OLD | NEW |
---|---|
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include <dirent.h> | |
5 #include <fcntl.h> | 6 #include <fcntl.h> |
6 #include <sys/resource.h> | 7 #include <sys/resource.h> |
7 #include <sys/stat.h> | 8 #include <sys/stat.h> |
8 #include <sys/time.h> | 9 #include <sys/time.h> |
9 #include <sys/types.h> | 10 #include <sys/types.h> |
10 | 11 |
11 #include <limits> | 12 #include <limits> |
12 | 13 |
13 #include "base/bind.h" | 14 #include "base/bind.h" |
14 #include "base/callback_helpers.h" | 15 #include "base/callback_helpers.h" |
15 #include "base/command_line.h" | 16 #include "base/command_line.h" |
16 #include "base/logging.h" | 17 #include "base/logging.h" |
17 #include "base/memory/singleton.h" | 18 #include "base/memory/singleton.h" |
18 #include "base/posix/eintr_wrapper.h" | 19 #include "base/posix/eintr_wrapper.h" |
20 #include "base/strings/string_number_conversions.h" | |
19 #include "base/time/time.h" | 21 #include "base/time/time.h" |
20 #include "content/common/sandbox_linux.h" | 22 #include "content/common/sandbox_linux.h" |
21 #include "content/common/sandbox_seccomp_bpf_linux.h" | 23 #include "content/common/sandbox_seccomp_bpf_linux.h" |
22 #include "content/public/common/content_switches.h" | 24 #include "content/public/common/content_switches.h" |
23 #include "content/public/common/sandbox_linux.h" | 25 #include "content/public/common/sandbox_linux.h" |
24 #include "sandbox/linux/suid/client/setuid_sandbox_client.h" | 26 #include "sandbox/linux/suid/client/setuid_sandbox_client.h" |
25 | 27 |
26 namespace { | 28 namespace { |
27 | 29 |
28 void LogSandboxStarted(const std::string& sandbox_name) { | 30 void LogSandboxStarted(const std::string& sandbox_name) { |
(...skipping 24 matching lines...) Expand all Loading... | |
53 } | 55 } |
54 | 56 |
55 bool IsRunningTSAN() { | 57 bool IsRunningTSAN() { |
56 #if defined(THREAD_SANITIZER) | 58 #if defined(THREAD_SANITIZER) |
57 return true; | 59 return true; |
58 #else | 60 #else |
59 return false; | 61 return false; |
60 #endif | 62 #endif |
61 } | 63 } |
62 | 64 |
65 struct DIRDeleter { | |
66 void operator()(DIR* d) { | |
67 PCHECK(closedir(d) == 0); | |
68 } | |
69 }; | |
70 | |
63 } // namespace | 71 } // namespace |
64 | 72 |
65 namespace content { | 73 namespace content { |
66 | 74 |
67 LinuxSandbox::LinuxSandbox() | 75 LinuxSandbox::LinuxSandbox() |
68 : proc_fd_(-1), | 76 : proc_fd_(-1), |
69 seccomp_bpf_started_(false), | 77 seccomp_bpf_started_(false), |
70 pre_initialized_(false), | 78 pre_initialized_(false), |
71 seccomp_bpf_supported_(false), | 79 seccomp_bpf_supported_(false), |
72 setuid_sandbox_client_(sandbox::SetuidSandboxClient::Create()) { | 80 setuid_sandbox_client_(sandbox::SetuidSandboxClient::Create()) { |
(...skipping 63 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
136 if (IsRunningTSAN()) | 144 if (IsRunningTSAN()) |
137 return false; | 145 return false; |
138 // The GPU process is allowed to call InitializeSandbox() with threads for | 146 // The GPU process is allowed to call InitializeSandbox() with threads for |
139 // now, because it loads third party libraries. | 147 // now, because it loads third party libraries. |
140 if (process_type != switches::kGpuProcess) | 148 if (process_type != switches::kGpuProcess) |
141 CHECK(false) << error_message; | 149 CHECK(false) << error_message; |
142 LOG(ERROR) << error_message; | 150 LOG(ERROR) << error_message; |
143 return false; | 151 return false; |
144 } | 152 } |
145 | 153 |
154 if (linux_sandbox->HasOpenDirectories()) { | |
155 LOG(FATAL) << "InitializeSandbox() called after unexpected directories " | |
156 "have been opened- this breaks the security of the setuid " | |
157 "sandbox."; | |
158 } | |
159 | |
146 // Attempt to limit the future size of the address space of the process. | 160 // Attempt to limit the future size of the address space of the process. |
147 linux_sandbox->LimitAddressSpace(process_type); | 161 linux_sandbox->LimitAddressSpace(process_type); |
148 | 162 |
149 // First, try to enable seccomp-bpf. | 163 // First, try to enable seccomp-bpf. |
150 seccomp_bpf_started = linux_sandbox->StartSeccompBpf(process_type); | 164 seccomp_bpf_started = linux_sandbox->StartSeccompBpf(process_type); |
151 | 165 |
152 return seccomp_bpf_started; | 166 return seccomp_bpf_started; |
153 } | 167 } |
154 | 168 |
155 int LinuxSandbox::GetStatus() const { | 169 int LinuxSandbox::GetStatus() const { |
(...skipping 45 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
201 } | 215 } |
202 | 216 |
203 // At least "..", "." and the current thread should be present. | 217 // At least "..", "." and the current thread should be present. |
204 CHECK_LE(3UL, task_stat.st_nlink); | 218 CHECK_LE(3UL, task_stat.st_nlink); |
205 // Counting threads via /proc/self/task could be racy. For the purpose of | 219 // Counting threads via /proc/self/task could be racy. For the purpose of |
206 // determining if the current proces is monothreaded it works: if at any | 220 // determining if the current proces is monothreaded it works: if at any |
207 // time it becomes monothreaded, it'll stay so. | 221 // time it becomes monothreaded, it'll stay so. |
208 return task_stat.st_nlink == 3; | 222 return task_stat.st_nlink == 3; |
209 } | 223 } |
210 | 224 |
225 bool LinuxSandbox::HasOpenDirectories() { | |
226 int proc_self_fd = -1; | |
227 if (proc_fd_ >= 0) { | |
228 proc_self_fd = openat(proc_fd_, "self/fd", O_DIRECTORY | O_RDONLY); | |
229 } else { | |
230 proc_self_fd = openat(AT_FDCWD, "/proc/self/fd", O_DIRECTORY | O_RDONLY); | |
231 if (proc_self_fd < 0) { | |
jln (very slow on Chromium)
2013/11/05 03:47:28
I wonder what's happening for errno to not be ENOE
Mostyn Bramley-Moore
2013/11/05 07:11:07
Yes. I'll check this again once more before queue
| |
232 // Guess false. | |
233 return false; | |
234 } | |
235 } | |
236 CHECK_GE(proc_self_fd, 0); | |
237 | |
238 // Ownership of proc_self_fd is transferred here, it must not be closed | |
239 // or modified afterwards except via dir. | |
240 scoped_ptr<DIR, DIRDeleter> dir(fdopendir(proc_self_fd)); | |
241 CHECK(dir); | |
242 | |
243 struct dirent e; | |
244 struct dirent* de; | |
245 while (!readdir_r(dir.get(), &e, &de) && de) { | |
246 if (strcmp(e.d_name, ".") == 0 || strcmp(e.d_name, "..") == 0) | |
247 continue; | |
248 | |
249 int fd_num; | |
250 CHECK(base::StringToInt(e.d_name, &fd_num)); | |
251 if (fd_num == proc_fd_ || fd_num == proc_self_fd) { | |
252 continue; | |
253 } | |
254 | |
255 struct stat s; | |
256 // It's OK to use proc_self_fd here, fstatat won't modify it. | |
257 CHECK(fstatat(proc_self_fd, e.d_name, &s, 0) == 0); | |
258 if (S_ISDIR(s.st_mode)) { | |
259 return true; | |
260 } | |
261 } | |
262 | |
263 // No open unmanaged directories found. \o/ | |
264 return false; | |
265 } | |
266 | |
211 bool LinuxSandbox::seccomp_bpf_started() const { | 267 bool LinuxSandbox::seccomp_bpf_started() const { |
212 return seccomp_bpf_started_; | 268 return seccomp_bpf_started_; |
213 } | 269 } |
214 | 270 |
215 sandbox::SetuidSandboxClient* | 271 sandbox::SetuidSandboxClient* |
216 LinuxSandbox::setuid_sandbox_client() const { | 272 LinuxSandbox::setuid_sandbox_client() const { |
217 return setuid_sandbox_client_.get(); | 273 return setuid_sandbox_client_.get(); |
218 } | 274 } |
219 | 275 |
220 // For seccomp-bpf, we use the SandboxSeccompBpf class. | 276 // For seccomp-bpf, we use the SandboxSeccompBpf class. |
(...skipping 58 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
279 void LinuxSandbox::SealSandbox() { | 335 void LinuxSandbox::SealSandbox() { |
280 if (proc_fd_ >= 0) { | 336 if (proc_fd_ >= 0) { |
281 int ret = HANDLE_EINTR(close(proc_fd_)); | 337 int ret = HANDLE_EINTR(close(proc_fd_)); |
282 CHECK_EQ(0, ret); | 338 CHECK_EQ(0, ret); |
283 proc_fd_ = -1; | 339 proc_fd_ = -1; |
284 } | 340 } |
285 } | 341 } |
286 | 342 |
287 } // namespace content | 343 } // namespace content |
288 | 344 |
OLD | NEW |