Setuid sandbox API versioning

sandbox/linux/suid/sandbox.c

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // http://code.google.com/p/chromium/wiki/LinuxSUIDSandbox
 
 #include "sandbox.h"
 
 #define _GNU_SOURCE
 #include <asm/unistd.h>
@@ skipping 24 matching lines @@
 
 #if !defined(CLONE_NEWPID)
 #define CLONE_NEWPID 0x20000000
 #endif
 #if !defined(CLONE_NEWNET)
 #define CLONE_NEWNET 0x40000000
 #endif
 
 static const char kSandboxDescriptorEnvironmentVarName[] = "SBX_D";
 static const char kSandboxHelperPidEnvironmentVarName[] = "SBX_HELPER_PID";
+
+// Should be kept in sync with base/linux_util.h
+static const long kSUIDSandboxApiNumber = 0;
+static const char kSandboxEnvironmentApiRequest[] = "SBX_CHROME_API_RQ";
+static const char kSandboxEnvironmentApiProvides[] = "SBX_CHROME_API_PRV";
+
 // This number must be kept in sync with common/zygote_commands_linux.h
 static const int kZygoteIdFd = 7;
 
 // These are the magic byte values which the sandboxed process uses to request
 // that it be chrooted.
 static const char kMsgChrootMe = 'C';
 static const char kMsgChrootSuccessful = 'O';
 
 static bool DropRoot();
 
@@ skipping 299 matching lines @@
       setenv(envvar, value, 1 /* overwrite */);
       unsetenv(saved_envvar);
     }
 
     free(saved_envvar);
   }
 
   return true;
 }
 
+bool CheckAndExportApiVersion() {
+  // Check the environment to see if a specific API version was requested.
+  // assume version 0 if none.
+  long api_number = -1;
+  char *api_string = getenv(kSandboxEnvironmentApiRequest);
+  if (!api_string) {
+    api_number = 0;
+  } else {
+    errno = 0;
+    char* endptr = NULL;
+    api_number = strtol(api_string, &endptr, 10);
+    if (!endptr || *endptr || errno != 0)
+      return false;
+  }
+
+  // Warn only for now.
+  if (api_number != kSUIDSandboxApiNumber) {
+    fprintf(stderr, "The setuid sandbox provides API version %ld, "
+      "but you need %ld\n"
+      "Please read "
+      "https://code.google.com/p/chromium/wiki/LinuxSUIDSandboxDevelopment."
+      "\n\n",
+      kSUIDSandboxApiNumber,
+      api_number);
+  }
+
+  // Export our version so that the sandboxed process can verify it did not
+  // use an old sandbox.
+  char version_string[64];
+  snprintf(version_string, sizeof(version_string), "%ld",
+           kSUIDSandboxApiNumber);
+  if (setenv(kSandboxEnvironmentApiProvides, version_string, 1)) {
+    perror("setenv");
+    return false;
+  }
+
+  return true;
+}
+
 int main(int argc, char **argv) {
   if (argc <= 1) {
-    if (argc == 0) {
+    if (argc <= 0) {
       return 1;
     }
 
     fprintf(stderr, "Usage: %s <renderer process> <args...>\n", argv[0]);
     return 1;
   }
 
+  // Allow someone to query our API version
+  if (argc == 2 && 0 == strcmp(argv[1], kSuidSandboxGetApiSwitch)) {
+    printf("%ld\n", kSUIDSandboxApiNumber);
+    return 0;
+  }
+
   // In the SUID sandbox, if we succeed in calling MoveToNewNamespaces()
   // below, then the zygote and all the renderers are in an alternate PID
   // namespace and do not know their real PIDs. As such, they report the wrong
   // PIDs to the task manager.
   //
   // To fix this, when the zygote spawns a new renderer, it gives the renderer
   // a dummy socket, which has a unique inode number. Then it asks the sandbox
   // host to find the PID of the process holding that fd by searching /proc.
   //
   // Since the zygote and renderers are all spawned by this setuid executable,
@@ skipping 35 matching lines @@
   if (argc == 3 && (0 == strcmp(argv[1], kAdjustLowMemMarginSwitch))) {
     char* endptr = NULL;
     errno = 0;
     unsigned long margin_mb = strtoul(argv[2], &endptr, 10);
     if (!endptr || *endptr || errno != 0)
       return 1;
     return AdjustLowMemoryMargin(margin_mb);
   }
 #endif
 
+  // Protect the core setuid sandbox functionality with an API version
+  if (!CheckAndExportApiVersion()) {
+    return 1;
+  }
+
   if (!MoveToNewNamespaces())
     return 1;
   if (!SpawnChrootHelper())
     return 1;
   if (!DropRoot())
     return 1;
   if (!SetupChildEnvironment())
     return 1;
 
   execv(argv[1], &argv[1]);
   FatalError("execv failed");
 
   return 1;
 }