Index: components/nacl/loader/sandbox_linux/nacl_sandbox_linux.cc |
diff --git a/components/nacl/loader/sandbox_linux/nacl_sandbox_linux.cc b/components/nacl/loader/sandbox_linux/nacl_sandbox_linux.cc |
index 5c4fa4224f7c2d0efbb4d203911da1286cb40fbb..d58df57c93af7f2015c6d37f861b67dbaf8de7dd 100644 |
--- a/components/nacl/loader/sandbox_linux/nacl_sandbox_linux.cc |
+++ b/components/nacl/loader/sandbox_linux/nacl_sandbox_linux.cc |
@@ -6,6 +6,7 @@ |
#include <errno.h> |
#include <fcntl.h> |
+#include <sys/prctl.h> |
#include <sys/stat.h> |
#include <sys/types.h> |
#include <unistd.h> |
@@ -22,7 +23,10 @@ |
#include "components/nacl/common/nacl_switches.h" |
#include "components/nacl/loader/nonsfi/nonsfi_sandbox.h" |
#include "components/nacl/loader/sandbox_linux/nacl_bpf_sandbox_linux.h" |
+#include "content/public/common/content_switches.h" |
#include "sandbox/linux/seccomp-bpf/sandbox_bpf.h" |
+#include "sandbox/linux/services/credentials.h" |
+#include "sandbox/linux/services/namespace_sandbox.h" |
#include "sandbox/linux/services/proc_util.h" |
#include "sandbox/linux/services/thread_helpers.h" |
#include "sandbox/linux/suid/client/setuid_sandbox_client.h" |
@@ -50,6 +54,21 @@ base::ScopedFD GetProcSelfTask(int proc_fd) { |
return proc_self_task.Pass(); |
} |
+bool MaybeSetProcessNonDumpable() { |
jln (very slow on Chromium)
2015/02/06 00:37:29
Good catch. Let's split it into its own CL if you
rickyz (no longer on Chrome)
2015/02/06 01:53:18
Split this out into https://codereview.chromium.or
|
+ const base::CommandLine& command_line = |
+ *base::CommandLine::ForCurrentProcess(); |
+ if (command_line.HasSwitch(switches::kAllowSandboxDebugging)) { |
+ return true; |
+ } |
+ |
+ if (prctl(PR_SET_DUMPABLE, 0) != 0) { |
+ PLOG(ERROR) << "Failed to set non-dumpable flag"; |
+ return false; |
+ } |
+ |
+ return prctl(PR_GET_DUMPABLE) == 0; |
+} |
+ |
} // namespace |
NaClSandbox::NaClSandbox() |
@@ -91,6 +110,17 @@ void NaClSandbox::InitializeLayerOneSandbox() { |
// Get sandboxed. |
CHECK(setuid_sandbox_client_->ChrootMe()); |
+ CHECK(MaybeSetProcessNonDumpable()); |
+ CHECK(IsSandboxed()); |
+ layer_one_enabled_ = true; |
+ } else if (sandbox::NamespaceSandbox::InNewUserNamespace()) { |
+ CHECK(sandbox::Credentials::MoveToNewUserNS()); |
+ CHECK(sandbox::Credentials::DropFileSystemAccess()); |
+ CHECK(sandbox::Credentials::DropAllCapabilities()); |
+ |
+ // This needs to happen after moving to a new user NS, since doing so |
+ // involves writing the UID/GID map. |
+ CHECK(MaybeSetProcessNonDumpable()); |
CHECK(IsSandboxed()); |
layer_one_enabled_ = true; |
} |
@@ -111,6 +141,9 @@ void NaClSandbox::CheckForExpectedNumberOfOpenFds() { |
// This sanity check ensures that dynamically loaded libraries don't |
// leave any FDs open before we enable the sandbox. |
CHECK_EQ(7, sandbox::ProcUtil::CountOpenFds(proc_fd_.get())); |
+ } else if (sandbox::NamespaceSandbox::InNewUserNamespace()) { |
+ // Same as above, except minus the SUID sandbox helper FD. |
+ CHECK_EQ(6, sandbox::ProcUtil::CountOpenFds(proc_fd_.get())); |
jln (very slow on Chromium)
2015/02/06 00:37:29
Maybe symbolize that count and -1/+1 it?
rickyz (no longer on Chrome)
2015/02/06 01:53:18
Done.
|
} |
} |