. | 91 // the setuid sandbox model. |
90 CHECK(!HasOpenDirectory()); | 92 CHECK(!HasOpenDirectory()); |
91 | 93 |
92 // Get sandboxed. | 94 // Get sandboxed. |
93 CHECK(setuid_sandbox_client_->ChrootMe()); | 95 CHECK(setuid_sandbox_client_->ChrootMe()); |
94 CHECK(IsSandboxed()); | 96 CHECK(IsSandboxed()); |
95 layer_one_enabled_ = true; | 97 layer_one_enabled_ = true; |
| 98 } else if (sandbox::NamespaceSandbox::InNewUserNamespace()) { |
| 99 CHECK(sandbox::Credentials::MoveToNewUserNS()); |
| 100 CHECK(sandbox::Credentials::DropFileSystemAccess()); |
| 101 CHECK(sandbox::Credentials::DropAllCapabilities()); |
| 102 CHECK(IsSandboxed()); |
| 103 layer_one_enabled_ = true; |
96 } | 104 } |
97 } | 105 } |
98 | 106 |
99 void NaClSandbox::CheckForExpectedNumberOfOpenFds() { | 107 void NaClSandbox::CheckForExpectedNumberOfOpenFds() { |
| 108 // We expect to have the following FDs open: |
| 109 // 1-3) stdin, stdout, stderr. |
| 110 // 4) The /dev/urandom FD used by base::GetUrandomFD(). |
| 111 // 5) A dummy pipe FD used to overwrite kSandboxIPCChannel. |
| 112 // 6) The socket for the Chrome IPC channel that's connected to the |
| 113 // browser process, kPrimaryIPCChannel. |
| 114 // We also have an fd for /proc (proc_fd_), but CountOpenFds excludes this. |
| 115 // |
| 116 // This sanity check ensures that dynamically loaded libraries don't |
| 117 // leave any FDs open before we enable the sandbox. |
| 118 const int kExpectedNumFds = 6; |
100 if (setuid_sandbox_client_->IsSuidSandboxChild()) { | 119 if (setuid_sandbox_client_->IsSuidSandboxChild()) { |
101 // We expect to have the following FDs open: | 120 // When using the setuid sandbox, there is one additional socket used for |
102 // 1-3) stdin, stdout, stderr. | 121 // ChrootMe(). After ChrootMe(), it is no longer connected to anything. |
103 // 4) The /dev/urandom FD used by base::GetUrandomFD(). | 122 CHECK_EQ(kExpectedNumFds + 1, |
104 // 5) A dummy pipe FD used to overwrite kSandboxIPCChannel. | 123 sandbox::ProcUtil::CountOpenFds(proc_fd_.get())); |
105 // 6) The socket created by the SUID sandbox helper, used by ChrootMe(). | 124 } else if (sandbox::NamespaceSandbox::InNewUserNamespace()) { |
106 // After ChrootMe(), this is no longer connected to anything. | 125 CHECK_EQ(kExpectedNumFds, sandbox::ProcUtil::CountOpenFds(proc_fd_.get())); |
107 // (Only present when running under the SUID sandbox.) | |
108 // 7) The socket for the Chrome IPC channel that's connected to the | |
109 // browser process, kPrimaryIPCChannel. | |
110 // | |
111 // This sanity check ensures that dynamically loaded libraries don't | |
112 // leave any FDs open before we enable the sandbox. | |
113 CHECK_EQ(7, sandbox::ProcUtil::CountOpenFds(proc_fd_.get())); | |
114 } | 126 } |
115 } | 127 } |
116 | 128 |
117 void NaClSandbox::InitializeLayerTwoSandbox(bool uses_nonsfi_mode) { | 129 void NaClSandbox::InitializeLayerTwoSandbox(bool uses_nonsfi_mode) { |
118 // seccomp-bpf only applies to the current thread, so it's critical to only | 130 // seccomp-bpf only applies to the current thread, so it's critical to only |
119 // have a single thread running here. | 131 // have a single thread running here. |
120 DCHECK(!layer_one_sealed_); | 132 DCHECK(!layer_one_sealed_); |
121 CHECK(IsSingleThreaded()); | 133 CHECK(IsSingleThreaded()); |
122 CheckForExpectedNumberOfOpenFds(); | 134 CheckForExpectedNumberOfOpenFds(); |
123 | 135 |
(...skipping 42 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
166 static const char kNoBpfMsg[] = | 178 static const char kNoBpfMsg[] = |
167 "The seccomp-bpf sandbox is not engaged for NaCl:"; | 179 "The seccomp-bpf sandbox is not engaged for NaCl:"; |
168 if (can_be_no_sandbox) | 180 if (can_be_no_sandbox) |
169 LOG(ERROR) << kNoBpfMsg << kItIsDangerousMsg; | 181 LOG(ERROR) << kNoBpfMsg << kItIsDangerousMsg; |
170 else | 182 else |
171 LOG(FATAL) << kNoBpfMsg << kItIsNotAllowedMsg; | 183 LOG(FATAL) << kNoBpfMsg << kItIsNotAllowedMsg; |
172 } | 184 } |
173 } | 185 } |
174 | 186 |
175 } // namespace nacl | 187 } // namespace nacl |
OLD | NEW |