Linux sandbox: better APIs with /proc/ arguments

components/nacl/loader/sandbox_linux/nacl_sandbox_linux.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "components/nacl/loader/sandbox_linux/nacl_sandbox_linux.h"
 
 #include <errno.h>
 #include <fcntl.h>
 #include <sys/prctl.h>
 #include <sys/stat.h>
@@ skipping 30 matching lines @@
 // This is a poor man's check on whether we are sandboxed.
 bool IsSandboxed() {
   int proc_fd = open("/proc/self/exe", O_RDONLY);
   if (proc_fd >= 0) {
     PCHECK(0 == IGNORE_EINTR(close(proc_fd)));
     return false;
   }
   return true;
 }
 
-// Open a new file descriptor to /proc/self/task/ by using
-// |proc_fd|.
-base::ScopedFD GetProcSelfTask(int proc_fd) {
-  base::ScopedFD proc_self_task(HANDLE_EINTR(
-      openat(proc_fd, "self/task/", O_RDONLY | O_DIRECTORY | O_CLOEXEC)));
-  PCHECK(proc_self_task.is_valid());
-  return proc_self_task.Pass();
-}
-
 bool MaybeSetProcessNonDumpable() {
   const base::CommandLine& command_line =
       *base::CommandLine::ForCurrentProcess();
   if (command_line.HasSwitch(switches::kAllowSandboxDebugging)) {
     return true;
   }
 
   if (prctl(PR_SET_DUMPABLE, 0, 0, 0, 0) != 0) {
     PLOG(ERROR) << "Failed to set non-dumpable flag";
     return false;
@@ skipping 45 matching lines @@
   proc_fd_.reset(
       HANDLE_EINTR(open("/proc", O_DIRECTORY | O_RDONLY | O_CLOEXEC)));
   PCHECK(proc_fd_.is_valid());
 }
 
 NaClSandbox::~NaClSandbox() {
 }
 
 bool NaClSandbox::IsSingleThreaded() {
   CHECK(proc_fd_.is_valid());
-  base::ScopedFD proc_self_task(GetProcSelfTask(proc_fd_.get()));
-  return sandbox::ThreadHelpers::IsSingleThreaded(proc_self_task.get());
+  return sandbox::ThreadHelpers::IsSingleThreaded(proc_fd_.get());
 }
 
 bool NaClSandbox::HasOpenDirectory() {
   CHECK(proc_fd_.is_valid());
   return sandbox::ProcUtil::HasOpenDirectory(proc_fd_.get());
 }
 
 void NaClSandbox::InitializeLayerOneSandbox() {
   // Check that IsSandboxed() works. We should not be sandboxed at this point.
   CHECK(!IsSandboxed()) << "Unexpectedly sandboxed!";
 
   if (setuid_sandbox_client_->IsSuidSandboxChild()) {
     setuid_sandbox_client_->CloseDummyFile();
 
     // Make sure that no directory file descriptor is open, as it would bypass
     // the setuid sandbox model.
     CHECK(!HasOpenDirectory());
 
     // Get sandboxed.
     CHECK(setuid_sandbox_client_->ChrootMe());
     CHECK(MaybeSetProcessNonDumpable());
     CHECK(IsSandboxed());
     layer_one_enabled_ = true;
   } else if (sandbox::NamespaceSandbox::InNewUserNamespace()) {
     CHECK(sandbox::Credentials::MoveToNewUserNS());
-    // This relies on SealLayerOneSandbox() to be called later.
-    CHECK(!HasOpenDirectory());
-    CHECK(sandbox::Credentials::DropFileSystemAccess());
-    CHECK(IsSingleThreaded());
-    CHECK(sandbox::Credentials::DropAllCapabilities());
+    // This relies on SealLayerOneSandbox() to be called later since this
+    // class is keeping a file descriptor to /proc/.
+    CHECK(sandbox::Credentials::DropFileSystemAccess(proc_fd_.get()));
+    CHECK(sandbox::Credentials::DropAllCapabilities(proc_fd_.get()));
     CHECK(IsSandboxed());
     layer_one_enabled_ = true;
   }
 }
 
 void NaClSandbox::CheckForExpectedNumberOfOpenFds() {
   // We expect to have the following FDs open:
   //  1-3) stdin, stdout, stderr.
   //  4) The /dev/urandom FD used by base::GetUrandomFD().
   //  5) A dummy pipe FD used to overwrite kSandboxIPCChannel.
@@ skipping 15 matching lines @@
 
 void NaClSandbox::InitializeLayerTwoSandbox(bool uses_nonsfi_mode) {
   // seccomp-bpf only applies to the current thread, so it's critical to only
   // have a single thread running here.
   DCHECK(!layer_one_sealed_);
   CHECK(IsSingleThreaded());
   CheckForExpectedNumberOfOpenFds();
 
   RestrictAddressSpaceUsage();
 
-  base::ScopedFD proc_self_task(GetProcSelfTask(proc_fd_.get()));
-
+  // Pass proc_fd_ ownership to the BPF sandbox, which guarantees it will
+  // be closed. There is no point in keeping it around since the BPF policy
+  // will prevent its usage.
   if (uses_nonsfi_mode) {
-    layer_two_enabled_ =
-        nacl::nonsfi::InitializeBPFSandbox(proc_self_task.Pass());
+    layer_two_enabled_ = nacl::nonsfi::InitializeBPFSandbox(proc_fd_.Pass());
     layer_two_is_nonsfi_ = true;
   } else {
-    layer_two_enabled_ = nacl::InitializeBPFSandbox(proc_self_task.Pass());
+    layer_two_enabled_ = nacl::InitializeBPFSandbox(proc_fd_.Pass());
   }
 }
 
 void NaClSandbox::SealLayerOneSandbox() {
-  if (!layer_two_enabled_) {
+  if (proc_fd_.is_valid() && !layer_two_enabled_) {
     // If nothing prevents us, check that there is no superfluous directory
     // open.
     CHECK(!HasOpenDirectory());
   }
   proc_fd_.reset();
   layer_one_sealed_ = true;
 }
 
 void NaClSandbox::CheckSandboxingStateWithPolicy() {
   static const char kItIsDangerousMsg[] = " this is dangerous.";
@@ skipping 19 matching lines @@
     static const char kNoBpfMsg[] =
         "The seccomp-bpf sandbox is not engaged for NaCl:";
     if (can_be_no_sandbox)
       LOG(ERROR) << kNoBpfMsg << kItIsDangerousMsg;
     else
       LOG(FATAL) << kNoBpfMsg << kItIsNotAllowedMsg;
   }
 }
 
 }  // namespace nacl