Convert DropFileSystemAccess to use ForkWithFlags.

sandbox/linux/services/credentials.cc

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sandbox/linux/services/credentials.h"
 
 #include <errno.h>
 #include <signal.h>
 #include <stdio.h>
 #include <sys/capability.h>
 #include <sys/syscall.h>
 #include <sys/types.h>
 #include <sys/wait.h>
 #include <unistd.h>
 
 #include "base/basictypes.h"
 #include "base/bind.h"
+#include "base/files/file_path.h"
+#include "base/files/file_util.h"
 #include "base/logging.h"
 #include "base/posix/eintr_wrapper.h"
-#include "base/strings/string_number_conversions.h"
+#include "base/process/process.h"
 #include "base/template_util.h"
 #include "base/third_party/valgrind/valgrind.h"
-#include "base/threading/thread.h"
 #include "sandbox/linux/services/syscall_wrappers.h"
 
 namespace {
 
 bool IsRunningOnValgrind() { return RUNNING_ON_VALGRIND; }
 
 struct CapFreeDeleter {
   inline void operator()(cap_t cap) const {
     int ret = cap_free(cap);
     CHECK_EQ(0, ret);
@@ skipping 55 matching lines @@
   PCHECK(getresuid(&ruid, &euid, &suid) == 0);
   PCHECK(getresgid(&rgid, &egid, &sgid) == 0);
   const bool uids_are_equal = (ruid == euid) && (ruid == suid);
   const bool gids_are_equal = (rgid == egid) && (rgid == sgid);
   if (!uids_are_equal || !gids_are_equal) return false;
   if (resuid) *resuid = euid;
   if (resgid) *resgid = egid;
   return true;
 }
 
-// chroot() and chdir() to /proc/<tid>/fdinfo.
-void ChrootToThreadFdInfo(base::PlatformThreadId tid, bool* result) {
-  DCHECK(result);
-  *result = false;
-
-  static_assert((base::is_same<base::PlatformThreadId, int>::value),
-                "platform thread id should be an int");
-  const std::string current_thread_fdinfo = "/proc/" +
-      base::IntToString(tid) + "/fdinfo/";
-
-  // Make extra sure that /proc/<tid>/fdinfo is unique to the thread.
-  CHECK(0 == unshare(CLONE_FILES));
-  int chroot_ret = chroot(current_thread_fdinfo.c_str());
-  if (chroot_ret) {
-    PLOG(ERROR) << "Could not chroot";
-    return;
-  }
-
-  // CWD is essentially an implicit file descriptor, so be careful to not leave
-  // it behind.
-  PCHECK(0 == chdir("/"));
-
-  *result = true;
-  return;
-}
-
 // chroot() to an empty dir that is "safe". To be safe, it must not contain
 // any subdirectory (chroot-ing there would allow a chroot escape) and it must
 // be impossible to create an empty directory there.
 // We achieve this by doing the following:
-// 1. We create a new thread, which will create a new /proc/<tid>/ directory
-// 2. We chroot to /proc/<tid>/fdinfo/
+// 1. We create a new process sharing file system information.
+// 2. In the child, we chroot to /proc/self/fdinfo/
 // This is already "safe", since fdinfo/ does not contain another directory and
 // one cannot create another directory there.
-// 3. The thread dies
+// 3. The process dies
 // After (3) happens, the directory is not available anymore in /proc.
 bool ChrootToSafeEmptyDir() {
-  base::Thread chrooter("sandbox_chrooter");
-  if (!chrooter.Start()) return false;
-  bool is_chrooted = false;
-  chrooter.message_loop()->PostTask(FROM_HERE,
-      base::Bind(&ChrootToThreadFdInfo, chrooter.thread_id(), &is_chrooted));
-  // Make sure our task has run before committing the return value.
-  chrooter.Stop();
-  return is_chrooted;
+  // We do not use a thread because when we are in a PID namespace, we cannot
+  // easily get a handle to the /proc/tid directory for the thread (since /proc
+  // may not be aware of the PID namespace). With a process, we can just use
+  // /proc/self.
+  pid_t pid = base::ForkWithFlags(SIGCHLD | CLONE_FS, nullptr, nullptr);

[jln (very slow on Chromium), 2015/01/15 19:29:44]

This will be quite slow (we need to duplicate all the page tables), if it
becomes a problem we should consider VFORK.

[rickyz (no longer on Chrome), 2015/01/15 22:19:05]

Acknowledged. If processes being expensive ends up being an issue, we could
still use a thread along with some hacks to get the PID of the thread outside of
the namespace - the ideal solution would have been to use /proc/thread-self, but
that was unfortunately only added in 3.17.

+  PCHECK(pid != -1);
+  if (pid == 0) {
+    // Make extra sure that /proc/self/fdinfo is unique to the process.
+    RAW_CHECK(unshare(CLONE_FILES) == 0);

[jln (very slow on Chromium), 2015/01/15 19:29:44]

I don't think that this is required given that it's not a thread (and you're not
sharing CLONE_FILES in ForkWithFlags()

[rickyz (no longer on Chrome), 2015/01/15 22:19:05]

Good point, removed.

+    RAW_CHECK(chroot("/proc/self/fdinfo") == 0);
+
+    // CWD is essentially an implicit file descriptor, so be careful to not
+    // leave it behind.
+    RAW_CHECK(chdir("/") == 0);
+    _exit(0);
+  }
+
+  int status;
+  PCHECK(HANDLE_EINTR(waitpid(pid, &status, 0)) == pid);
+
+  return status == 0;
 }
 
 // CHECK() that an attempt to move to a new user namespace raised an expected
 // errno.
 void CheckCloneNewUserErrno(int error) {
   // EPERM can happen if already in a chroot. EUSERS if too many nested
   // namespaces are used. EINVAL for kernels that don't support the feature.
   // Valgrind will ENOSYS unshare().
   PCHECK(error == EPERM || error == EUSERS || error == EINVAL ||
          error == ENOSYS);
@@ skipping 82 matching lines @@
   DCHECK(GetRESIds(NULL, NULL));
   const char kGidMapFile[] = "/proc/self/gid_map";
   const char kUidMapFile[] = "/proc/self/uid_map";
   CHECK(WriteToIdMapFile(kGidMapFile, gid));
   CHECK(WriteToIdMapFile(kUidMapFile, uid));
   DCHECK(GetRESIds(NULL, NULL));
   return true;
 }
 
 bool Credentials::DropFileSystemAccess() {
-  return ChrootToSafeEmptyDir();
+  return ChrootToSafeEmptyDir() &&

[jln (very slow on Chromium), 2015/01/15 19:29:44]

If ChrootToSafeEmptyDir() succeeds, it's critical that
base::DirectoryExists(base::FilePath("/proc")); fails, or we have a pretty awful
bug.

How about a CHECK or DCHECK instead of simply returning false?

[rickyz (no longer on Chrome), 2015/01/15 22:19:05]

Done.

+         !base::DirectoryExists(base::FilePath("/proc"));
 }
 
 }  // namespace sandbox.