Namespace sandbox: add important security checks

components/nacl/loader/sandbox_linux/nacl_sandbox_linux.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "components/nacl/loader/sandbox_linux/nacl_sandbox_linux.h"
 
 #include <errno.h>
 #include <fcntl.h>
 #include <sys/prctl.h>
 #include <sys/stat.h>
@@ skipping 97 matching lines @@
     // the setuid sandbox model.
     CHECK(!HasOpenDirectory());
 
     // Get sandboxed.
     CHECK(setuid_sandbox_client_->ChrootMe());
     CHECK(MaybeSetProcessNonDumpable());
     CHECK(IsSandboxed());
     layer_one_enabled_ = true;
   } else if (sandbox::NamespaceSandbox::InNewUserNamespace()) {
     CHECK(sandbox::Credentials::MoveToNewUserNS());
+    // This relies on SealLayerOneSandbox() to be called later.
+    CHECK(!HasOpenDirectory());

[mdempsky, 2015/02/12 03:07:14]

This matches the ordering under IsSuidSandboxChild(), but I wonder if it would
be better to do the HasOpenDirectory() check *after* we've dropped filesystem
access?  (Also in LinuxSandbox, if appropriate.)

[jln (very slow on Chromium), 2015/02/12 03:25:28]

We actually also do that as part of the "sealing". "Sealing" checks for open
directories and then closes the /proc file descriptor.

This is mainly to fail "earlier" (maybe we could DCHECK?), but the real security
check is indeed after InitializeLayerOneSandbox() has run!

     CHECK(sandbox::Credentials::DropFileSystemAccess());
+    CHECK(IsSingleThreaded());
     CHECK(sandbox::Credentials::DropAllCapabilities());
     CHECK(IsSandboxed());
     layer_one_enabled_ = true;
   }
 }
 
 void NaClSandbox::CheckForExpectedNumberOfOpenFds() {
   // We expect to have the following FDs open:
   //  1-3) stdin, stdout, stderr.
   //  4) The /dev/urandom FD used by base::GetUrandomFD().
@@ skipping 66 matching lines @@
     static const char kNoBpfMsg[] =
         "The seccomp-bpf sandbox is not engaged for NaCl:";
     if (can_be_no_sandbox)
       LOG(ERROR) << kNoBpfMsg << kItIsDangerousMsg;
     else
       LOG(FATAL) << kNoBpfMsg << kItIsNotAllowedMsg;
   }
 }
 
 }  // namespace nacl