Index: content/zygote/zygote_main_linux.cc |
diff --git a/content/zygote/zygote_main_linux.cc b/content/zygote/zygote_main_linux.cc |
index 8f89580d42f6ed7a97b86e0e8651acf0905675a5..b7c7a0d5b97bb5f51f8bff9edc2246c90ab91078 100644 |
--- a/content/zygote/zygote_main_linux.cc |
+++ b/content/zygote/zygote_main_linux.cc |
@@ -39,8 +39,10 @@ |
#include "content/public/common/zygote_fork_delegate_linux.h" |
#include "content/zygote/zygote_linux.h" |
#include "crypto/nss_util.h" |
+#include "sandbox/linux/services/credentials.h" |
#include "sandbox/linux/services/init_process_reaper.h" |
#include "sandbox/linux/services/libc_urandom_override.h" |
+#include "sandbox/linux/services/namespace_sandbox.h" |
#include "sandbox/linux/suid/client/setuid_sandbox_client.h" |
#include "third_party/icu/source/i18n/unicode/timezone.h" |
#include "third_party/skia/include/ports/SkFontConfigInterface.h" |
@@ -470,6 +472,23 @@ static bool EnterSuidSandbox(sandbox::SetuidSandboxClient* setuid_sandbox, |
return true; |
} |
+static void EnterNamespaceSandbox(base::Closure* post_fork_parent_callback) { |
+ pid_t pid = getpid(); |
jln (very slow on Chromium)
2015/02/05 00:26:56
Want to sys_getpid() here, just in case?
rickyz (no longer on Chrome)
2015/02/05 01:42:51
Hm, I don't think there should be a way for getpid
|
+ if (sandbox::NamespaceSandbox::InNewPidNamespace()) { |
+ CHECK_EQ(1, pid); |
+ } |
+ |
+ CHECK(sandbox::Credentials::MoveToNewUserNS()); |
+ CHECK(sandbox::Credentials::DropFileSystemAccess()); |
+ // We do not drop capabilities because we will use CAP_SYS_ADMIN to place |
+ // each child process in its own PID namespace later on (this is not yet |
+ // implemented). |
jln (very slow on Chromium)
2015/02/05 00:26:56
Let's drop capabilities, no? Otherwise the sandbox
rickyz (no longer on Chrome)
2015/02/05 01:42:51
Yeah, sounds reasonable to drop capabilities until
jln (very slow on Chromium)
2015/02/05 05:44:15
No, it's not true. After DropFileSystemAccess(); y
rickyz (no longer on Chrome)
2015/02/05 09:01:14
Ah yes, you're right - I had forgotten that unshar
|
+ |
+ if (pid == 1) { |
+ CHECK(CreateInitProcessReaper(post_fork_parent_callback)); |
+ } |
+} |
+ |
#if defined(ADDRESS_SANITIZER) |
const size_t kSanitizerMaxMessageLength = 1 * 1024 * 1024; |
@@ -546,6 +565,8 @@ static void EnterLayerOneSandbox(LinuxSandbox* linux_sandbox, |
if (is_suid_sandbox_child) { |
CHECK(EnterSuidSandbox(setuid_sandbox, post_fork_parent_callback)) |
<< "Failed to enter setuid sandbox"; |
+ } else if (sandbox::NamespaceSandbox::InNewUserNamespace()) { |
+ EnterNamespaceSandbox(post_fork_parent_callback); |
} |
} |