Move a couple of utility functions to a new namespace_utils class.

sandbox/linux/services/namespace_utils.cc

+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "sandbox/linux/services/namespace_utils.h"
+
+#include <fcntl.h>
+#include <sched.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <unistd.h>
+
+#include <string>
+
+#include "base/files/file_path.h"
+#include "base/files/file_util.h"
+#include "base/files/scoped_file.h"
+#include "base/logging.h"
+#include "base/posix/eintr_wrapper.h"
+#include "base/process/launch.h"
+#include "base/strings/stringprintf.h"
+#include "base/third_party/valgrind/valgrind.h"
+
+namespace sandbox {
+
+namespace {
+bool IsRunningOnValgrind() {
+  return RUNNING_ON_VALGRIND;
+}
+}  // namespace
+
+// Write a uid or gid mapping from |id| to |id| in |map_file|.
+bool NamespaceUtils::WriteToIdMapFile(const char* map_file, generic_id_t id) {

[jln (very slow on Chromium), 2015/01/23 02:48:23]

Nit: add "// static" before the type.

[rickyz (no longer on Chrome), 2015/01/23 23:59:37]

Done.

+  base::ScopedFD fd(HANDLE_EINTR(open(map_file, O_WRONLY)));
+  if (!fd.is_valid()) {
+    return false;
+  }
+
+  const generic_id_t inside_id = id;
+  const generic_id_t outside_id = id;
+  const std::string mapping =
+      base::StringPrintf("%d %d 1\n", inside_id, outside_id);
+  const size_t len = mapping.size();
+  const ssize_t rc = HANDLE_EINTR(write(fd.get(), mapping.c_str(), len));
+  return rc == static_cast<ssize_t>(len);
+}
+
+bool NamespaceUtils::SupportsUnprivilegedNamespace(int type) {

[jln (very slow on Chromium), 2015/01/23 02:48:23]

Note: this works for kernel support, but it still doesn't tell you if switching
to a user NS will work.

The most common case where this won't work is if Chrome is run from within a
chroot().

This could be problematic, so I wonder if we should keep the previous function
(with the probe process) under a name such as CanCreateProcessInNewUserNS().

And maybe rename this one to KernelSupports*

WDYT?

[rickyz (no longer on Chrome), 2015/01/23 23:59:37]

Yeah, that makes sense. CanCreateProcessInNewUserNS will be useful for deciding
whether to fall back to the setuid sandbox, and
KernelSupportsUnprivilegedNamespace will be useful for determining CLONE_*
flags.

+  // Valgrind will let clone(2) pass-through, but doesn't support unshare(),
+  // so always consider namespaces unsupported there.
+  if (IsRunningOnValgrind()) {
+    return false;
+  }
+
+  // As of Linux 3.8, /proc/self/ns/* files exist for all namespace types. Since
+  // user namespaces were added in 3.8, it is OK to rely on the existence of
+  // /proc/self/ns/*.
+  if (!base::PathExists(base::FilePath("/proc/self/ns/user"))) {
+    return false;
+  }
+
+  const char* path;
+  switch (type) {
+    case CLONE_NEWUSER:
+      return true;
+    case CLONE_NEWIPC:
+      path = "/proc/self/ns/ipc";
+      break;
+    case CLONE_NEWNET:
+      path = "/proc/self/ns/net";
+      break;
+    case CLONE_NEWNS:
+      path = "/proc/self/ns/mnt";
+      break;
+    case CLONE_NEWPID:
+      path = "/proc/self/ns/pid";
+      break;
+    case CLONE_NEWUTS:
+      path = "/proc/self/ns/uts";
+      break;
+    default:
+      NOTREACHED();
+      return false;
+  }
+
+  return base::PathExists(base::FilePath(path));
+}
+
+}  // namespace sandbox