content/browser/child_process_launcher.cc

   1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "content/browser/child_process_launcher.h"
   6
   7 #include <utility>  // For std::pair.
   8
   9 #include "base/bind.h"
  10 #include "base/command_line.h"
  11 #include "base/files/file_util.h"
  12 #include "base/files/scoped_file.h"
  13 #include "base/logging.h"
  14 #include "base/memory/scoped_ptr.h"
  15 #include "base/metrics/histogram.h"
  16 #include "base/process/process.h"
  17 #include "base/synchronization/lock.h"
  18 #include "base/threading/thread.h"
  19 #include "content/public/browser/browser_thread.h"
  20 #include "content/public/browser/content_browser_client.h"
  21 #include "content/public/common/content_descriptors.h"
  22 #include "content/public/common/content_switches.h"
  23 #include "content/public/common/result_codes.h"
  24 #include "content/public/common/sandboxed_process_launcher_delegate.h"
  25
  26 #if defined(OS_WIN)
  27 #include "base/files/file_path.h"
  28 #include "content/common/sandbox_win.h"
  29 #include "content/public/common/sandbox_init.h"
  30 #elif defined(OS_MACOSX)
  31 #include "content/browser/bootstrap_sandbox_mac.h"
  32 #include "content/browser/mach_broker_mac.h"
  33 #include "sandbox/mac/bootstrap_sandbox.h"
  34 #elif defined(OS_ANDROID)
  35 #include "base/android/jni_android.h"
  36 #include "content/browser/android/child_process_launcher_android.h"
  37 #elif defined(OS_POSIX)
  38 #include "base/memory/shared_memory.h"
  39 #include "base/memory/singleton.h"
  40 #include "content/browser/renderer_host/render_sandbox_host_linux.h"
  41 #include "content/browser/zygote_host/zygote_host_impl_linux.h"
  42 #include "content/common/child_process_sandbox_support_impl_linux.h"
  43 #endif
  44
  45 #if defined(OS_POSIX)
  46 #include "base/metrics/stats_table.h"
  47 #include "base/posix/global_descriptors.h"
  48 #endif
  49
  50 namespace content {
  51
  52 // Having the functionality of ChildProcessLauncher be in an internal
  53 // ref counted object allows us to automatically terminate the process when the
  54 // parent class destructs, while still holding on to state that we need.
  55 class ChildProcessLauncher::Context
  56     : public base::RefCountedThreadSafe<ChildProcessLauncher::Context> {
  57  public:
  58   Context()
  59       : client_(NULL),
  60         client_thread_id_(BrowserThread::UI),
  61         termination_status_(base::TERMINATION_STATUS_NORMAL_TERMINATION),
  62         exit_code_(RESULT_CODE_NORMAL_EXIT),
  63         starting_(true),
  64         // TODO(earthdok): Re-enable on CrOS http://crbug.com/360622
  65 #if (defined(ADDRESS_SANITIZER) || defined(LEAK_SANITIZER) || \
  66     defined(THREAD_SANITIZER)) && !defined(OS_CHROMEOS)
  67         terminate_child_on_shutdown_(false)
  68 #else
  69         terminate_child_on_shutdown_(true)
  70 #endif
  71 #if defined(OS_POSIX) && !defined(OS_MACOSX) && !defined(OS_ANDROID)
  72         , zygote_(false)
  73 #endif
  74         {
  75   }
  76
  77   void Launch(
  78       SandboxedProcessLauncherDelegate* delegate,
  79       base::CommandLine* cmd_line,
  80       int child_process_id,
  81       Client* client) {
  82     client_ = client;
  83
  84     CHECK(BrowserThread::GetCurrentThreadIdentifier(&client_thread_id_));
  85
  86 #if defined(OS_ANDROID)
  87     // We need to close the client end of the IPC channel to reliably detect
  88     // child termination. We will close this fd after we create the child
  89     // process which is asynchronous on Android.
  90     ipcfd_ = delegate->GetIpcFd();
  91 #endif
  92     BrowserThread::PostTask(
  93         BrowserThread::PROCESS_LAUNCHER, FROM_HERE,
  94         base::Bind(
  95             &Context::LaunchInternal,
  96             make_scoped_refptr(this),
  97             client_thread_id_,
  98             child_process_id,
  99             delegate,
 100             cmd_line));
 101   }
 102
 103 #if defined(OS_ANDROID)
 104   static void OnChildProcessStarted(
 105       // |this_object| is NOT thread safe. Only use it to post a task back.
 106       scoped_refptr<Context> this_object,
 107       BrowserThread::ID client_thread_id,
 108       const base::TimeTicks begin_launch_time,
 109       base::ProcessHandle handle) {
 110     RecordHistograms(begin_launch_time);
 111     if (BrowserThread::CurrentlyOn(client_thread_id)) {
 112       // This is always invoked on the UI thread which is commonly the
 113       // |client_thread_id| so we can shortcut one PostTask.
 114       this_object->Notify(handle);
 115     } else {
 116       BrowserThread::PostTask(
 117           client_thread_id, FROM_HERE,
 118           base::Bind(
 119               &ChildProcessLauncher::Context::Notify,
 120               this_object,
 121               handle));
 122     }
 123   }
 124 #endif
 125
 126   void ResetClient() {
 127     // No need for locking as this function gets called on the same thread that
 128     // client_ would be used.
 129     CHECK(BrowserThread::CurrentlyOn(client_thread_id_));
 130     client_ = NULL;
 131   }
 132
 133   void set_terminate_child_on_shutdown(bool terminate_on_shutdown) {
 134     terminate_child_on_shutdown_ = terminate_on_shutdown;
 135   }
 136
 137  private:
 138   friend class base::RefCountedThreadSafe<ChildProcessLauncher::Context>;
 139   friend class ChildProcessLauncher;
 140
 141   ~Context() {
 142     Terminate();
 143   }
 144
 145   static void RecordHistograms(const base::TimeTicks begin_launch_time) {
 146     base::TimeDelta launch_time = base::TimeTicks::Now() - begin_launch_time;
 147     if (BrowserThread::CurrentlyOn(BrowserThread::PROCESS_LAUNCHER)) {
 148       RecordLaunchHistograms(launch_time);
 149     } else {
 150       BrowserThread::PostTask(
 151           BrowserThread::PROCESS_LAUNCHER, FROM_HERE,
 152           base::Bind(&ChildProcessLauncher::Context::RecordLaunchHistograms,
 153                      launch_time));
 154     }
 155   }
 156
 157   static void RecordLaunchHistograms(const base::TimeDelta launch_time) {
 158     // Log the launch time, separating out the first one (which will likely be
 159     // slower due to the rest of the browser initializing at the same time).
 160     static bool done_first_launch = false;
 161     if (done_first_launch) {
 162       UMA_HISTOGRAM_TIMES("MPArch.ChildProcessLaunchSubsequent", launch_time);
 163     } else {
 164       UMA_HISTOGRAM_TIMES("MPArch.ChildProcessLaunchFirst", launch_time);
 165       done_first_launch = true;
 166     }
 167   }
 168
 169   static void LaunchInternal(
 170       // |this_object| is NOT thread safe. Only use it to post a task back.
 171       scoped_refptr<Context> this_object,
 172       BrowserThread::ID client_thread_id,
 173       int child_process_id,
 174       SandboxedProcessLauncherDelegate* delegate,
 175       base::CommandLine* cmd_line) {
 176     scoped_ptr<SandboxedProcessLauncherDelegate> delegate_deleter(delegate);
 177 #if defined(OS_WIN)
 178     bool launch_elevated = delegate->ShouldLaunchElevated();
 179 #elif defined(OS_ANDROID)
 180     int ipcfd = delegate->GetIpcFd();
 181 #elif defined(OS_MACOSX)
 182     base::EnvironmentMap env = delegate->GetEnvironment();
 183     int ipcfd = delegate->GetIpcFd();
 184 #elif defined(OS_POSIX)
 185     bool use_zygote = delegate->ShouldUseZygote();
 186     base::EnvironmentMap env = delegate->GetEnvironment();
 187     int ipcfd = delegate->GetIpcFd();
 188 #endif
 189     scoped_ptr<base::CommandLine> cmd_line_deleter(cmd_line);
 190     base::TimeTicks begin_launch_time = base::TimeTicks::Now();
 191
 192 #if defined(OS_WIN)
 193     base::ProcessHandle handle = base::kNullProcessHandle;
 194     if (launch_elevated) {
 195       base::LaunchOptions options;
 196       options.start_hidden = true;
 197       base::LaunchElevatedProcess(*cmd_line, options, &handle);
 198     } else {
 199       handle = StartSandboxedProcess(delegate, cmd_line);
 200     }
 201 #elif defined(OS_POSIX)
 202     std::string process_type =
 203         cmd_line->GetSwitchValueASCII(switches::kProcessType);
 204     std::vector<FileDescriptorInfo> files_to_register;
 205     files_to_register.push_back(
 206         FileDescriptorInfo(kPrimaryIPCChannel,
 207                            base::FileDescriptor(ipcfd, false)));
 208     base::StatsTable* stats_table = base::StatsTable::current();
 209     if (stats_table &&
 210         base::SharedMemory::IsHandleValid(
 211             stats_table->GetSharedMemoryHandle())) {
 212       files_to_register.push_back(
 213           FileDescriptorInfo(kStatsTableSharedMemFd,
 214                              stats_table->GetSharedMemoryHandle()));
 215     }
 216 #endif
 217
 218 #if defined(OS_ANDROID)
 219     // Android WebView runs in single process, ensure that we never get here
 220     // when running in single process mode.
 221     CHECK(!cmd_line->HasSwitch(switches::kSingleProcess));
 222
 223     GetContentClient()->browser()->
 224         GetAdditionalMappedFilesForChildProcess(*cmd_line, child_process_id,
 225                                                 &files_to_register);
 226
 227     StartChildProcess(cmd_line->argv(), child_process_id, files_to_register,
 228         base::Bind(&ChildProcessLauncher::Context::OnChildProcessStarted,
 229                    this_object, client_thread_id, begin_launch_time));
 230
 231 #elif defined(OS_POSIX)
 232     base::ProcessHandle handle = base::kNullProcessHandle;
 233     // We need to close the client end of the IPC channel to reliably detect
 234     // child termination.
 235     base::ScopedFD ipcfd_closer(ipcfd);
 236
 237 #if !defined(OS_MACOSX)
 238     GetContentClient()->browser()->
 239         GetAdditionalMappedFilesForChildProcess(*cmd_line, child_process_id,
 240                                                 &files_to_register);
 241     if (use_zygote) {
 242       handle = ZygoteHostImpl::GetInstance()->ForkRequest(cmd_line->argv(),
 243                                                           files_to_register,
 244                                                           process_type);
 245     } else
 246     // Fall through to the normal posix case below when we're not zygoting.
 247 #endif  // !defined(OS_MACOSX)
 248     {
 249       // Convert FD mapping to FileHandleMappingVector
 250       base::FileHandleMappingVector fds_to_map;
 251       for (size_t i = 0; i < files_to_register.size(); ++i) {
 252         fds_to_map.push_back(std::make_pair(
 253             files_to_register[i].fd.fd,
 254             files_to_register[i].id +
 255                 base::GlobalDescriptors::kBaseDescriptor));
 256       }
 257
 258 #if !defined(OS_MACOSX)
 259       if (process_type == switches::kRendererProcess) {
 260         const int sandbox_fd =
 261             RenderSandboxHostLinux::GetInstance()->GetRendererSocket();
 262         fds_to_map.push_back(std::make_pair(
 263             sandbox_fd,
 264             GetSandboxFD()));
 265       }
 266 #endif  // defined(OS_MACOSX)
 267
 268       // Actually launch the app.
 269       base::LaunchOptions options;
 270       options.environ = env;
 271       options.fds_to_remap = &fds_to_map;
 272
 273 #if defined(OS_MACOSX)
 274       // Hold the MachBroker lock for the duration of LaunchProcess. The child
 275       // will send its task port to the parent almost immediately after startup.
 276       // The Mach message will be delivered to the parent, but updating the
 277       // record of the launch will wait until after the placeholder PID is
 278       // inserted below. This ensures that while the child process may send its
 279       // port to the parent prior to the parent leaving LaunchProcess, the
 280       // order in which the record in MachBroker is updated is correct.
 281       MachBroker* broker = MachBroker::GetInstance();
 282       broker->GetLock().Acquire();
 283
 284       // Make sure the MachBroker is running, and inform it to expect a
 285       // check-in from the new process.
 286       broker->EnsureRunning();
 287
 288       const int bootstrap_sandbox_policy = delegate->GetSandboxType();
 289       if (ShouldEnableBootstrapSandbox() &&
 290           bootstrap_sandbox_policy != SANDBOX_TYPE_INVALID) {
 291         options.replacement_bootstrap_name =
 292             GetBootstrapSandbox()->server_bootstrap_name();
 293         GetBootstrapSandbox()->PrepareToForkWithPolicy(
 294             bootstrap_sandbox_policy);
 295       }
 296 #endif  // defined(OS_MACOSX)
 297
 298       bool launched = base::LaunchProcess(*cmd_line, options, &handle);
 299       if (!launched)
 300         handle = base::kNullProcessHandle;
 301
 302 #if defined(OS_MACOSX)
 303       if (ShouldEnableBootstrapSandbox() &&
 304           bootstrap_sandbox_policy != SANDBOX_TYPE_INVALID) {
 305         GetBootstrapSandbox()->FinishedFork(handle);
 306       }
 307
 308       if (launched)
 309         broker->AddPlaceholderForPid(handle);
 310
 311       // After updating the broker, release the lock and let the child's
 312       // messasge be processed on the broker's thread.
 313       broker->GetLock().Release();
 314 #endif  // defined(OS_MACOSX)
 315     }
 316 #endif  // else defined(OS_POSIX)
 317 #if !defined(OS_ANDROID)
 318   if (handle)
 319     RecordHistograms(begin_launch_time);
 320   BrowserThread::PostTask(
 321       client_thread_id, FROM_HERE,
 322       base::Bind(
 323           &Context::Notify,
 324           this_object.get(),
 325 #if defined(OS_POSIX) && !defined(OS_MACOSX)
 326           use_zygote,
 327 #endif
 328           handle));
 329 #endif  // !defined(OS_ANDROID)
 330   }
 331
 332   void Notify(
 333 #if defined(OS_POSIX) && !defined(OS_MACOSX) && !defined(OS_ANDROID)
 334       bool zygote,
 335 #endif
 336       base::ProcessHandle handle) {
 337 #if defined(OS_ANDROID)
 338     // Finally close the ipcfd
 339     base::ScopedFD ipcfd_closer(ipcfd_);
 340 #endif
 341     starting_ = false;
 342     process_.set_handle(handle);
 343     if (!handle)
 344       LOG(ERROR) << "Failed to launch child process";
 345
 346 #if defined(OS_POSIX) && !defined(OS_MACOSX) && !defined(OS_ANDROID)
 347     zygote_ = zygote;
 348 #endif
 349     if (client_) {
 350       if (handle) {
 351         client_->OnProcessLaunched();
 352       } else {
 353         client_->OnProcessLaunchFailed();
 354       }
 355     } else {
 356       Terminate();
 357     }
 358   }
 359
 360   void Terminate() {
 361     if (!process_.handle())
 362       return;
 363
 364     if (!terminate_child_on_shutdown_)
 365       return;
 366
 367     // On Posix, EnsureProcessTerminated can lead to 2 seconds of sleep!  So
 368     // don't this on the UI/IO threads.
 369     BrowserThread::PostTask(
 370         BrowserThread::PROCESS_LAUNCHER, FROM_HERE,
 371         base::Bind(
 372             &Context::TerminateInternal,
 373 #if defined(OS_POSIX) && !defined(OS_MACOSX) && !defined(OS_ANDROID)
 374             zygote_,
 375 #endif
 376             process_.handle()));
 377     process_.set_handle(base::kNullProcessHandle);
 378   }
 379
 380   static void SetProcessBackgrounded(base::ProcessHandle handle,
 381                                      bool background) {
 382     base::Process process(handle);
 383     process.SetProcessBackgrounded(background);
 384 #if defined(OS_ANDROID)
 385     SetChildProcessInForeground(handle, !background);
 386 #endif
 387   }
 388
 389   static void TerminateInternal(
 390 #if defined(OS_POSIX) && !defined(OS_MACOSX) && !defined(OS_ANDROID)
 391       bool zygote,
 392 #endif
 393       base::ProcessHandle handle) {
 394 #if defined(OS_ANDROID)
 395     VLOG(0) << "ChromeProcess: Stopping process with handle " << handle;
 396     StopChildProcess(handle);
 397 #else
 398     base::Process process(handle);
 399      // Client has gone away, so just kill the process.  Using exit code 0
 400     // means that UMA won't treat this as a crash.
 401     process.Terminate(RESULT_CODE_NORMAL_EXIT);
 402     // On POSIX, we must additionally reap the child.
 403 #if defined(OS_POSIX)
 404 #if !defined(OS_MACOSX)
 405     if (zygote) {
 406       // If the renderer was created via a zygote, we have to proxy the reaping
 407       // through the zygote process.
 408       ZygoteHostImpl::GetInstance()->EnsureProcessTerminated(handle);
 409     } else
 410 #endif  // !OS_MACOSX
 411     {
 412       base::EnsureProcessTerminated(handle);
 413     }
 414 #endif  // OS_POSIX
 415     process.Close();
 416 #endif  // defined(OS_ANDROID)
 417   }
 418
 419   Client* client_;
 420   BrowserThread::ID client_thread_id_;
 421   base::Process process_;
 422   base::TerminationStatus termination_status_;
 423   int exit_code_;
 424   bool starting_;
 425   // Controls whether the child process should be terminated on browser
 426   // shutdown. Default behavior is to terminate the child.
 427   bool terminate_child_on_shutdown_;
 428 #if defined(OS_ANDROID)
 429   // The fd to close after creating the process.
 430   int ipcfd_;
 431 #elif defined(OS_POSIX) && !defined(OS_MACOSX)
 432   bool zygote_;
 433 #endif
 434 };
 435
 436
 437 ChildProcessLauncher::ChildProcessLauncher(
 438     SandboxedProcessLauncherDelegate* delegate,
 439     base::CommandLine* cmd_line,
 440     int child_process_id,
 441     Client* client) {
 442   context_ = new Context();
 443   context_->Launch(
 444       delegate,
 445       cmd_line,
 446       child_process_id,
 447       client);
 448 }
 449
 450 ChildProcessLauncher::~ChildProcessLauncher() {
 451   context_->ResetClient();
 452 }
 453
 454 bool ChildProcessLauncher::IsStarting() {
 455   return context_->starting_;
 456 }
 457
 458 base::ProcessHandle ChildProcessLauncher::GetHandle() {
 459   DCHECK(!context_->starting_);
 460   return context_->process_.handle();
 461 }
 462
 463 base::TerminationStatus ChildProcessLauncher::GetChildTerminationStatus(
 464     bool known_dead,
 465     int* exit_code) {
 466   base::ProcessHandle handle = context_->process_.handle();
 467   if (handle == base::kNullProcessHandle) {
 468     // Process is already gone, so return the cached termination status.
 469     if (exit_code)
 470       *exit_code = context_->exit_code_;
 471     return context_->termination_status_;
 472   }
 473 #if defined(OS_POSIX) && !defined(OS_MACOSX) && !defined(OS_ANDROID)
 474   if (context_->zygote_) {
 475     context_->termination_status_ = ZygoteHostImpl::GetInstance()->
 476         GetTerminationStatus(handle, known_dead, &context_->exit_code_);
 477   } else if (known_dead) {
 478     context_->termination_status_ =
 479         base::GetKnownDeadTerminationStatus(handle, &context_->exit_code_);
 480   } else {
 481 #elif defined(OS_MACOSX)
 482   if (known_dead) {
 483     context_->termination_status_ =
 484         base::GetKnownDeadTerminationStatus(handle, &context_->exit_code_);
 485   } else {
 486 #elif defined(OS_ANDROID)
 487   if (IsChildProcessOomProtected(handle)) {
 488       context_->termination_status_ = base::TERMINATION_STATUS_OOM_PROTECTED;
 489   } else {
 490 #else
 491   {
 492 #endif
 493     context_->termination_status_ =
 494         base::GetTerminationStatus(handle, &context_->exit_code_);
 495   }
 496
 497   if (exit_code)
 498     *exit_code = context_->exit_code_;
 499
 500   // POSIX: If the process crashed, then the kernel closed the socket
 501   // for it and so the child has already died by the time we get
 502   // here. Since GetTerminationStatus called waitpid with WNOHANG,
 503   // it'll reap the process.  However, if GetTerminationStatus didn't
 504   // reap the child (because it was still running), we'll need to
 505   // Terminate via ProcessWatcher. So we can't close the handle here.
 506   if (context_->termination_status_ != base::TERMINATION_STATUS_STILL_RUNNING)
 507     context_->process_.Close();
 508
 509   return context_->termination_status_;
 510 }
 511
 512 void ChildProcessLauncher::SetProcessBackgrounded(bool background) {
 513   BrowserThread::PostTask(
 514      BrowserThread::PROCESS_LAUNCHER, FROM_HERE,
 515      base::Bind(
 516          &ChildProcessLauncher::Context::SetProcessBackgrounded,
 517          GetHandle(), background));
 518 }
 519
 520 void ChildProcessLauncher::SetTerminateChildOnShutdown(
 521     bool terminate_on_shutdown) {
 522   if (context_.get())
 523     context_->set_terminate_child_on_shutdown(terminate_on_shutdown);
 524 }
 525
 526 }  // namespace content