OLD | NEW |
---|---|
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "content/zygote/zygote_main.h" | 5 #include "content/zygote/zygote_main.h" |
6 | 6 |
7 #include <dlfcn.h> | 7 #include <dlfcn.h> |
8 #include <fcntl.h> | 8 #include <fcntl.h> |
9 #include <pthread.h> | 9 #include <pthread.h> |
10 #include <signal.h> | 10 #include <signal.h> |
(...skipping 21 matching lines...) Expand all Loading... | |
32 #include "content/common/child_process_sandbox_support_impl_linux.h" | 32 #include "content/common/child_process_sandbox_support_impl_linux.h" |
33 #include "content/common/font_config_ipc_linux.h" | 33 #include "content/common/font_config_ipc_linux.h" |
34 #include "content/common/sandbox_linux/sandbox_linux.h" | 34 #include "content/common/sandbox_linux/sandbox_linux.h" |
35 #include "content/common/zygote_commands_linux.h" | 35 #include "content/common/zygote_commands_linux.h" |
36 #include "content/public/common/content_switches.h" | 36 #include "content/public/common/content_switches.h" |
37 #include "content/public/common/main_function_params.h" | 37 #include "content/public/common/main_function_params.h" |
38 #include "content/public/common/sandbox_linux.h" | 38 #include "content/public/common/sandbox_linux.h" |
39 #include "content/public/common/zygote_fork_delegate_linux.h" | 39 #include "content/public/common/zygote_fork_delegate_linux.h" |
40 #include "content/zygote/zygote_linux.h" | 40 #include "content/zygote/zygote_linux.h" |
41 #include "crypto/nss_util.h" | 41 #include "crypto/nss_util.h" |
42 #include "sandbox/linux/services/credentials.h" | |
42 #include "sandbox/linux/services/init_process_reaper.h" | 43 #include "sandbox/linux/services/init_process_reaper.h" |
43 #include "sandbox/linux/services/libc_urandom_override.h" | 44 #include "sandbox/linux/services/libc_urandom_override.h" |
45 #include "sandbox/linux/services/namespace_sandbox.h" | |
44 #include "sandbox/linux/suid/client/setuid_sandbox_client.h" | 46 #include "sandbox/linux/suid/client/setuid_sandbox_client.h" |
45 #include "third_party/icu/source/i18n/unicode/timezone.h" | 47 #include "third_party/icu/source/i18n/unicode/timezone.h" |
46 #include "third_party/skia/include/ports/SkFontConfigInterface.h" | 48 #include "third_party/skia/include/ports/SkFontConfigInterface.h" |
47 | 49 |
48 #if defined(OS_LINUX) | 50 #if defined(OS_LINUX) |
49 #include <sys/prctl.h> | 51 #include <sys/prctl.h> |
50 #endif | 52 #endif |
51 | 53 |
52 #if defined(USE_OPENSSL) | 54 #if defined(USE_OPENSSL) |
53 #include <openssl/rand.h> | 55 #include <openssl/rand.h> |
(...skipping 390 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
444 // startup and the point where we set the non-dumpable flag in which a | 446 // startup and the point where we set the non-dumpable flag in which a |
445 // compromised renderer could ptrace attach. | 447 // compromised renderer could ptrace attach. |
446 // | 448 // |
447 // However, now that we have a zygote model, only the (trusted) zygote | 449 // However, now that we have a zygote model, only the (trusted) zygote |
448 // exists at this point and we can set the non-dumpable flag which is | 450 // exists at this point and we can set the non-dumpable flag which is |
449 // inherited by all our renderer children. | 451 // inherited by all our renderer children. |
450 // | 452 // |
451 // Note: a non-dumpable process can't be debugged. To debug sandbox-related | 453 // Note: a non-dumpable process can't be debugged. To debug sandbox-related |
452 // issues, one can specify --allow-sandbox-debugging to let the process be | 454 // issues, one can specify --allow-sandbox-debugging to let the process be |
453 // dumpable. | 455 // dumpable. |
454 const base::CommandLine& command_line = | 456 const base::CommandLine& command_line = |
jln (very slow on Chromium)
2015/02/05 00:26:56
Split to own function and use for NS sandbox as we
rickyz (no longer on Chrome)
2015/02/05 01:42:51
Done.
| |
455 *base::CommandLine::ForCurrentProcess(); | 457 *base::CommandLine::ForCurrentProcess(); |
456 if (!command_line.HasSwitch(switches::kAllowSandboxDebugging)) { | 458 if (!command_line.HasSwitch(switches::kAllowSandboxDebugging)) { |
457 prctl(PR_SET_DUMPABLE, 0, 0, 0, 0); | 459 prctl(PR_SET_DUMPABLE, 0, 0, 0, 0); |
458 if (prctl(PR_GET_DUMPABLE, 0, 0, 0, 0)) { | 460 if (prctl(PR_GET_DUMPABLE, 0, 0, 0, 0)) { |
459 LOG(ERROR) << "Failed to set non-dumpable flag"; | 461 LOG(ERROR) << "Failed to set non-dumpable flag"; |
460 return false; | 462 return false; |
461 } | 463 } |
462 } else { | 464 } else { |
463 // If sandbox debugging is allowed, install a handler for sandbox-related | 465 // If sandbox debugging is allowed, install a handler for sandbox-related |
464 // crash testing. | 466 // crash testing. |
465 InstallSandboxCrashTestHandler(); | 467 InstallSandboxCrashTestHandler(); |
466 } | 468 } |
467 | 469 |
468 #endif | 470 #endif |
469 | 471 |
470 return true; | 472 return true; |
471 } | 473 } |
472 | 474 |
475 static void EnterNamespaceSandbox(base::Closure* post_fork_parent_callback) { | |
476 pid_t pid = getpid(); | |
jln (very slow on Chromium)
2015/02/05 00:26:56
Want to sys_getpid() here, just in case?
rickyz (no longer on Chrome)
2015/02/05 01:42:51
Hm, I don't think there should be a way for getpid
| |
477 if (sandbox::NamespaceSandbox::InNewPidNamespace()) { | |
478 CHECK_EQ(1, pid); | |
479 } | |
480 | |
481 CHECK(sandbox::Credentials::MoveToNewUserNS()); | |
482 CHECK(sandbox::Credentials::DropFileSystemAccess()); | |
483 // We do not drop capabilities because we will use CAP_SYS_ADMIN to place | |
484 // each child process in its own PID namespace later on (this is not yet | |
485 // implemented). | |
jln (very slow on Chromium)
2015/02/05 00:26:56
Let's drop capabilities, no? Otherwise the sandbox
rickyz (no longer on Chrome)
2015/02/05 01:42:51
Yeah, sounds reasonable to drop capabilities until
jln (very slow on Chromium)
2015/02/05 05:44:15
No, it's not true. After DropFileSystemAccess(); y
rickyz (no longer on Chrome)
2015/02/05 09:01:14
Ah yes, you're right - I had forgotten that unshar
| |
486 | |
487 if (pid == 1) { | |
488 CHECK(CreateInitProcessReaper(post_fork_parent_callback)); | |
489 } | |
490 } | |
491 | |
473 #if defined(ADDRESS_SANITIZER) | 492 #if defined(ADDRESS_SANITIZER) |
474 const size_t kSanitizerMaxMessageLength = 1 * 1024 * 1024; | 493 const size_t kSanitizerMaxMessageLength = 1 * 1024 * 1024; |
475 | 494 |
476 // A helper process which collects code coverage data from the renderers over a | 495 // A helper process which collects code coverage data from the renderers over a |
477 // socket and dumps it to a file. See http://crbug.com/336212 for discussion. | 496 // socket and dumps it to a file. See http://crbug.com/336212 for discussion. |
478 static void SanitizerCoverageHelper(int socket_fd, int file_fd) { | 497 static void SanitizerCoverageHelper(int socket_fd, int file_fd) { |
479 scoped_ptr<char[]> buffer(new char[kSanitizerMaxMessageLength]); | 498 scoped_ptr<char[]> buffer(new char[kSanitizerMaxMessageLength]); |
480 while (true) { | 499 while (true) { |
481 ssize_t received_size = HANDLE_EINTR( | 500 ssize_t received_size = HANDLE_EINTR( |
482 recv(socket_fd, buffer.get(), kSanitizerMaxMessageLength, 0)); | 501 recv(socket_fd, buffer.get(), kSanitizerMaxMessageLength, 0)); |
(...skipping 56 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
539 #if !defined(THREAD_SANITIZER) | 558 #if !defined(THREAD_SANITIZER) |
540 DCHECK(linux_sandbox->IsSingleThreaded()); | 559 DCHECK(linux_sandbox->IsSingleThreaded()); |
541 #endif | 560 #endif |
542 | 561 |
543 sandbox::SetuidSandboxClient* setuid_sandbox = | 562 sandbox::SetuidSandboxClient* setuid_sandbox = |
544 linux_sandbox->setuid_sandbox_client(); | 563 linux_sandbox->setuid_sandbox_client(); |
545 | 564 |
546 if (is_suid_sandbox_child) { | 565 if (is_suid_sandbox_child) { |
547 CHECK(EnterSuidSandbox(setuid_sandbox, post_fork_parent_callback)) | 566 CHECK(EnterSuidSandbox(setuid_sandbox, post_fork_parent_callback)) |
548 << "Failed to enter setuid sandbox"; | 567 << "Failed to enter setuid sandbox"; |
568 } else if (sandbox::NamespaceSandbox::InNewUserNamespace()) { | |
569 EnterNamespaceSandbox(post_fork_parent_callback); | |
549 } | 570 } |
550 } | 571 } |
551 | 572 |
552 bool ZygoteMain(const MainFunctionParams& params, | 573 bool ZygoteMain(const MainFunctionParams& params, |
553 ScopedVector<ZygoteForkDelegate> fork_delegates) { | 574 ScopedVector<ZygoteForkDelegate> fork_delegates) { |
554 g_am_zygote_or_renderer = true; | 575 g_am_zygote_or_renderer = true; |
555 sandbox::InitLibcUrandomOverrides(); | 576 sandbox::InitLibcUrandomOverrides(); |
556 | 577 |
557 std::vector<int> fds_to_close_post_fork; | 578 std::vector<int> fds_to_close_post_fork; |
558 | 579 |
(...skipping 81 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
640 bool setuid_sandbox_engaged = sandbox_flags & kSandboxLinuxSUID; | 661 bool setuid_sandbox_engaged = sandbox_flags & kSandboxLinuxSUID; |
641 CHECK_EQ(must_enable_setuid_sandbox, setuid_sandbox_engaged); | 662 CHECK_EQ(must_enable_setuid_sandbox, setuid_sandbox_engaged); |
642 | 663 |
643 Zygote zygote(sandbox_flags, fork_delegates.Pass(), extra_children, | 664 Zygote zygote(sandbox_flags, fork_delegates.Pass(), extra_children, |
644 extra_fds); | 665 extra_fds); |
645 // This function call can return multiple times, once per fork(). | 666 // This function call can return multiple times, once per fork(). |
646 return zygote.ProcessRequests(); | 667 return zygote.ProcessRequests(); |
647 } | 668 } |
648 | 669 |
649 } // namespace content | 670 } // namespace content |
OLD | NEW |