Allow using the namespace sandbox in zygote host.

content/zygote/zygote_main_linux.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/zygote/zygote_main.h"
 
 #include <dlfcn.h>
 #include <fcntl.h>
 #include <pthread.h>
 #include <signal.h>
@@ skipping 21 matching lines @@
 #include "content/common/child_process_sandbox_support_impl_linux.h"
 #include "content/common/font_config_ipc_linux.h"
 #include "content/common/sandbox_linux/sandbox_linux.h"
 #include "content/common/zygote_commands_linux.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/common/main_function_params.h"
 #include "content/public/common/sandbox_linux.h"
 #include "content/public/common/zygote_fork_delegate_linux.h"
 #include "content/zygote/zygote_linux.h"
 #include "crypto/nss_util.h"
+#include "sandbox/linux/services/credentials.h"
 #include "sandbox/linux/services/init_process_reaper.h"
 #include "sandbox/linux/services/libc_urandom_override.h"
+#include "sandbox/linux/services/namespace_sandbox.h"
 #include "sandbox/linux/suid/client/setuid_sandbox_client.h"
 #include "third_party/icu/source/i18n/unicode/timezone.h"
 #include "third_party/skia/include/ports/SkFontConfigInterface.h"
 
 #if defined(OS_LINUX)
 #include <sys/prctl.h>
 #endif
 
 #if defined(USE_OPENSSL)
 #include <openssl/rand.h>
@@ skipping 409 matching lines @@
     // If sandbox debugging is allowed, install a handler for sandbox-related
     // crash testing.
     InstallSandboxCrashTestHandler();
   }
 
 #endif
 
   return true;
 }
 
+static void EnterNamespaceSandbox(base::Closure* post_fork_parent_callback) {
+  pid_t pid = getpid();
+  if (sandbox::NamespaceSandbox::InNewPidNamespace()) {
+    CHECK_EQ(1, pid);
+  }
+
+  CHECK(sandbox::Credentials::MoveToNewUserNS());
+  CHECK(sandbox::Credentials::DropFileSystemAccess());
+  // We do not drop capabilities because we will use CAP_SYS_ADMIN to place
+  // each child process in its own PID namespace later on (this is not yet
+  // implemented).
+
+  if (pid == 1) {
+    CHECK(CreateInitProcessReaper(post_fork_parent_callback));
+  }
+}
+
 #if defined(ADDRESS_SANITIZER)
 const size_t kSanitizerMaxMessageLength = 1 * 1024 * 1024;
 
 // A helper process which collects code coverage data from the renderers over a
 // socket and dumps it to a file. See http://crbug.com/336212 for discussion.
 static void SanitizerCoverageHelper(int socket_fd, int file_fd) {
   scoped_ptr<char[]> buffer(new char[kSanitizerMaxMessageLength]);
   while (true) {
     ssize_t received_size = HANDLE_EINTR(
         recv(socket_fd, buffer.get(), kSanitizerMaxMessageLength, 0));
@@ skipping 56 matching lines @@
 #if !defined(THREAD_SANITIZER)
   DCHECK(linux_sandbox->IsSingleThreaded());
 #endif
 
   sandbox::SetuidSandboxClient* setuid_sandbox =
       linux_sandbox->setuid_sandbox_client();
 
   if (is_suid_sandbox_child) {
     CHECK(EnterSuidSandbox(setuid_sandbox, post_fork_parent_callback))
         << "Failed to enter setuid sandbox";
+  } else if (sandbox::NamespaceSandbox::InNewUserNamespace()) {
+    EnterNamespaceSandbox(post_fork_parent_callback);
   }
 }
 
 bool ZygoteMain(const MainFunctionParams& params,
                 ScopedVector<ZygoteForkDelegate> fork_delegates) {
   g_am_zygote_or_renderer = true;
   sandbox::InitLibcUrandomOverrides();
 
   std::vector<int> fds_to_close_post_fork;
 
@@ skipping 34 matching lines @@
                                     kZygoteBootMessage,
                                     sizeof(kZygoteBootMessage),
                                     std::vector<int>()));
   }
 
   VLOG(1) << "ZygoteMain: initializing " << fork_delegates.size()
           << " fork delegates";
   for (ScopedVector<ZygoteForkDelegate>::iterator i = fork_delegates.begin();
        i != fork_delegates.end();
        ++i) {
     (*i)->Init(GetSandboxFD(), must_enable_setuid_sandbox);

[jln (very slow on Chromium), 2015/02/05 05:44:15]

This means NaCl won't have a setuid sandbox.

   }
 
   const std::vector<int> sandbox_fds_to_close_post_fork =
       linux_sandbox->GetFileDescriptorsToClose();
 
   fds_to_close_post_fork.insert(fds_to_close_post_fork.end(),
                                 sandbox_fds_to_close_post_fork.begin(),
                                 sandbox_fds_to_close_post_fork.end());
   base::Closure post_fork_parent_callback =
       base::Bind(&CloseFds, fds_to_close_post_fork);
@@ skipping 26 matching lines @@
   bool setuid_sandbox_engaged = sandbox_flags & kSandboxLinuxSUID;
   CHECK_EQ(must_enable_setuid_sandbox, setuid_sandbox_engaged);
 
   Zygote zygote(sandbox_flags, fork_delegates.Pass(), extra_children,
                 extra_fds);
   // This function call can return multiple times, once per fork().
   return zygote.ProcessRequests();
 }
 
 }  // namespace content