OLD | NEW |
1 // Copyright 2014 The Chromium Authors. All rights reserved. | 1 // Copyright 2014 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "components/nacl/loader/sandbox_linux/nacl_sandbox_linux.h" | 5 #include "components/nacl/loader/sandbox_linux/nacl_sandbox_linux.h" |
6 | 6 |
7 #include <errno.h> | 7 #include <errno.h> |
8 #include <fcntl.h> | 8 #include <fcntl.h> |
| 9 #include <sys/prctl.h> |
9 #include <sys/stat.h> | 10 #include <sys/stat.h> |
10 #include <sys/types.h> | 11 #include <sys/types.h> |
11 #include <unistd.h> | 12 #include <unistd.h> |
12 | 13 |
13 #include "base/basictypes.h" | 14 #include "base/basictypes.h" |
14 #include "base/callback.h" | 15 #include "base/callback.h" |
15 #include "base/command_line.h" | 16 #include "base/command_line.h" |
16 #include "base/compiler_specific.h" | 17 #include "base/compiler_specific.h" |
17 #include "base/files/scoped_file.h" | 18 #include "base/files/scoped_file.h" |
18 #include "base/logging.h" | 19 #include "base/logging.h" |
19 #include "base/memory/scoped_ptr.h" | 20 #include "base/memory/scoped_ptr.h" |
20 #include "base/posix/eintr_wrapper.h" | 21 #include "base/posix/eintr_wrapper.h" |
21 #include "build/build_config.h" | 22 #include "build/build_config.h" |
22 #include "components/nacl/common/nacl_switches.h" | 23 #include "components/nacl/common/nacl_switches.h" |
23 #include "components/nacl/loader/nonsfi/nonsfi_sandbox.h" | 24 #include "components/nacl/loader/nonsfi/nonsfi_sandbox.h" |
24 #include "components/nacl/loader/sandbox_linux/nacl_bpf_sandbox_linux.h" | 25 #include "components/nacl/loader/sandbox_linux/nacl_bpf_sandbox_linux.h" |
| 26 #include "content/public/common/content_switches.h" |
25 #include "sandbox/linux/seccomp-bpf/sandbox_bpf.h" | 27 #include "sandbox/linux/seccomp-bpf/sandbox_bpf.h" |
26 #include "sandbox/linux/services/proc_util.h" | 28 #include "sandbox/linux/services/proc_util.h" |
27 #include "sandbox/linux/services/thread_helpers.h" | 29 #include "sandbox/linux/services/thread_helpers.h" |
28 #include "sandbox/linux/suid/client/setuid_sandbox_client.h" | 30 #include "sandbox/linux/suid/client/setuid_sandbox_client.h" |
29 | 31 |
30 namespace nacl { | 32 namespace nacl { |
31 | 33 |
32 namespace { | 34 namespace { |
33 | 35 |
34 // This is a poor man's check on whether we are sandboxed. | 36 // This is a poor man's check on whether we are sandboxed. |
35 bool IsSandboxed() { | 37 bool IsSandboxed() { |
36 int proc_fd = open("/proc/self/exe", O_RDONLY); | 38 int proc_fd = open("/proc/self/exe", O_RDONLY); |
37 if (proc_fd >= 0) { | 39 if (proc_fd >= 0) { |
38 PCHECK(0 == IGNORE_EINTR(close(proc_fd))); | 40 PCHECK(0 == IGNORE_EINTR(close(proc_fd))); |
39 return false; | 41 return false; |
40 } | 42 } |
41 return true; | 43 return true; |
42 } | 44 } |
43 | 45 |
44 // Open a new file descriptor to /proc/self/task/ by using | 46 // Open a new file descriptor to /proc/self/task/ by using |
45 // |proc_fd|. | 47 // |proc_fd|. |
46 base::ScopedFD GetProcSelfTask(int proc_fd) { | 48 base::ScopedFD GetProcSelfTask(int proc_fd) { |
47 base::ScopedFD proc_self_task(HANDLE_EINTR( | 49 base::ScopedFD proc_self_task(HANDLE_EINTR( |
48 openat(proc_fd, "self/task/", O_RDONLY | O_DIRECTORY | O_CLOEXEC))); | 50 openat(proc_fd, "self/task/", O_RDONLY | O_DIRECTORY | O_CLOEXEC))); |
49 PCHECK(proc_self_task.is_valid()); | 51 PCHECK(proc_self_task.is_valid()); |
50 return proc_self_task.Pass(); | 52 return proc_self_task.Pass(); |
51 } | 53 } |
52 | 54 |
| 55 bool MaybeSetProcessNonDumpable() { |
| 56 const base::CommandLine& command_line = |
| 57 *base::CommandLine::ForCurrentProcess(); |
| 58 if (command_line.HasSwitch(switches::kAllowSandboxDebugging)) { |
| 59 return true; |
| 60 } |
| 61 |
| 62 if (prctl(PR_SET_DUMPABLE, 0, 0, 0, 0) != 0) { |
| 63 PLOG(ERROR) << "Failed to set non-dumpable flag"; |
| 64 return false; |
| 65 } |
| 66 |
| 67 return prctl(PR_GET_DUMPABLE) == 0; |
| 68 } |
| 69 |
53 } // namespace | 70 } // namespace |
54 | 71 |
55 NaClSandbox::NaClSandbox() | 72 NaClSandbox::NaClSandbox() |
56 : layer_one_enabled_(false), | 73 : layer_one_enabled_(false), |
57 layer_one_sealed_(false), | 74 layer_one_sealed_(false), |
58 layer_two_enabled_(false), | 75 layer_two_enabled_(false), |
59 layer_two_is_nonsfi_(false), | 76 layer_two_is_nonsfi_(false), |
60 proc_fd_(-1), | 77 proc_fd_(-1), |
61 setuid_sandbox_client_(sandbox::SetuidSandboxClient::Create()) { | 78 setuid_sandbox_client_(sandbox::SetuidSandboxClient::Create()) { |
62 proc_fd_.reset( | 79 proc_fd_.reset( |
(...skipping 21 matching lines...) Expand all Loading... |
84 | 101 |
85 if (setuid_sandbox_client_->IsSuidSandboxChild()) { | 102 if (setuid_sandbox_client_->IsSuidSandboxChild()) { |
86 setuid_sandbox_client_->CloseDummyFile(); | 103 setuid_sandbox_client_->CloseDummyFile(); |
87 | 104 |
88 // Make sure that no directory file descriptor is open, as it would bypass | 105 // Make sure that no directory file descriptor is open, as it would bypass |
89 // the setuid sandbox model. | 106 // the setuid sandbox model. |
90 CHECK(!HasOpenDirectory()); | 107 CHECK(!HasOpenDirectory()); |
91 | 108 |
92 // Get sandboxed. | 109 // Get sandboxed. |
93 CHECK(setuid_sandbox_client_->ChrootMe()); | 110 CHECK(setuid_sandbox_client_->ChrootMe()); |
| 111 CHECK(MaybeSetProcessNonDumpable()); |
94 CHECK(IsSandboxed()); | 112 CHECK(IsSandboxed()); |
95 layer_one_enabled_ = true; | 113 layer_one_enabled_ = true; |
96 } | 114 } |
97 } | 115 } |
98 | 116 |
99 void NaClSandbox::CheckForExpectedNumberOfOpenFds() { | 117 void NaClSandbox::CheckForExpectedNumberOfOpenFds() { |
100 if (setuid_sandbox_client_->IsSuidSandboxChild()) { | 118 if (setuid_sandbox_client_->IsSuidSandboxChild()) { |
101 // We expect to have the following FDs open: | 119 // We expect to have the following FDs open: |
102 // 1-3) stdin, stdout, stderr. | 120 // 1-3) stdin, stdout, stderr. |
103 // 4) The /dev/urandom FD used by base::GetUrandomFD(). | 121 // 4) The /dev/urandom FD used by base::GetUrandomFD(). |
(...skipping 62 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
166 static const char kNoBpfMsg[] = | 184 static const char kNoBpfMsg[] = |
167 "The seccomp-bpf sandbox is not engaged for NaCl:"; | 185 "The seccomp-bpf sandbox is not engaged for NaCl:"; |
168 if (can_be_no_sandbox) | 186 if (can_be_no_sandbox) |
169 LOG(ERROR) << kNoBpfMsg << kItIsDangerousMsg; | 187 LOG(ERROR) << kNoBpfMsg << kItIsDangerousMsg; |
170 else | 188 else |
171 LOG(FATAL) << kNoBpfMsg << kItIsNotAllowedMsg; | 189 LOG(FATAL) << kNoBpfMsg << kItIsNotAllowedMsg; |
172 } | 190 } |
173 } | 191 } |
174 | 192 |
175 } // namespace nacl | 193 } // namespace nacl |
OLD | NEW |