| OLD | NEW |
|---|
| (Empty) |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | |
| 2 // Use of this source code is governed by a BSD-style license that can be | |
| 3 // found in the LICENSE file. | |
| 4 | |
| 5 #include "content/browser/zygote_host_impl_linux.h" | |
| 6 | |
| 7 #include <dlfcn.h> | |
| 8 #include <fcntl.h> | |
| 9 #include <pthread.h> | |
| 10 #include <stdio.h> | |
| 11 #include <sys/socket.h> | |
| 12 #include <sys/stat.h> | |
| 13 #include <sys/types.h> | |
| 14 #include <sys/wait.h> | |
| 15 #include <unistd.h> | |
| 16 | |
| 17 #include "base/basictypes.h" | |
| 18 #include "base/command_line.h" | |
| 19 #include "base/debug/trace_event.h" | |
| 20 #include "base/eintr_wrapper.h" | |
| 21 #include "base/file_path.h" | |
| 22 #include "base/file_util.h" | |
| 23 #include "base/global_descriptors_posix.h" | |
| 24 #include "base/hash_tables.h" | |
| 25 #include "base/linux_util.h" | |
| 26 #include "base/memory/scoped_ptr.h" | |
| 27 #include "base/pickle.h" | |
| 28 #include "base/process_util.h" | |
| 29 #include "base/rand_util.h" | |
| 30 #include "base/rand_util_c.h" | |
| 31 #include "base/sys_info.h" | |
| 32 #include "build/build_config.h" | |
| 33 #include "crypto/nss_util.h" | |
| 34 #include "content/common/chrome_descriptors.h" | |
| 35 #include "content/common/font_config_ipc_linux.h" | |
| 36 #include "content/common/pepper_plugin_registry.h" | |
| 37 #include "content/common/sandbox_methods_linux.h" | |
| 38 #include "content/common/seccomp_sandbox.h" | |
| 39 #include "content/common/set_process_title.h" | |
| 40 #include "content/common/unix_domain_socket_posix.h" | |
| 41 #include "content/public/common/content_switches.h" | |
| 42 #include "content/public/common/main_function_params.h" | |
| 43 #include "content/public/common/result_codes.h" | |
| 44 #include "content/public/common/zygote_fork_delegate_linux.h" | |
| 45 #include "skia/ext/SkFontHost_fontconfig_control.h" | |
| 46 #include "unicode/timezone.h" | |
| 47 #include "ipc/ipc_channel.h" | |
| 48 #include "ipc/ipc_switches.h" | |
| 49 | |
| 50 #if defined(OS_LINUX) | |
| 51 #include <sys/epoll.h> | |
| 52 #include <sys/prctl.h> | |
| 53 #include <sys/signal.h> | |
| 54 #else | |
| 55 #include <signal.h> | |
| 56 #endif | |
| 57 | |
| 58 #if defined(CHROMIUM_SELINUX) | |
| 59 #include <selinux/selinux.h> | |
| 60 #include <selinux/context.h> | |
| 61 #endif | |
| 62 | |
| 63 // http://code.google.com/p/chromium/wiki/LinuxZygote | |
| 64 | |
| 65 static const int kBrowserDescriptor = 3; | |
| 66 static const int kMagicSandboxIPCDescriptor = 5; | |
| 67 static const int kZygoteIdDescriptor = 7; | |
| 68 static bool g_suid_sandbox_active = false; | |
| 69 | |
| 70 static const char kUrandomDevPath[] = "/dev/urandom"; | |
| 71 | |
| 72 #if defined(SECCOMP_SANDBOX) | |
| 73 static int g_proc_fd = -1; | |
| 74 #endif | |
| 75 | |
| 76 #if defined(CHROMIUM_SELINUX) | |
| 77 static void SELinuxTransitionToTypeOrDie(const char* type) { | |
| 78 security_context_t security_context; | |
| 79 if (getcon(&security_context)) | |
| 80 LOG(FATAL) << "Cannot get SELinux context"; | |
| 81 | |
| 82 context_t context = context_new(security_context); | |
| 83 context_type_set(context, type); | |
| 84 const int r = setcon(context_str(context)); | |
| 85 context_free(context); | |
| 86 freecon(security_context); | |
| 87 | |
| 88 if (r) { | |
| 89 LOG(FATAL) << "dynamic transition to type '" << type << "' failed. " | |
| 90 "(this binary has been built with SELinux support, but maybe " | |
| 91 "the policies haven't been loaded into the kernel?)"; | |
| 92 } | |
| 93 } | |
| 94 #endif // CHROMIUM_SELINUX | |
| 95 | |
| 96 // This is the object which implements the zygote. The ZygoteMain function, | |
| 97 // which is called from ChromeMain, simply constructs one of these objects and | |
| 98 // runs it. | |
| 99 class Zygote { | |
| 100 public: | |
| 101 Zygote(int sandbox_flags, content::ZygoteForkDelegate* helper) | |
| 102 : sandbox_flags_(sandbox_flags), | |
| 103 helper_(helper), | |
| 104 initial_uma_sample_(0), | |
| 105 initial_uma_boundary_value_(0) { | |
| 106 if (helper_) | |
| 107 helper_->InitialUMA(&initial_uma_name_, | |
| 108 &initial_uma_sample_, | |
| 109 &initial_uma_boundary_value_); | |
| 110 } | |
| 111 | |
| 112 bool ProcessRequests() { | |
| 113 // A SOCK_SEQPACKET socket is installed in fd 3. We get commands from the | |
| 114 // browser on it. | |
| 115 // A SOCK_DGRAM is installed in fd 5. This is the sandbox IPC channel. | |
| 116 // See http://code.google.com/p/chromium/wiki/LinuxSandboxIPC | |
| 117 | |
| 118 // We need to accept SIGCHLD, even though our handler is a no-op because | |
| 119 // otherwise we cannot wait on children. (According to POSIX 2001.) | |
| 120 struct sigaction action; | |
| 121 memset(&action, 0, sizeof(action)); | |
| 122 action.sa_handler = SIGCHLDHandler; | |
| 123 CHECK(sigaction(SIGCHLD, &action, NULL) == 0); | |
| 124 | |
| 125 if (g_suid_sandbox_active) { | |
| 126 // Let the ZygoteHost know we are ready to go. | |
| 127 // The receiving code is in content/browser/zygote_host_linux.cc. | |
| 128 std::vector<int> empty; | |
| 129 bool r = UnixDomainSocket::SendMsg(kBrowserDescriptor, kZygoteMagic, | |
| 130 sizeof(kZygoteMagic), empty); | |
| 131 #if defined(OS_CHROMEOS) | |
| 132 LOG_IF(WARNING, !r) << "Sending zygote magic failed"; | |
| 133 // Exit normally on chromeos because session manager may send SIGTERM | |
| 134 // right after the process starts and it may fail to send zygote magic | |
| 135 // number to browser process. | |
| 136 if (!r) | |
| 137 _exit(content::RESULT_CODE_NORMAL_EXIT); | |
| 138 #else | |
| 139 CHECK(r) << "Sending zygote magic failed"; | |
| 140 #endif | |
| 141 } | |
| 142 | |
| 143 for (;;) { | |
| 144 // This function call can return multiple times, once per fork(). | |
| 145 if (HandleRequestFromBrowser(kBrowserDescriptor)) | |
| 146 return true; | |
| 147 } | |
| 148 } | |
| 149 | |
| 150 private: | |
| 151 // See comment below, where sigaction is called. | |
| 152 static void SIGCHLDHandler(int signal) { } | |
| 153 | |
| 154 // --------------------------------------------------------------------------- | |
| 155 // Requests from the browser... | |
| 156 | |
| 157 // Read and process a request from the browser. Returns true if we are in a | |
| 158 // new process and thus need to unwind back into ChromeMain. | |
| 159 bool HandleRequestFromBrowser(int fd) { | |
| 160 std::vector<int> fds; | |
| 161 static const unsigned kMaxMessageLength = 2048; | |
| 162 char buf[kMaxMessageLength]; | |
| 163 const ssize_t len = UnixDomainSocket::RecvMsg(fd, buf, sizeof(buf), &fds); | |
| 164 | |
| 165 if (len == 0 || (len == -1 && errno == ECONNRESET)) { | |
| 166 // EOF from the browser. We should die. | |
| 167 _exit(0); | |
| 168 return false; | |
| 169 } | |
| 170 | |
| 171 if (len == -1) { | |
| 172 PLOG(ERROR) << "Error reading message from browser"; | |
| 173 return false; | |
| 174 } | |
| 175 | |
| 176 Pickle pickle(buf, len); | |
| 177 PickleIterator iter(pickle); | |
| 178 | |
| 179 int kind; | |
| 180 if (pickle.ReadInt(&iter, &kind)) { | |
| 181 switch (kind) { | |
| 182 case ZygoteHostImpl::kCmdFork: | |
| 183 // This function call can return multiple times, once per fork(). | |
| 184 return HandleForkRequest(fd, pickle, iter, fds); | |
| 185 | |
| 186 case ZygoteHostImpl::kCmdReap: | |
| 187 if (!fds.empty()) | |
| 188 break; | |
| 189 HandleReapRequest(fd, pickle, iter); | |
| 190 return false; | |
| 191 case ZygoteHostImpl::kCmdGetTerminationStatus: | |
| 192 if (!fds.empty()) | |
| 193 break; | |
| 194 HandleGetTerminationStatus(fd, pickle, iter); | |
| 195 return false; | |
| 196 case ZygoteHostImpl::kCmdGetSandboxStatus: | |
| 197 HandleGetSandboxStatus(fd, pickle, iter); | |
| 198 return false; | |
| 199 default: | |
| 200 NOTREACHED(); | |
| 201 break; | |
| 202 } | |
| 203 } | |
| 204 | |
| 205 LOG(WARNING) << "Error parsing message from browser"; | |
| 206 for (std::vector<int>::const_iterator | |
| 207 i = fds.begin(); i != fds.end(); ++i) | |
| 208 close(*i); | |
| 209 return false; | |
| 210 } | |
| 211 | |
| 212 void HandleReapRequest(int fd, const Pickle& pickle, PickleIterator iter) { | |
| 213 base::ProcessId child; | |
| 214 base::ProcessId actual_child; | |
| 215 | |
| 216 if (!pickle.ReadInt(&iter, &child)) { | |
| 217 LOG(WARNING) << "Error parsing reap request from browser"; | |
| 218 return; | |
| 219 } | |
| 220 | |
| 221 if (g_suid_sandbox_active) { | |
| 222 actual_child = real_pids_to_sandbox_pids[child]; | |
| 223 if (!actual_child) | |
| 224 return; | |
| 225 real_pids_to_sandbox_pids.erase(child); | |
| 226 } else { | |
| 227 actual_child = child; | |
| 228 } | |
| 229 | |
| 230 base::EnsureProcessTerminated(actual_child); | |
| 231 } | |
| 232 | |
| 233 void HandleGetTerminationStatus(int fd, | |
| 234 const Pickle& pickle, | |
| 235 PickleIterator iter) { | |
| 236 base::ProcessHandle child; | |
| 237 | |
| 238 if (!pickle.ReadInt(&iter, &child)) { | |
| 239 LOG(WARNING) << "Error parsing GetTerminationStatus request " | |
| 240 << "from browser"; | |
| 241 return; | |
| 242 } | |
| 243 | |
| 244 base::TerminationStatus status; | |
| 245 int exit_code; | |
| 246 if (g_suid_sandbox_active) | |
| 247 child = real_pids_to_sandbox_pids[child]; | |
| 248 if (child) { | |
| 249 status = base::GetTerminationStatus(child, &exit_code); | |
| 250 } else { | |
| 251 // Assume that if we can't find the child in the sandbox, then | |
| 252 // it terminated normally. | |
| 253 status = base::TERMINATION_STATUS_NORMAL_TERMINATION; | |
| 254 exit_code = content::RESULT_CODE_NORMAL_EXIT; | |
| 255 } | |
| 256 | |
| 257 Pickle write_pickle; | |
| 258 write_pickle.WriteInt(static_cast<int>(status)); | |
| 259 write_pickle.WriteInt(exit_code); | |
| 260 ssize_t written = | |
| 261 HANDLE_EINTR(write(fd, write_pickle.data(), write_pickle.size())); | |
| 262 if (written != static_cast<ssize_t>(write_pickle.size())) | |
| 263 PLOG(ERROR) << "write"; | |
| 264 } | |
| 265 | |
| 266 // This is equivalent to fork(), except that, when using the SUID | |
| 267 // sandbox, it returns the real PID of the child process as it | |
| 268 // appears outside the sandbox, rather than returning the PID inside | |
| 269 // the sandbox. Optionally, it fills in uma_name et al with a report | |
| 270 // the helper wants to make via UMA_HISTOGRAM_ENUMERATION. | |
| 271 int ForkWithRealPid(const std::string& process_type, std::vector<int>& fds, | |
| 272 const std::string& channel_switch, | |
| 273 std::string* uma_name, | |
| 274 int* uma_sample, int* uma_boundary_value) { | |
| 275 const bool use_helper = (helper_ && helper_->CanHelp(process_type, | |
| 276 uma_name, | |
| 277 uma_sample, | |
| 278 uma_boundary_value)); | |
| 279 if (!(use_helper || g_suid_sandbox_active)) { | |
| 280 return fork(); | |
| 281 } | |
| 282 | |
| 283 int dummy_fd; | |
| 284 ino_t dummy_inode; | |
| 285 int pipe_fds[2] = { -1, -1 }; | |
| 286 base::ProcessId pid = 0; | |
| 287 | |
| 288 dummy_fd = socket(PF_UNIX, SOCK_DGRAM, 0); | |
| 289 if (dummy_fd < 0) { | |
| 290 LOG(ERROR) << "Failed to create dummy FD"; | |
| 291 goto error; | |
| 292 } | |
| 293 if (!base::FileDescriptorGetInode(&dummy_inode, dummy_fd)) { | |
| 294 LOG(ERROR) << "Failed to get inode for dummy FD"; | |
| 295 goto error; | |
| 296 } | |
| 297 if (pipe(pipe_fds) != 0) { | |
| 298 LOG(ERROR) << "Failed to create pipe"; | |
| 299 goto error; | |
| 300 } | |
| 301 | |
| 302 if (use_helper) { | |
| 303 fds.push_back(dummy_fd); | |
| 304 fds.push_back(pipe_fds[0]); | |
| 305 pid = helper_->Fork(fds); | |
| 306 } else { | |
| 307 pid = fork(); | |
| 308 } | |
| 309 if (pid < 0) { | |
| 310 goto error; | |
| 311 } else if (pid == 0) { | |
| 312 // In the child process. | |
| 313 close(pipe_fds[1]); | |
| 314 base::ProcessId real_pid; | |
| 315 // Wait until the parent process has discovered our PID. We | |
| 316 // should not fork any child processes (which the seccomp | |
| 317 // sandbox does) until then, because that can interfere with the | |
| 318 // parent's discovery of our PID. | |
| 319 if (!file_util::ReadFromFD(pipe_fds[0], | |
| 320 reinterpret_cast<char*>(&real_pid), | |
| 321 sizeof(real_pid))) { | |
| 322 LOG(FATAL) << "Failed to synchronise with parent zygote process"; | |
| 323 } | |
| 324 if (real_pid <= 0) { | |
| 325 LOG(FATAL) << "Invalid pid from parent zygote"; | |
| 326 } | |
| 327 #if defined(OS_LINUX) | |
| 328 // Sandboxed processes need to send the global, non-namespaced PID when | |
| 329 // setting up an IPC channel to their parent. | |
| 330 IPC::Channel::SetGlobalPid(real_pid); | |
| 331 // Force the real PID so chrome event data have a PID that corresponds | |
| 332 // to system trace event data. | |
| 333 base::debug::TraceLog::GetInstance()->SetProcessID( | |
| 334 static_cast<int>(real_pid)); | |
| 335 #endif | |
| 336 close(pipe_fds[0]); | |
| 337 close(dummy_fd); | |
| 338 return 0; | |
| 339 } else { | |
| 340 // In the parent process. | |
| 341 close(dummy_fd); | |
| 342 dummy_fd = -1; | |
| 343 close(pipe_fds[0]); | |
| 344 pipe_fds[0] = -1; | |
| 345 base::ProcessId real_pid; | |
| 346 if (g_suid_sandbox_active) { | |
| 347 uint8_t reply_buf[512]; | |
| 348 Pickle request; | |
| 349 request.WriteInt(LinuxSandbox::METHOD_GET_CHILD_WITH_INODE); | |
| 350 request.WriteUInt64(dummy_inode); | |
| 351 | |
| 352 const ssize_t r = UnixDomainSocket::SendRecvMsg( | |
| 353 kMagicSandboxIPCDescriptor, reply_buf, sizeof(reply_buf), NULL, | |
| 354 request); | |
| 355 if (r == -1) { | |
| 356 LOG(ERROR) << "Failed to get child process's real PID"; | |
| 357 goto error; | |
| 358 } | |
| 359 | |
| 360 Pickle reply(reinterpret_cast<char*>(reply_buf), r); | |
| 361 PickleIterator iter(reply); | |
| 362 if (!reply.ReadInt(&iter, &real_pid)) | |
| 363 goto error; | |
| 364 if (real_pid <= 0) { | |
| 365 // METHOD_GET_CHILD_WITH_INODE failed. Did the child die already? | |
| 366 LOG(ERROR) << "METHOD_GET_CHILD_WITH_INODE failed"; | |
| 367 goto error; | |
| 368 } | |
| 369 real_pids_to_sandbox_pids[real_pid] = pid; | |
| 370 } | |
| 371 if (use_helper) { | |
| 372 real_pid = pid; | |
| 373 if (!helper_->AckChild(pipe_fds[1], channel_switch)) { | |
| 374 LOG(ERROR) << "Failed to synchronise with zygote fork helper"; | |
| 375 goto error; | |
| 376 } | |
| 377 } else { | |
| 378 int written = | |
| 379 HANDLE_EINTR(write(pipe_fds[1], &real_pid, sizeof(real_pid))); | |
| 380 if (written != sizeof(real_pid)) { | |
| 381 LOG(ERROR) << "Failed to synchronise with child process"; | |
| 382 goto error; | |
| 383 } | |
| 384 } | |
| 385 close(pipe_fds[1]); | |
| 386 return real_pid; | |
| 387 } | |
| 388 | |
| 389 error: | |
| 390 if (pid > 0) { | |
| 391 if (waitpid(pid, NULL, WNOHANG) == -1) | |
| 392 LOG(ERROR) << "Failed to wait for process"; | |
| 393 } | |
| 394 if (dummy_fd >= 0) | |
| 395 close(dummy_fd); | |
| 396 if (pipe_fds[0] >= 0) | |
| 397 close(pipe_fds[0]); | |
| 398 if (pipe_fds[1] >= 0) | |
| 399 close(pipe_fds[1]); | |
| 400 return -1; | |
| 401 } | |
| 402 | |
| 403 // Unpacks process type and arguments from |pickle| and forks a new process. | |
| 404 // Returns -1 on error, otherwise returns twice, returning 0 to the child | |
| 405 // process and the child process ID to the parent process, like fork(). | |
| 406 base::ProcessId ReadArgsAndFork(const Pickle& pickle, | |
| 407 PickleIterator iter, | |
| 408 std::vector<int>& fds, | |
| 409 std::string* uma_name, | |
| 410 int* uma_sample, | |
| 411 int* uma_boundary_value) { | |
| 412 std::vector<std::string> args; | |
| 413 int argc = 0; | |
| 414 int numfds = 0; | |
| 415 base::GlobalDescriptors::Mapping mapping; | |
| 416 std::string process_type; | |
| 417 std::string channel_id; | |
| 418 const std::string channel_id_prefix = std::string("--") | |
| 419 + switches::kProcessChannelID + std::string("="); | |
| 420 | |
| 421 if (!pickle.ReadString(&iter, &process_type)) | |
| 422 return -1; | |
| 423 if (!pickle.ReadInt(&iter, &argc)) | |
| 424 return -1; | |
| 425 | |
| 426 for (int i = 0; i < argc; ++i) { | |
| 427 std::string arg; | |
| 428 if (!pickle.ReadString(&iter, &arg)) | |
| 429 return -1; | |
| 430 args.push_back(arg); | |
| 431 if (arg.compare(0, channel_id_prefix.length(), channel_id_prefix) == 0) | |
| 432 channel_id = arg; | |
| 433 } | |
| 434 | |
| 435 if (!pickle.ReadInt(&iter, &numfds)) | |
| 436 return -1; | |
| 437 if (numfds != static_cast<int>(fds.size())) | |
| 438 return -1; | |
| 439 | |
| 440 for (int i = 0; i < numfds; ++i) { | |
| 441 base::GlobalDescriptors::Key key; | |
| 442 if (!pickle.ReadUInt32(&iter, &key)) | |
| 443 return -1; | |
| 444 mapping.push_back(std::make_pair(key, fds[i])); | |
| 445 } | |
| 446 | |
| 447 mapping.push_back(std::make_pair( | |
| 448 static_cast<uint32_t>(kSandboxIPCChannel), kMagicSandboxIPCDescriptor)); | |
| 449 | |
| 450 // Returns twice, once per process. | |
| 451 base::ProcessId child_pid = ForkWithRealPid(process_type, fds, channel_id, | |
| 452 uma_name, uma_sample, | |
| 453 uma_boundary_value); | |
| 454 if (!child_pid) { | |
| 455 // This is the child process. | |
| 456 #if defined(SECCOMP_SANDBOX) | |
| 457 if (SeccompSandboxEnabled() && g_proc_fd >= 0) { | |
| 458 // Try to open /proc/self/maps as the seccomp sandbox needs access to it | |
| 459 int proc_self_maps = openat(g_proc_fd, "self/maps", O_RDONLY); | |
| 460 if (proc_self_maps >= 0) { | |
| 461 SeccompSandboxSetProcSelfMaps(proc_self_maps); | |
| 462 } else { | |
| 463 PLOG(ERROR) << "openat(/proc/self/maps)"; | |
| 464 } | |
| 465 close(g_proc_fd); | |
| 466 g_proc_fd = -1; | |
| 467 } | |
| 468 #endif | |
| 469 | |
| 470 close(kBrowserDescriptor); // our socket from the browser | |
| 471 if (g_suid_sandbox_active) | |
| 472 close(kZygoteIdDescriptor); // another socket from the browser | |
| 473 base::GlobalDescriptors::GetInstance()->Reset(mapping); | |
| 474 | |
| 475 #if defined(CHROMIUM_SELINUX) | |
| 476 SELinuxTransitionToTypeOrDie("chromium_renderer_t"); | |
| 477 #endif | |
| 478 | |
| 479 // Reset the process-wide command line to our new command line. | |
| 480 CommandLine::Reset(); | |
| 481 CommandLine::Init(0, NULL); | |
| 482 CommandLine::ForCurrentProcess()->InitFromArgv(args); | |
| 483 | |
| 484 // Update the process title. The argv was already cached by the call to | |
| 485 // SetProcessTitleFromCommandLine in ChromeMain, so we can pass NULL here | |
| 486 // (we don't have the original argv at this point). | |
| 487 SetProcessTitleFromCommandLine(NULL); | |
| 488 } else if (child_pid < 0) { | |
| 489 LOG(ERROR) << "Zygote could not fork: process_type " << process_type | |
| 490 << " numfds " << numfds << " child_pid " << child_pid; | |
| 491 } | |
| 492 return child_pid; | |
| 493 } | |
| 494 | |
| 495 // Handle a 'fork' request from the browser: this means that the browser | |
| 496 // wishes to start a new renderer. Returns true if we are in a new process, | |
| 497 // otherwise writes the child_pid back to the browser via |fd|. Writes a | |
| 498 // child_pid of -1 on error. | |
| 499 bool HandleForkRequest(int fd, const Pickle& pickle, | |
| 500 PickleIterator iter, std::vector<int>& fds) { | |
| 501 std::string uma_name; | |
| 502 int uma_sample; | |
| 503 int uma_boundary_value; | |
| 504 base::ProcessId child_pid = ReadArgsAndFork(pickle, iter, fds, | |
| 505 &uma_name, &uma_sample, | |
| 506 &uma_boundary_value); | |
| 507 if (child_pid == 0) | |
| 508 return true; | |
| 509 for (std::vector<int>::const_iterator | |
| 510 i = fds.begin(); i != fds.end(); ++i) | |
| 511 close(*i); | |
| 512 if (uma_name.empty()) { | |
| 513 // There is no UMA report from this particular fork. | |
| 514 // Use the initial UMA report if any, and clear that record for next time. | |
| 515 // Note the swap method here is the efficient way to do this, since | |
| 516 // we know uma_name is empty. | |
| 517 uma_name.swap(initial_uma_name_); | |
| 518 uma_sample = initial_uma_sample_; | |
| 519 uma_boundary_value = initial_uma_boundary_value_; | |
| 520 } | |
| 521 // Must always send reply, as ZygoteHost blocks while waiting for it. | |
| 522 Pickle reply_pickle; | |
| 523 reply_pickle.WriteInt(child_pid); | |
| 524 reply_pickle.WriteString(uma_name); | |
| 525 if (!uma_name.empty()) { | |
| 526 reply_pickle.WriteInt(uma_sample); | |
| 527 reply_pickle.WriteInt(uma_boundary_value); | |
| 528 } | |
| 529 if (HANDLE_EINTR(write(fd, reply_pickle.data(), reply_pickle.size())) != | |
| 530 static_cast<ssize_t> (reply_pickle.size())) | |
| 531 PLOG(ERROR) << "write"; | |
| 532 return false; | |
| 533 } | |
| 534 | |
| 535 bool HandleGetSandboxStatus(int fd, | |
| 536 const Pickle& pickle, | |
| 537 PickleIterator iter) { | |
| 538 if (HANDLE_EINTR(write(fd, &sandbox_flags_, sizeof(sandbox_flags_))) != | |
| 539 sizeof(sandbox_flags_)) { | |
| 540 PLOG(ERROR) << "write"; | |
| 541 } | |
| 542 | |
| 543 return false; | |
| 544 } | |
| 545 | |
| 546 // In the SUID sandbox, we try to use a new PID namespace. Thus the PIDs | |
| 547 // fork() returns are not the real PIDs, so we need to map the Real PIDS | |
| 548 // into the sandbox PID namespace. | |
| 549 typedef base::hash_map<base::ProcessHandle, base::ProcessHandle> ProcessMap; | |
| 550 ProcessMap real_pids_to_sandbox_pids; | |
| 551 | |
| 552 const int sandbox_flags_; | |
| 553 content::ZygoteForkDelegate* helper_; | |
| 554 | |
| 555 // These might be set by helper_->InitialUMA. They supply a UMA | |
| 556 // enumeration sample we should report on the first fork. | |
| 557 std::string initial_uma_name_; | |
| 558 int initial_uma_sample_; | |
| 559 int initial_uma_boundary_value_; | |
| 560 }; | |
| 561 | |
| 562 // With SELinux we can carve out a precise sandbox, so we don't have to play | |
| 563 // with intercepting libc calls. | |
| 564 #if !defined(CHROMIUM_SELINUX) | |
| 565 | |
| 566 static void ProxyLocaltimeCallToBrowser(time_t input, struct tm* output, | |
| 567 char* timezone_out, | |
| 568 size_t timezone_out_len) { | |
| 569 Pickle request; | |
| 570 request.WriteInt(LinuxSandbox::METHOD_LOCALTIME); | |
| 571 request.WriteString( | |
| 572 std::string(reinterpret_cast<char*>(&input), sizeof(input))); | |
| 573 | |
| 574 uint8_t reply_buf[512]; | |
| 575 const ssize_t r = UnixDomainSocket::SendRecvMsg( | |
| 576 kMagicSandboxIPCDescriptor, reply_buf, sizeof(reply_buf), NULL, request); | |
| 577 if (r == -1) { | |
| 578 memset(output, 0, sizeof(struct tm)); | |
| 579 return; | |
| 580 } | |
| 581 | |
| 582 Pickle reply(reinterpret_cast<char*>(reply_buf), r); | |
| 583 PickleIterator iter(reply); | |
| 584 std::string result, timezone; | |
| 585 if (!reply.ReadString(&iter, &result) || | |
| 586 !reply.ReadString(&iter, &timezone) || | |
| 587 result.size() != sizeof(struct tm)) { | |
| 588 memset(output, 0, sizeof(struct tm)); | |
| 589 return; | |
| 590 } | |
| 591 | |
| 592 memcpy(output, result.data(), sizeof(struct tm)); | |
| 593 if (timezone_out_len) { | |
| 594 const size_t copy_len = std::min(timezone_out_len - 1, timezone.size()); | |
| 595 memcpy(timezone_out, timezone.data(), copy_len); | |
| 596 timezone_out[copy_len] = 0; | |
| 597 output->tm_zone = timezone_out; | |
| 598 } else { | |
| 599 output->tm_zone = NULL; | |
| 600 } | |
| 601 } | |
| 602 | |
| 603 static bool g_am_zygote_or_renderer = false; | |
| 604 | |
| 605 // Sandbox interception of libc calls. | |
| 606 // | |
| 607 // Because we are running in a sandbox certain libc calls will fail (localtime | |
| 608 // being the motivating example - it needs to read /etc/localtime). We need to | |
| 609 // intercept these calls and proxy them to the browser. However, these calls | |
| 610 // may come from us or from our libraries. In some cases we can't just change | |
| 611 // our code. | |
| 612 // | |
| 613 // It's for these cases that we have the following setup: | |
| 614 // | |
| 615 // We define global functions for those functions which we wish to override. | |
| 616 // Since we will be first in the dynamic resolution order, the dynamic linker | |
| 617 // will point callers to our versions of these functions. However, we have the | |
| 618 // same binary for both the browser and the renderers, which means that our | |
| 619 // overrides will apply in the browser too. | |
| 620 // | |
| 621 // The global |g_am_zygote_or_renderer| is true iff we are in a zygote or | |
| 622 // renderer process. It's set in ZygoteMain and inherited by the renderers when | |
| 623 // they fork. (This means that it'll be incorrect for global constructor | |
| 624 // functions and before ZygoteMain is called - beware). | |
| 625 // | |
| 626 // Our replacement functions can check this global and either proxy | |
| 627 // the call to the browser over the sandbox IPC | |
| 628 // (http://code.google.com/p/chromium/wiki/LinuxSandboxIPC) or they can use | |
| 629 // dlsym with RTLD_NEXT to resolve the symbol, ignoring any symbols in the | |
| 630 // current module. | |
| 631 // | |
| 632 // Other avenues: | |
| 633 // | |
| 634 // Our first attempt involved some assembly to patch the GOT of the current | |
| 635 // module. This worked, but was platform specific and doesn't catch the case | |
| 636 // where a library makes a call rather than current module. | |
| 637 // | |
| 638 // We also considered patching the function in place, but this would again by | |
| 639 // platform specific and the above technique seems to work well enough. | |
| 640 | |
| 641 typedef struct tm* (*LocaltimeFunction)(const time_t* timep); | |
| 642 typedef struct tm* (*LocaltimeRFunction)(const time_t* timep, | |
| 643 struct tm* result); | |
| 644 typedef FILE* (*FopenFunction)(const char* path, const char* mode); | |
| 645 typedef int (*XstatFunction)(int version, const char *path, struct stat *buf); | |
| 646 typedef int (*Xstat64Function)(int version, const char *path, | |
| 647 struct stat64 *buf); | |
| 648 | |
| 649 static pthread_once_t g_libc_localtime_funcs_guard = PTHREAD_ONCE_INIT; | |
| 650 static LocaltimeFunction g_libc_localtime; | |
| 651 static LocaltimeRFunction g_libc_localtime_r; | |
| 652 | |
| 653 static pthread_once_t g_libc_file_io_funcs_guard = PTHREAD_ONCE_INIT; | |
| 654 static FopenFunction g_libc_fopen; | |
| 655 static FopenFunction g_libc_fopen64; | |
| 656 static XstatFunction g_libc_xstat; | |
| 657 static Xstat64Function g_libc_xstat64; | |
| 658 | |
| 659 static void InitLibcLocaltimeFunctions() { | |
| 660 g_libc_localtime = reinterpret_cast<LocaltimeFunction>( | |
| 661 dlsym(RTLD_NEXT, "localtime")); | |
| 662 g_libc_localtime_r = reinterpret_cast<LocaltimeRFunction>( | |
| 663 dlsym(RTLD_NEXT, "localtime_r")); | |
| 664 | |
| 665 if (!g_libc_localtime || !g_libc_localtime_r) { | |
| 666 // http://code.google.com/p/chromium/issues/detail?id=16800 | |
| 667 // | |
| 668 // Nvidia's libGL.so overrides dlsym for an unknown reason and replaces | |
| 669 // it with a version which doesn't work. In this case we'll get a NULL | |
| 670 // result. There's not a lot we can do at this point, so we just bodge it! | |
| 671 LOG(ERROR) << "Your system is broken: dlsym doesn't work! This has been " | |
| 672 "reported to be caused by Nvidia's libGL. You should expect" | |
| 673 " time related functions to misbehave. " | |
| 674 "http://code.google.com/p/chromium/issues/detail?id=16800"; | |
| 675 } | |
| 676 | |
| 677 if (!g_libc_localtime) | |
| 678 g_libc_localtime = gmtime; | |
| 679 if (!g_libc_localtime_r) | |
| 680 g_libc_localtime_r = gmtime_r; | |
| 681 } | |
| 682 | |
| 683 struct tm* localtime(const time_t* timep) { | |
| 684 if (g_am_zygote_or_renderer) { | |
| 685 static struct tm time_struct; | |
| 686 static char timezone_string[64]; | |
| 687 ProxyLocaltimeCallToBrowser(*timep, &time_struct, timezone_string, | |
| 688 sizeof(timezone_string)); | |
| 689 return &time_struct; | |
| 690 } else { | |
| 691 CHECK_EQ(0, pthread_once(&g_libc_localtime_funcs_guard, | |
| 692 InitLibcLocaltimeFunctions)); | |
| 693 return g_libc_localtime(timep); | |
| 694 } | |
| 695 } | |
| 696 | |
| 697 struct tm* localtime_r(const time_t* timep, struct tm* result) { | |
| 698 if (g_am_zygote_or_renderer) { | |
| 699 ProxyLocaltimeCallToBrowser(*timep, result, NULL, 0); | |
| 700 return result; | |
| 701 } else { | |
| 702 CHECK_EQ(0, pthread_once(&g_libc_localtime_funcs_guard, | |
| 703 InitLibcLocaltimeFunctions)); | |
| 704 return g_libc_localtime_r(timep, result); | |
| 705 } | |
| 706 } | |
| 707 | |
| 708 // TODO(sergeyu): Currently this code doesn't work properly under ASAN | |
| 709 // - it crashes content_unittests. Make sure it works properly and | |
| 710 // enable it here. http://crbug.com/123263 | |
| 711 #if !defined(ADDRESS_SANITIZER) | |
| 712 | |
| 713 static void InitLibcFileIOFunctions() { | |
| 714 g_libc_fopen = reinterpret_cast<FopenFunction>( | |
| 715 dlsym(RTLD_NEXT, "fopen")); | |
| 716 g_libc_fopen64 = reinterpret_cast<FopenFunction>( | |
| 717 dlsym(RTLD_NEXT, "fopen64")); | |
| 718 | |
| 719 if (!g_libc_fopen) { | |
| 720 LOG(FATAL) << "Failed to get fopen() from libc."; | |
| 721 } else if (!g_libc_fopen64) { | |
| 722 #if !defined(OS_OPENBSD) && !defined(OS_FREEBSD) | |
| 723 LOG(WARNING) << "Failed to get fopen64() from libc. Using fopen() instead."; | |
| 724 #endif // !defined(OS_OPENBSD) && !defined(OS_FREEBSD) | |
| 725 g_libc_fopen64 = g_libc_fopen; | |
| 726 } | |
| 727 | |
| 728 // TODO(sergeyu): This works only on systems with glibc. Fix it to | |
| 729 // work properly on other systems if necessary. | |
| 730 g_libc_xstat = reinterpret_cast<XstatFunction>( | |
| 731 dlsym(RTLD_NEXT, "__xstat")); | |
| 732 g_libc_xstat64 = reinterpret_cast<Xstat64Function>( | |
| 733 dlsym(RTLD_NEXT, "__xstat64")); | |
| 734 | |
| 735 if (!g_libc_xstat) { | |
| 736 LOG(FATAL) << "Failed to get __xstat() from libc."; | |
| 737 } | |
| 738 if (!g_libc_xstat64) { | |
| 739 LOG(WARNING) << "Failed to get __xstat64() from libc."; | |
| 740 } | |
| 741 } | |
| 742 | |
| 743 // fopen() and fopen64() are intercepted here so that NSS can open | |
| 744 // /dev/urandom to seed its random number generator. NSS is used by | |
| 745 // remoting in the sendbox. | |
| 746 | |
| 747 // fopen() call may be redirected to fopen64() in stdio.h using | |
| 748 // __REDIRECT(), which sets asm name for fopen() to "fopen64". This | |
| 749 // means that we cannot override fopen() directly here. Instead the | |
| 750 // the code below defines fopen_override() function with asm name | |
| 751 // "fopen", so that all references to fopen() will resolve to this | |
| 752 // function. | |
| 753 __attribute__ ((__visibility__("default"))) | |
| 754 FILE* fopen_override(const char* path, const char* mode) __asm__ ("fopen"); | |
| 755 | |
| 756 __attribute__ ((__visibility__("default"))) | |
| 757 FILE* fopen_override(const char* path, const char* mode) { | |
| 758 if (g_am_zygote_or_renderer && strcmp(path, kUrandomDevPath) == 0) { | |
| 759 int fd = HANDLE_EINTR(dup(GetUrandomFD())); | |
| 760 if (fd < 0) { | |
| 761 PLOG(ERROR) << "dup() failed."; | |
| 762 return NULL; | |
| 763 } | |
| 764 return fdopen(fd, mode); | |
| 765 } else { | |
| 766 CHECK_EQ(0, pthread_once(&g_libc_file_io_funcs_guard, | |
| 767 InitLibcFileIOFunctions)); | |
| 768 return g_libc_fopen(path, mode); | |
| 769 } | |
| 770 } | |
| 771 | |
| 772 __attribute__ ((__visibility__("default"))) | |
| 773 FILE* fopen64(const char* path, const char* mode) { | |
| 774 if (g_am_zygote_or_renderer && strcmp(path, kUrandomDevPath) == 0) { | |
| 775 int fd = HANDLE_EINTR(dup(GetUrandomFD())); | |
| 776 if (fd < 0) { | |
| 777 PLOG(ERROR) << "dup() failed."; | |
| 778 return NULL; | |
| 779 } | |
| 780 return fdopen(fd, mode); | |
| 781 } else { | |
| 782 CHECK_EQ(0, pthread_once(&g_libc_file_io_funcs_guard, | |
| 783 InitLibcFileIOFunctions)); | |
| 784 return g_libc_fopen64(path, mode); | |
| 785 } | |
| 786 } | |
| 787 | |
| 788 // stat() is subject to the same problem as fopen(), so we have to use | |
| 789 // the same trick to override it. | |
| 790 __attribute__ ((__visibility__("default"))) | |
| 791 int xstat_override(int version, | |
| 792 const char *path, | |
| 793 struct stat *buf) __asm__ ("__xstat"); | |
| 794 | |
| 795 __attribute__ ((__visibility__("default"))) | |
| 796 int xstat_override(int version, const char *path, struct stat *buf) { | |
| 797 if (g_am_zygote_or_renderer && strcmp(path, kUrandomDevPath) == 0) { | |
| 798 int result = __fxstat(version, GetUrandomFD(), buf); | |
| 799 return result; | |
| 800 } else { | |
| 801 CHECK_EQ(0, pthread_once(&g_libc_file_io_funcs_guard, | |
| 802 InitLibcFileIOFunctions)); | |
| 803 return g_libc_xstat(version, path, buf); | |
| 804 } | |
| 805 } | |
| 806 | |
| 807 __attribute__ ((__visibility__("default"))) | |
| 808 int xstat64_override(int version, | |
| 809 const char *path, | |
| 810 struct stat64 *buf) __asm__ ("__xstat64"); | |
| 811 | |
| 812 __attribute__ ((__visibility__("default"))) | |
| 813 int xstat64_override(int version, const char *path, struct stat64 *buf) { | |
| 814 if (g_am_zygote_or_renderer && strcmp(path, kUrandomDevPath) == 0) { | |
| 815 int result = __fxstat64(version, GetUrandomFD(), buf); | |
| 816 return result; | |
| 817 } else { | |
| 818 CHECK_EQ(0, pthread_once(&g_libc_file_io_funcs_guard, | |
| 819 InitLibcFileIOFunctions)); | |
| 820 CHECK(g_libc_xstat64); | |
| 821 return g_libc_xstat64(version, path, buf); | |
| 822 } | |
| 823 } | |
| 824 | |
| 825 #endif // !ADDRESS_SANITIZER | |
| 826 | |
| 827 #endif // !CHROMIUM_SELINUX | |
| 828 | |
| 829 // This function triggers the static and lazy construction of objects that need | |
| 830 // to be created before imposing the sandbox. | |
| 831 static void PreSandboxInit() { | |
| 832 base::RandUint64(); | |
| 833 | |
| 834 base::SysInfo::MaxSharedMemorySize(); | |
| 835 | |
| 836 // ICU DateFormat class (used in base/time_format.cc) needs to get the | |
| 837 // Olson timezone ID by accessing the zoneinfo files on disk. After | |
| 838 // TimeZone::createDefault is called once here, the timezone ID is | |
| 839 // cached and there's no more need to access the file system. | |
| 840 scoped_ptr<icu::TimeZone> zone(icu::TimeZone::createDefault()); | |
| 841 | |
| 842 #if defined(USE_NSS) | |
| 843 // NSS libraries are loaded before sandbox is activated. This is to allow | |
| 844 // successful initialization of NSS which tries to load extra library files. | |
| 845 crypto::LoadNSSLibraries(); | |
| 846 #elif defined(USE_OPENSSL) | |
| 847 // OpenSSL is intentionally not supported in the sandboxed processes, see | |
| 848 // http://crbug.com/99163. If that ever changes we'll likely need to init | |
| 849 // OpenSSL here (at least, load the library and error strings). | |
| 850 #else | |
| 851 // It's possible that another hypothetical crypto stack would not require | |
| 852 // pre-sandbox init, but more likely this is just a build configuration error. | |
| 853 #error Which SSL library are you using? | |
| 854 #endif | |
| 855 | |
| 856 // Ensure access to the Pepper plugins before the sandbox is turned on. | |
| 857 PepperPluginRegistry::PreloadModules(); | |
| 858 } | |
| 859 | |
| 860 #if !defined(CHROMIUM_SELINUX) | |
| 861 static bool EnterSandbox() { | |
| 862 PreSandboxInit(); | |
| 863 SkiaFontConfigSetImplementation( | |
| 864 new FontConfigIPC(kMagicSandboxIPCDescriptor)); | |
| 865 | |
| 866 // The SUID sandbox sets this environment variable to a file descriptor | |
| 867 // over which we can signal that we have completed our startup and can be | |
| 868 // chrooted. | |
| 869 const char* const sandbox_fd_string = getenv("SBX_D"); | |
| 870 | |
| 871 if (sandbox_fd_string) { | |
| 872 // Use the SUID sandbox. This still allows the seccomp sandbox to | |
| 873 // be enabled by the process later. | |
| 874 g_suid_sandbox_active = true; | |
| 875 | |
| 876 char* endptr; | |
| 877 const long fd_long = strtol(sandbox_fd_string, &endptr, 10); | |
| 878 if (!*sandbox_fd_string || *endptr || fd_long < 0 || fd_long > INT_MAX) | |
| 879 return false; | |
| 880 const int fd = fd_long; | |
| 881 | |
| 882 static const char kMsgChrootMe = 'C'; | |
| 883 static const char kMsgChrootSuccessful = 'O'; | |
| 884 | |
| 885 if (HANDLE_EINTR(write(fd, &kMsgChrootMe, 1)) != 1) { | |
| 886 LOG(ERROR) << "Failed to write to chroot pipe: " << errno; | |
| 887 return false; | |
| 888 } | |
| 889 | |
| 890 // We need to reap the chroot helper process in any event: | |
| 891 wait(NULL); | |
| 892 | |
| 893 char reply; | |
| 894 if (HANDLE_EINTR(read(fd, &reply, 1)) != 1) { | |
| 895 LOG(ERROR) << "Failed to read from chroot pipe: " << errno; | |
| 896 return false; | |
| 897 } | |
| 898 | |
| 899 if (reply != kMsgChrootSuccessful) { | |
| 900 LOG(ERROR) << "Error code reply from chroot helper"; | |
| 901 return false; | |
| 902 } | |
| 903 | |
| 904 #if !defined(OS_OPENBSD) | |
| 905 // Previously, we required that the binary be non-readable. This causes the | |
| 906 // kernel to mark the process as non-dumpable at startup. The thinking was | |
| 907 // that, although we were putting the renderers into a PID namespace (with | |
| 908 // the SUID sandbox), they would nonetheless be in the /same/ PID | |
| 909 // namespace. So they could ptrace each other unless they were non-dumpable. | |
| 910 // | |
| 911 // If the binary was readable, then there would be a window between process | |
| 912 // startup and the point where we set the non-dumpable flag in which a | |
| 913 // compromised renderer could ptrace attach. | |
| 914 // | |
| 915 // However, now that we have a zygote model, only the (trusted) zygote | |
| 916 // exists at this point and we can set the non-dumpable flag which is | |
| 917 // inherited by all our renderer children. | |
| 918 // | |
| 919 // Note: a non-dumpable process can't be debugged. To debug sandbox-related | |
| 920 // issues, one can specify --allow-sandbox-debugging to let the process be | |
| 921 // dumpable. | |
| 922 const CommandLine& command_line = *CommandLine::ForCurrentProcess(); | |
| 923 if (!command_line.HasSwitch(switches::kAllowSandboxDebugging)) { | |
| 924 prctl(PR_SET_DUMPABLE, 0, 0, 0, 0); | |
| 925 if (prctl(PR_GET_DUMPABLE, 0, 0, 0, 0)) { | |
| 926 LOG(ERROR) << "Failed to set non-dumpable flag"; | |
| 927 return false; | |
| 928 } | |
| 929 } | |
| 930 #endif | |
| 931 } | |
| 932 | |
| 933 return true; | |
| 934 } | |
| 935 #else // CHROMIUM_SELINUX | |
| 936 | |
| 937 static bool EnterSandbox() { | |
| 938 PreSandboxInit(); | |
| 939 SkiaFontConfigSetImplementation( | |
| 940 new FontConfigIPC(kMagicSandboxIPCDescriptor)); | |
| 941 return true; | |
| 942 } | |
| 943 | |
| 944 #endif // CHROMIUM_SELINUX | |
| 945 | |
| 946 bool ZygoteMain(const content::MainFunctionParams& params, | |
| 947 content::ZygoteForkDelegate* forkdelegate) { | |
| 948 #if !defined(CHROMIUM_SELINUX) | |
| 949 g_am_zygote_or_renderer = true; | |
| 950 #endif | |
| 951 | |
| 952 #if defined(SECCOMP_SANDBOX) | |
| 953 if (SeccompSandboxEnabled()) { | |
| 954 // The seccomp sandbox needs access to files in /proc, which might be denied | |
| 955 // after one of the other sandboxes have been started. So, obtain a suitable | |
| 956 // file handle in advance. | |
| 957 g_proc_fd = open("/proc", O_DIRECTORY | O_RDONLY); | |
| 958 if (g_proc_fd < 0) { | |
| 959 LOG(ERROR) << "WARNING! Cannot access \"/proc\". Disabling seccomp " | |
| 960 "sandboxing."; | |
| 961 } | |
| 962 } | |
| 963 #endif // SECCOMP_SANDBOX | |
| 964 | |
| 965 if (forkdelegate != NULL) { | |
| 966 VLOG(1) << "ZygoteMain: initializing fork delegate"; | |
| 967 forkdelegate->Init(getenv("SBX_D") != NULL, // g_suid_sandbox_active, | |
| 968 kBrowserDescriptor, | |
| 969 kMagicSandboxIPCDescriptor); | |
| 970 } else { | |
| 971 VLOG(1) << "ZygoteMain: fork delegate is NULL"; | |
| 972 } | |
| 973 | |
| 974 // Turn on the SELinux or SUID sandbox | |
| 975 if (!EnterSandbox()) { | |
| 976 LOG(FATAL) << "Failed to enter sandbox. Fail safe abort. (errno: " | |
| 977 << errno << ")"; | |
| 978 return false; | |
| 979 } | |
| 980 | |
| 981 int sandbox_flags = 0; | |
| 982 if (getenv("SBX_D")) | |
| 983 sandbox_flags |= ZygoteHostImpl::kSandboxSUID; | |
| 984 if (getenv("SBX_PID_NS")) | |
| 985 sandbox_flags |= ZygoteHostImpl::kSandboxPIDNS; | |
| 986 if (getenv("SBX_NET_NS")) | |
| 987 sandbox_flags |= ZygoteHostImpl::kSandboxNetNS; | |
| 988 | |
| 989 #if defined(SECCOMP_SANDBOX) | |
| 990 // The seccomp sandbox will be turned on when the renderers start. But we can | |
| 991 // already check if sufficient support is available so that we only need to | |
| 992 // print one error message for the entire browser session. | |
| 993 if (g_proc_fd >= 0 && SeccompSandboxEnabled()) { | |
| 994 if (!SupportsSeccompSandbox(g_proc_fd)) { | |
| 995 // There are a good number of users who cannot use the seccomp sandbox | |
| 996 // (e.g. because their distribution does not enable seccomp mode by | |
| 997 // default). While we would prefer to deny execution in this case, it | |
| 998 // seems more realistic to continue in degraded mode. | |
| 999 LOG(ERROR) << "WARNING! This machine lacks support needed for the " | |
| 1000 "Seccomp sandbox. Running renderers with Seccomp " | |
| 1001 "sandboxing disabled."; | |
| 1002 } else { | |
| 1003 VLOG(1) << "Enabling experimental Seccomp sandbox."; | |
| 1004 sandbox_flags |= ZygoteHostImpl::kSandboxSeccomp; | |
| 1005 } | |
| 1006 } | |
| 1007 #endif // SECCOMP_SANDBOX | |
| 1008 | |
| 1009 Zygote zygote(sandbox_flags, forkdelegate); | |
| 1010 // This function call can return multiple times, once per fork(). | |
| 1011 return zygote.ProcessRequests(); | |
| 1012 } | |
| OLD | NEW |
|---|
Chromium Code Reviews
Issue 10388013:
Move the Linux zygote stuff into its own per-process directory. (Closed)
Base URL: svn://svn.chromium.org/chrome/trunk/src