Linux sandbox: change API to start the sandbox

components/nacl/loader/sandbox_linux/nacl_sandbox_linux.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "components/nacl/loader/sandbox_linux/nacl_sandbox_linux.h"
 
 #include <errno.h>
 #include <fcntl.h>
 #include <sys/stat.h>
 #include <sys/types.h>
 #include <unistd.h>
 
 #include "base/basictypes.h"
 #include "base/callback.h"
 #include "base/command_line.h"
 #include "base/compiler_specific.h"
+#include "base/files/scoped_file.h"
 #include "base/logging.h"
 #include "base/memory/scoped_ptr.h"
 #include "base/posix/eintr_wrapper.h"
 #include "build/build_config.h"
 #include "components/nacl/common/nacl_switches.h"
 #include "components/nacl/loader/nonsfi/nonsfi_sandbox.h"
 #include "components/nacl/loader/sandbox_linux/nacl_bpf_sandbox_linux.h"
+#include "sandbox/linux/seccomp-bpf/sandbox_bpf.h"
 #include "sandbox/linux/services/credentials.h"
 #include "sandbox/linux/services/thread_helpers.h"
 #include "sandbox/linux/suid/client/setuid_sandbox_client.h"
 
 namespace nacl {
 
 namespace {
 
 // This is a poor man's check on whether we are sandboxed.
 bool IsSandboxed() {
   int proc_fd = open("/proc/self/exe", O_RDONLY);
   if (proc_fd >= 0) {
     PCHECK(0 == IGNORE_EINTR(close(proc_fd)));
     return false;
   }
   return true;
 }
 
+// Open a new file descriptor to /proc/self/task/ by using
+// |proc_fd|.
+base::ScopedFD GetProcSelfTask(int proc_fd) {
+  base::ScopedFD proc_self_task(HANDLE_EINTR(
+      openat(proc_fd, "self/task/", O_RDONLY | O_DIRECTORY | O_CLOEXEC)));
+  PCHECK(proc_self_task.is_valid());
+  return proc_self_task.Pass();
+}
+
 }  // namespace
 
 NaClSandbox::NaClSandbox()
     : layer_one_enabled_(false),
       layer_one_sealed_(false),
       layer_two_enabled_(false),
       layer_two_is_nonsfi_(false),
       proc_fd_(-1),
       setuid_sandbox_client_(sandbox::SetuidSandboxClient::Create()) {
   proc_fd_.reset(
       HANDLE_EINTR(open("/proc", O_DIRECTORY | O_RDONLY | O_CLOEXEC)));
   PCHECK(proc_fd_.is_valid());
+  // Determine if the kernel supports seccomp-bpf and let it cache the
+  // result. This must be done before any sandbox is engaged.
+  sandbox::SandboxBPF::SupportsSeccompSandbox();
 }
 
 NaClSandbox::~NaClSandbox() {
 }
 
 bool NaClSandbox::IsSingleThreaded() {
   CHECK(proc_fd_.is_valid());
-  base::ScopedFD proc_self_task(HANDLE_EINTR(openat(
-      proc_fd_.get(), "self/task/", O_RDONLY | O_DIRECTORY | O_CLOEXEC)));
-  PCHECK(proc_self_task.is_valid());
+  base::ScopedFD proc_self_task(GetProcSelfTask(proc_fd_.get()));
   return sandbox::ThreadHelpers::IsSingleThreaded(proc_self_task.get());
 }
 
 bool NaClSandbox::HasOpenDirectory() {
   CHECK(proc_fd_.is_valid());
   sandbox::Credentials credentials;
   return credentials.HasOpenDirectory(proc_fd_.get());
 }
 
 void NaClSandbox::InitializeLayerOneSandbox() {
@@ skipping 33 matching lines @@
   }
 }
 
 void NaClSandbox::InitializeLayerTwoSandbox(bool uses_nonsfi_mode) {
   // seccomp-bpf only applies to the current thread, so it's critical to only
   // have a single thread running here.
   DCHECK(!layer_one_sealed_);
   CHECK(IsSingleThreaded());
   CheckForExpectedNumberOfOpenFds();
 
+  base::ScopedFD proc_self_task(GetProcSelfTask(proc_fd_.get()));
+
   if (uses_nonsfi_mode) {
-    layer_two_enabled_ = nacl::nonsfi::InitializeBPFSandbox();
+    layer_two_enabled_ =
+        nacl::nonsfi::InitializeBPFSandbox(proc_self_task.Pass());
     layer_two_is_nonsfi_ = true;
   } else {
-    layer_two_enabled_ = nacl::InitializeBPFSandbox();
+    layer_two_enabled_ = nacl::InitializeBPFSandbox(proc_self_task.Pass());
   }
 }
 
 void NaClSandbox::SealLayerOneSandbox() {
   if (!layer_two_enabled_) {
     // If nothing prevents us, check that there is no superfluous directory
     // open.
     CHECK(!HasOpenDirectory());
   }
   proc_fd_.reset();
@@ skipping 24 matching lines @@
     static const char kNoBpfMsg[] =
         "The seccomp-bpf sandbox is not engaged for NaCl:";
     if (can_be_no_sandbox)
       LOG(ERROR) << kNoBpfMsg << kItIsDangerousMsg;
     else
       LOG(FATAL) << kNoBpfMsg << kItIsNotAllowedMsg;
   }
 }
 
 }  // namespace nacl