OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include <sys/types.h> | 5 #include <sys/types.h> |
6 #include <sys/wait.h> | 6 #include <sys/wait.h> |
7 #include <unistd.h> | 7 #include <unistd.h> |
8 | 8 |
9 #include "base/eintr_wrapper.h" | 9 #include "base/eintr_wrapper.h" |
10 #include "base/environment.h" | 10 #include "base/environment.h" |
(...skipping 10 matching lines...) Expand all Loading... |
21 // Set an environment variable that reflects the API version we expect from the | 21 // Set an environment variable that reflects the API version we expect from the |
22 // setuid sandbox. Old versions of the sandbox will ignore this. | 22 // setuid sandbox. Old versions of the sandbox will ignore this. |
23 void SetSandboxAPIEnvironmentVariable(base::Environment* env) { | 23 void SetSandboxAPIEnvironmentVariable(base::Environment* env) { |
24 env->SetVar(sandbox::kSandboxEnvironmentApiRequest, | 24 env->SetVar(sandbox::kSandboxEnvironmentApiRequest, |
25 base::IntToString(sandbox::kSUIDSandboxApiNumber)); | 25 base::IntToString(sandbox::kSUIDSandboxApiNumber)); |
26 } | 26 } |
27 | 27 |
28 // Wrapper around a shared C function. | 28 // Wrapper around a shared C function. |
29 // Returns the "saved" environment variable name corresponding to |envvar| | 29 // Returns the "saved" environment variable name corresponding to |envvar| |
30 // in a new string or NULL. | 30 // in a new string or NULL. |
31 std::string* CreateSavedVariableName(const char* envvar) { | 31 std::string* CreateSavedVariableName(const char* env_var) { |
32 char* const saved_env_var = SandboxSavedEnvironmentVariable(envvar); | 32 char* const saved_env_var = SandboxSavedEnvironmentVariable(env_var); |
33 if (!saved_env_var) | 33 if (!saved_env_var) |
34 return NULL; | 34 return NULL; |
35 std::string* saved_env_var_copy = new std::string(saved_env_var); | 35 std::string* saved_env_var_copy = new std::string(saved_env_var); |
36 // SandboxSavedEnvironmentVariable is the C function that we wrap and uses | 36 // SandboxSavedEnvironmentVariable is the C function that we wrap and uses |
37 // malloc() to allocate memory. | 37 // malloc() to allocate memory. |
38 free(saved_env_var); | 38 free(saved_env_var); |
39 return saved_env_var_copy; | 39 return saved_env_var_copy; |
40 } | 40 } |
41 | 41 |
42 // The ELF loader will clear many environment variables so we save them to | 42 // The ELF loader will clear many environment variables so we save them to |
43 // different names here so that the SUID sandbox can resolve them for the | 43 // different names here so that the SUID sandbox can resolve them for the |
44 // renderer. | 44 // renderer. |
45 void SaveSUIDUnsafeEnvironmentVariables(base::Environment* env) { | 45 void SaveSUIDUnsafeEnvironmentVariables(base::Environment* env) { |
46 for (unsigned i = 0; kSUIDUnsafeEnvironmentVariables[i]; ++i) { | 46 for (unsigned i = 0; kSUIDUnsafeEnvironmentVariables[i]; ++i) { |
47 const char* const env_var = kSUIDUnsafeEnvironmentVariables[i]; | 47 const char* env_var = kSUIDUnsafeEnvironmentVariables[i]; |
48 // Get the saved environment variable corresponding to envvar. | 48 // Get the saved environment variable corresponding to envvar. |
49 scoped_ptr<std::string> saved_env_var(CreateSavedVariableName(env_var)); | 49 scoped_ptr<std::string> saved_env_var(CreateSavedVariableName(env_var)); |
50 if (saved_env_var == NULL) | 50 if (saved_env_var == NULL) |
51 continue; | 51 continue; |
52 | 52 |
53 std::string value; | 53 std::string value; |
54 if (env->GetVar(env_var, &value)) | 54 if (env->GetVar(env_var, &value)) |
55 env->SetVar(saved_env_var->c_str(), value); | 55 env->SetVar(saved_env_var->c_str(), value); |
56 else | 56 else |
57 env->UnSetVar(saved_env_var->c_str()); | 57 env->UnSetVar(saved_env_var->c_str()); |
(...skipping 48 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
106 SetuidSandboxClient::SetuidSandboxClient() | 106 SetuidSandboxClient::SetuidSandboxClient() |
107 : env_(NULL), | 107 : env_(NULL), |
108 sandboxed_(false) { | 108 sandboxed_(false) { |
109 } | 109 } |
110 | 110 |
111 SetuidSandboxClient::~SetuidSandboxClient() { | 111 SetuidSandboxClient::~SetuidSandboxClient() { |
112 delete env_; | 112 delete env_; |
113 } | 113 } |
114 | 114 |
115 bool SetuidSandboxClient::ChrootMe() { | 115 bool SetuidSandboxClient::ChrootMe() { |
116 int fd = GetIPCDescriptor(env_); | 116 int ipc_fd = GetIPCDescriptor(env_); |
117 | 117 |
118 if (fd < 0) { | 118 if (ipc_fd < 0) { |
119 LOG(ERROR) << "Failed to obtain the sandbox IPC descriptor"; | 119 LOG(ERROR) << "Failed to obtain the sandbox IPC descriptor"; |
120 return false; | 120 return false; |
121 } | 121 } |
122 | 122 |
123 if (HANDLE_EINTR(write(fd, &kMsgChrootMe, 1)) != 1) { | 123 if (HANDLE_EINTR(write(ipc_fd, &kMsgChrootMe, 1)) != 1) { |
124 PLOG(ERROR) << "Failed to write to chroot pipe"; | 124 PLOG(ERROR) << "Failed to write to chroot pipe"; |
125 return false; | 125 return false; |
126 } | 126 } |
127 | 127 |
128 // We need to reap the chroot helper process in any event. | 128 // We need to reap the chroot helper process in any event. |
129 pid_t helper_pid = GetHelperPID(env_); | 129 pid_t helper_pid = GetHelperPID(env_); |
130 // If helper_pid is -1 we wait for any child. | 130 // If helper_pid is -1 we wait for any child. |
131 if (waitpid(helper_pid, NULL, 0) < 0) { | 131 if (waitpid(helper_pid, NULL, 0) < 0) { |
132 PLOG(ERROR) << "Failed to wait for setuid helper to die"; | 132 PLOG(ERROR) << "Failed to wait for setuid helper to die"; |
133 return false; | 133 return false; |
134 } | 134 } |
135 | 135 |
136 char reply; | 136 char reply; |
137 if (HANDLE_EINTR(read(fd, &reply, 1)) != 1) { | 137 if (HANDLE_EINTR(read(ipc_fd, &reply, 1)) != 1) { |
138 PLOG(ERROR) << "Failed to read from chroot pipe"; | 138 PLOG(ERROR) << "Failed to read from chroot pipe"; |
139 return false; | 139 return false; |
140 } | 140 } |
141 | 141 |
142 if (reply != kMsgChrootSuccessful) { | 142 if (reply != kMsgChrootSuccessful) { |
143 LOG(ERROR) << "Error code reply from chroot helper"; | 143 LOG(ERROR) << "Error code reply from chroot helper"; |
144 return false; | 144 return false; |
145 } | 145 } |
146 | 146 |
147 // We now consider ourselves "fully sandboxed" as far as the | 147 // We now consider ourselves "fully sandboxed" as far as the |
(...skipping 21 matching lines...) Expand all Loading... |
169 bool SetuidSandboxClient::IsSandboxed() const { | 169 bool SetuidSandboxClient::IsSandboxed() const { |
170 return sandboxed_; | 170 return sandboxed_; |
171 } | 171 } |
172 | 172 |
173 void SetuidSandboxClient::SetupLaunchEnvironment() { | 173 void SetuidSandboxClient::SetupLaunchEnvironment() { |
174 SaveSUIDUnsafeEnvironmentVariables(env_); | 174 SaveSUIDUnsafeEnvironmentVariables(env_); |
175 SetSandboxAPIEnvironmentVariable(env_); | 175 SetSandboxAPIEnvironmentVariable(env_); |
176 } | 176 } |
177 | 177 |
178 } // namespace sandbox | 178 } // namespace sandbox |
| 179 |
OLD | NEW |