Change the sandbox API to require passing in a copy of /proc instead of

sandbox.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sandbox_impl.h"
 
 #include "library.h"
 #include "syscall_entrypoint.h"
 #include "system_call_table.h"
 
 namespace playground {
 
 // Global variables
-int                                 Sandbox::proc_self_ = -1;
+int                                 Sandbox::proc_ = -1;
 int                                 Sandbox::proc_self_maps_ = -1;
 enum Sandbox::SandboxStatus         Sandbox::status_ = STATUS_UNKNOWN;
 int                                 Sandbox::pid_;
 int                                 Sandbox::processFdPub_;
 int                                 Sandbox::cloneFdPub_
   // This is necessary to locate the symbol from assembly code on
   // x86-64 (with %rip-relative addressing) in order for this to work
   // in relocatable code (a .so or a PIE).  On i386 this is not
   // necessary but it does not hurt.
   __attribute__((visibility("internal")));
@@ skipping 162 matching lines @@
       !sendFd(processFd, proc_self_maps, -1, NULL, 0)) {
  failure:
     die("Cannot access /proc/self/maps");
   }
   int dummy;
   if (read(sys, processFd, &dummy, sizeof(dummy)) != sizeof(dummy)) {
     goto failure;
   }
 }
 
-int Sandbox::supportsSeccompSandbox(int proc_self) {
+int Sandbox::supportsSeccompSandbox(int proc) {
   if (status_ != STATUS_UNKNOWN) {
     return status_ != STATUS_UNSUPPORTED;
   }
   int fds[2];
   SysCalls sys;
   if (sys.pipe(fds)) {
     status_ = STATUS_UNSUPPORTED;
     return 0;
   }
   pid_t pid;
   switch ((pid = sys.fork())) {
     case -1:
       status_ = STATUS_UNSUPPORTED;
       return 0;
     case 0: {
       int devnull = sys.open("/dev/null", O_RDWR, 0);
       if (devnull >= 0) {
         sys.dup2(devnull, 0);
         sys.dup2(devnull, 1);
         sys.dup2(devnull, 2);
         sys.close(devnull);
       }
-      if (proc_self >= 0) {
-        setProcSelf(sys.dup(proc_self));
+      if (proc >= 0) {
+        setProcFd(sys.dup(proc));
       }
       startSandbox();
       write(sys, fds[1], "", 1);
 
       // Try to tell the trusted thread to shut down the entire process in an
       // orderly fashion
       defaultSystemCallHandler(__NR_exit_group, 0, 0, 0, 0, 0, 0);
 
       // If that did not work (e.g. because the kernel does not know about the
       // exit_group() system call), make a direct _exit() system call instead.
@@ skipping 12 matching lines @@
       } else {
         status_ = STATUS_AVAILABLE;
       }
       int rc;
       (void)NOINTR_SYS(sys.waitpid(pid, &rc, 0));
       (void)NOINTR_SYS(sys.close(fds[0]));
       return status_ != STATUS_UNSUPPORTED;
   }
 }
 
-void Sandbox::setProcSelf(int proc_self) {
-  proc_self_ = proc_self;
+void Sandbox::setProcFd(int proc) {
+  proc_ = proc;
 }
 
 void Sandbox::startSandbox() {
   if (status_ == STATUS_UNSUPPORTED) {
     die("The seccomp sandbox is not supported on this computer");
   } else if (status_ == STATUS_ENABLED) {
     return;
   }
 
   SysCalls sys;
-  if (proc_self_ >= 0) {
-    proc_self_maps_ = sys.openat(proc_self_, "maps", O_RDONLY, 0);
-    if (NOINTR_SYS(sys.close(proc_self_))) {
-      die("Failed to close proc_self_");
+  if (proc_ >= 0) {
+    proc_self_maps_ = sys.openat(proc_, "self/maps", O_RDONLY, 0);
+    if (NOINTR_SYS(sys.close(proc_))) {
+      die("Failed to close file descriptor pointing to /proc");
     }
-    proc_self_ = -1;
+    proc_ = -1;
   }
   if (proc_self_maps_ < 0) {
     proc_self_maps_        = sys.open("/proc/self/maps", O_RDONLY, 0);
     if (proc_self_maps_ < 0) {
       die("Cannot access \"/proc/self/maps\"");
     }
   }
 
   // The pid is unchanged for the entire program, so we can retrieve it once
   // and store it in a global variable.
@@ skipping 104 matching lines @@
   } entrypoint;
   *entrypoint.get_syscall_entrypoint() = syscallEntryPointNoFrame;
 
   // We can no longer check for sandboxing support at this point, but we also
   // know for a fact that it is available (as we just turned it on). So update
   // the status to reflect this information.
   status_ = STATUS_ENABLED;
 }
 
 } // namespace