Allow using the namespace sandbox in zygote host.

content/zygote/zygote_main_linux.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/zygote/zygote_main.h"
 
 #include <dlfcn.h>
 #include <fcntl.h>
 #include <pthread.h>
 #include <signal.h>
@@ skipping 21 matching lines @@
 #include "content/common/child_process_sandbox_support_impl_linux.h"
 #include "content/common/font_config_ipc_linux.h"
 #include "content/common/sandbox_linux/sandbox_linux.h"
 #include "content/common/zygote_commands_linux.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/common/main_function_params.h"
 #include "content/public/common/sandbox_linux.h"
 #include "content/public/common/zygote_fork_delegate_linux.h"
 #include "content/zygote/zygote_linux.h"
 #include "crypto/nss_util.h"
+#include "sandbox/linux/services/credentials.h"
 #include "sandbox/linux/services/init_process_reaper.h"
 #include "sandbox/linux/services/libc_urandom_override.h"
+#include "sandbox/linux/services/namespace_sandbox.h"
 #include "sandbox/linux/suid/client/setuid_sandbox_client.h"
 #include "third_party/icu/source/i18n/unicode/timezone.h"
 #include "third_party/skia/include/ports/SkFontConfigInterface.h"
 
 #if defined(OS_LINUX)
 #include <sys/prctl.h>
 #endif
 
 #if defined(USE_OPENSSL)
 #include <openssl/rand.h>
@@ skipping 390 matching lines @@
   // startup and the point where we set the non-dumpable flag in which a
   // compromised renderer could ptrace attach.
   //
   // However, now that we have a zygote model, only the (trusted) zygote
   // exists at this point and we can set the non-dumpable flag which is
   // inherited by all our renderer children.
   //
   // Note: a non-dumpable process can't be debugged. To debug sandbox-related
   // issues, one can specify --allow-sandbox-debugging to let the process be
   // dumpable.
   const base::CommandLine& command_line =

[jln (very slow on Chromium), 2015/02/05 00:26:56]

Split to own function and use for NS sandbox as well?

[rickyz (no longer on Chrome), 2015/02/05 01:42:51]

Done.

       *base::CommandLine::ForCurrentProcess();
   if (!command_line.HasSwitch(switches::kAllowSandboxDebugging)) {
     prctl(PR_SET_DUMPABLE, 0, 0, 0, 0);
     if (prctl(PR_GET_DUMPABLE, 0, 0, 0, 0)) {
       LOG(ERROR) << "Failed to set non-dumpable flag";
       return false;
     }
   } else {
     // If sandbox debugging is allowed, install a handler for sandbox-related
     // crash testing.
     InstallSandboxCrashTestHandler();
   }
 
 #endif
 
   return true;
 }
 
+static void EnterNamespaceSandbox(base::Closure* post_fork_parent_callback) {
+  pid_t pid = getpid();

[jln (very slow on Chromium), 2015/02/05 00:26:56]

Want to sys_getpid() here, just in case?

[rickyz (no longer on Chrome), 2015/02/05 01:42:51]

Hm, I don't think there should be a way for getpid to be wrong here - this
process is freshly execed, so even if the original clone managed to poison the
pid cache, it should have been blown away at this point.

+  if (sandbox::NamespaceSandbox::InNewPidNamespace()) {
+    CHECK_EQ(1, pid);
+  }
+
+  CHECK(sandbox::Credentials::MoveToNewUserNS());
+  CHECK(sandbox::Credentials::DropFileSystemAccess());
+  // We do not drop capabilities because we will use CAP_SYS_ADMIN to place
+  // each child process in its own PID namespace later on (this is not yet
+  // implemented).

[jln (very slow on Chromium), 2015/02/05 00:26:56]

Let's drop capabilities, no? Otherwise the sandbox could be bypassed if our root
directory happened to be writeable, and it overall seems very fragile.

I think we should have a first stage where the namespace sandbox can replace the
setuid sandbox. Let's try to enable this by default and ship to users in M42!

One PID NS per renderer should come later (maybe M43).

[rickyz (no longer on Chrome), 2015/02/05 01:42:51]

Yeah, sounds reasonable to drop capabilities until separate PID namespaces is
landed. Just wanted to mention that having these capabilities does not actually
represent any extra privilege, since we are in a user namespace - an attacker
could regain these capabilities at any time using unshare(CLONE_NEWUSER).

[jln (very slow on Chromium), 2015/02/05 05:44:15]

No, it's not true. After DropFileSystemAccess(); you can't
unshare(CLONE_NEWUSER). It would be a really bad bug (and we test for it in
unittests), as it would allow to escape almost any chroot().

Keeping the capabilities around is dangerous because:

- The chroot could be escape if any subdirectory existed in it (currently that's
not the case, but relying on this weakens us)
- There is of course some attack surface associated to having extra capabilities
(new CLONE_* flags available, etc..)

[rickyz (no longer on Chrome), 2015/02/05 09:01:14]

Ah yes, you're right - I had forgotten that unshare(CLONE_NEWUSER) is no longer
allowed after a process is chrooted. Unfortunately, when we move all zygote
children into their own PID namespaces, that will require CAP_SYS_ADMIN in the
zygote. Let's discuss this some more when change comes up.

+
+  if (pid == 1) {
+    CHECK(CreateInitProcessReaper(post_fork_parent_callback));
+  }
+}
+
 #if defined(ADDRESS_SANITIZER)
 const size_t kSanitizerMaxMessageLength = 1 * 1024 * 1024;
 
 // A helper process which collects code coverage data from the renderers over a
 // socket and dumps it to a file. See http://crbug.com/336212 for discussion.
 static void SanitizerCoverageHelper(int socket_fd, int file_fd) {
   scoped_ptr<char[]> buffer(new char[kSanitizerMaxMessageLength]);
   while (true) {
     ssize_t received_size = HANDLE_EINTR(
         recv(socket_fd, buffer.get(), kSanitizerMaxMessageLength, 0));
@@ skipping 56 matching lines @@
 #if !defined(THREAD_SANITIZER)
   DCHECK(linux_sandbox->IsSingleThreaded());
 #endif
 
   sandbox::SetuidSandboxClient* setuid_sandbox =
       linux_sandbox->setuid_sandbox_client();
 
   if (is_suid_sandbox_child) {
     CHECK(EnterSuidSandbox(setuid_sandbox, post_fork_parent_callback))
         << "Failed to enter setuid sandbox";
+  } else if (sandbox::NamespaceSandbox::InNewUserNamespace()) {
+    EnterNamespaceSandbox(post_fork_parent_callback);
   }
 }
 
 bool ZygoteMain(const MainFunctionParams& params,
                 ScopedVector<ZygoteForkDelegate> fork_delegates) {
   g_am_zygote_or_renderer = true;
   sandbox::InitLibcUrandomOverrides();
 
   std::vector<int> fds_to_close_post_fork;
 
@@ skipping 81 matching lines @@
   bool setuid_sandbox_engaged = sandbox_flags & kSandboxLinuxSUID;
   CHECK_EQ(must_enable_setuid_sandbox, setuid_sandbox_engaged);
 
   Zygote zygote(sandbox_flags, fork_delegates.Pass(), extra_children,
                 extra_fds);
   // This function call can return multiple times, once per fork().
   return zygote.ProcessRequests();
 }
 
 }  // namespace content