Start all children in their own PID namespace.

content/zygote/zygote_main_linux.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/zygote/zygote_main.h"
 
 #include <dlfcn.h>
 #include <fcntl.h>
 #include <pthread.h>
 #include <signal.h>
@@ skipping 22 matching lines @@
 #include "content/common/font_config_ipc_linux.h"
 #include "content/common/sandbox_linux/sandbox_debug_handling_linux.h"
 #include "content/common/sandbox_linux/sandbox_linux.h"
 #include "content/common/zygote_commands_linux.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/common/main_function_params.h"
 #include "content/public/common/sandbox_linux.h"
 #include "content/public/common/zygote_fork_delegate_linux.h"
 #include "content/zygote/zygote_linux.h"
 #include "crypto/nss_util.h"
+#include "sandbox/linux/services/credentials.h"
 #include "sandbox/linux/services/init_process_reaper.h"
 #include "sandbox/linux/services/libc_urandom_override.h"
 #include "sandbox/linux/services/namespace_sandbox.h"
 #include "sandbox/linux/services/thread_helpers.h"
 #include "sandbox/linux/suid/client/setuid_sandbox_client.h"
 #include "third_party/icu/source/i18n/unicode/timezone.h"
 #include "third_party/skia/include/ports/SkFontConfigInterface.h"
 
 #if defined(OS_LINUX)
 #include <sys/prctl.h>
@@ skipping 346 matching lines @@
   if (getpid() == 1) {
     // The setuid sandbox has created a new PID namespace and we need
     // to assume the role of init.
     CHECK(CreateInitProcessReaper(post_fork_parent_callback));
   }
 
   CHECK(SandboxDebugHandling::SetDumpableStatusAndHandlers());
   return true;
 }
 
+static void DropAllCapabilities(int proc_fd, base::Closure* done) {

[jln (very slow on Chromium), 2015/02/25 21:32:48]

DropAllCapabilitiesAndRun()

[jln (very slow on Chromium), 2015/02/25 21:32:49]

I don't think there is a way in base:: to make a closure from a list of
Closures, even though that's kind of what we want to do here.

Maybe just make a RunTwoClosures(Closure* one, Closure*, two) {one.Run();
two.Run();} and make a closure from that?

[rickyz (no longer on Chrome), 2015/03/21 01:35:31]

Done.

+  LOG(ERROR) << "proc_fd: " << proc_fd;

[jln (very slow on Chromium), 2015/02/25 21:32:48]

oops

[rickyz (no longer on Chrome), 2015/03/21 01:35:31]

Done.

+  CHECK(sandbox::Credentials::DropAllCapabilities(proc_fd));
+  done->Run();
+}
+
 static void EnterNamespaceSandbox(LinuxSandbox* linux_sandbox,
                                   base::Closure* post_fork_parent_callback) {
   linux_sandbox->EngageNamespaceSandbox();
 
   if (getpid() == 1) {
-    CHECK(CreateInitProcessReaper(post_fork_parent_callback));
+    base::Closure callback =
+        base::Bind(&DropAllCapabilities, linux_sandbox->proc_fd(),
+                   post_fork_parent_callback);
+    CHECK(CreateInitProcessReaper(&callback));
   }
 }
 
 #if defined(SANITIZER_COVERAGE)
 const size_t kSanitizerMaxMessageLength = 1 * 1024 * 1024;
 
 // A helper process which collects code coverage data from the renderers over a
 // socket and dumps it to a file. See http://crbug.com/336212 for discussion.
 static void SanitizerCoverageHelper(int socket_fd, int file_fd) {
   scoped_ptr<char[]> buffer(new char[kSanitizerMaxMessageLength]);
@@ skipping 170 matching lines @@
   const bool namespace_sandbox_engaged = sandbox_flags & kSandboxLinuxUserNS;
   CHECK_EQ(using_namespace_sandbox, namespace_sandbox_engaged);
 
   Zygote zygote(sandbox_flags, fork_delegates.Pass(), extra_children,
                 extra_fds);
   // This function call can return multiple times, once per fork().
   return zygote.ProcessRequests();
 }
 
 }  // namespace content