content/common/sandbox_linux/sandbox_linux.cc

   1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include <dirent.h>
   6 #include <fcntl.h>
   7 #include <sys/resource.h>
   8 #include <sys/stat.h>
   9 #include <sys/time.h>
  10 #include <sys/types.h>
  11 #include <unistd.h>
  12
  13 #include <limits>
  14 #include <string>
  15 #include <vector>
  16
  17 #include "base/bind.h"
  18 #include "base/callback_helpers.h"
  19 #include "base/command_line.h"
  20 #include "base/debug/stack_trace.h"
  21 #include "base/files/scoped_file.h"
  22 #include "base/logging.h"
  23 #include "base/macros.h"
  24 #include "base/memory/scoped_ptr.h"
  25 #include "base/memory/singleton.h"
  26 #include "base/posix/eintr_wrapper.h"
  27 #include "base/strings/string_number_conversions.h"
  28 #include "base/sys_info.h"
  29 #include "base/time/time.h"
  30 #include "build/build_config.h"
  31 #include "content/common/sandbox_linux/sandbox_debug_handling_linux.h"
  32 #include "content/common/sandbox_linux/sandbox_linux.h"
  33 #include "content/common/sandbox_linux/sandbox_seccomp_bpf_linux.h"
  34 #include "content/public/common/content_switches.h"
  35 #include "content/public/common/sandbox_linux.h"
  36 #include "sandbox/linux/services/credentials.h"
  37 #include "sandbox/linux/services/namespace_sandbox.h"
  38 #include "sandbox/linux/services/proc_util.h"
  39 #include "sandbox/linux/services/resource_limits.h"
  40 #include "sandbox/linux/services/thread_helpers.h"
  41 #include "sandbox/linux/services/yama.h"
  42 #include "sandbox/linux/suid/client/setuid_sandbox_client.h"
  43
  44 #if defined(ANY_OF_AMTLU_SANITIZER)
  45 #include <sanitizer/common_interface_defs.h>
  46 #endif
  47
  48 using sandbox::Yama;
  49
  50 namespace {
  51
  52 struct FDCloser {
  53   inline void operator()(int* fd) const {
  54     DCHECK(fd);
  55     PCHECK(0 == IGNORE_EINTR(close(*fd)));
  56     *fd = -1;
  57   }
  58 };
  59
  60 void LogSandboxStarted(const std::string& sandbox_name) {
  61   const base::CommandLine& command_line =
  62       *base::CommandLine::ForCurrentProcess();
  63   const std::string process_type =
  64       command_line.GetSwitchValueASCII(switches::kProcessType);
  65   const std::string activated_sandbox =
  66       "Activated " + sandbox_name + " sandbox for process type: " +
  67       process_type + ".";
  68   VLOG(1) << activated_sandbox;
  69 }
  70
  71 bool IsRunningTSAN() {
  72 #if defined(THREAD_SANITIZER)
  73   return true;
  74 #else
  75   return false;
  76 #endif
  77 }
  78
  79 // Get a file descriptor to /proc. Either duplicate |proc_fd| or try to open
  80 // it by using the filesystem directly.
  81 // TODO(jln): get rid of this ugly interface.
  82 base::ScopedFD OpenProc(int proc_fd) {
  83   int ret_proc_fd = -1;
  84   if (proc_fd >= 0) {
  85     // If a handle to /proc is available, use it. This allows to bypass file
  86     // system restrictions.
  87     ret_proc_fd =
  88         HANDLE_EINTR(openat(proc_fd, ".", O_RDONLY | O_DIRECTORY | O_CLOEXEC));
  89   } else {
  90     // Otherwise, make an attempt to access the file system directly.
  91     ret_proc_fd = HANDLE_EINTR(
  92         openat(AT_FDCWD, "/proc/", O_RDONLY | O_DIRECTORY | O_CLOEXEC));
  93   }
  94   DCHECK_LE(0, ret_proc_fd);
  95   return base::ScopedFD(ret_proc_fd);
  96 }
  97
  98 }  // namespace
  99
 100 namespace content {
 101
 102 LinuxSandbox::LinuxSandbox()
 103     : proc_fd_(-1),
 104       seccomp_bpf_started_(false),
 105       sandbox_status_flags_(kSandboxLinuxInvalid),
 106       pre_initialized_(false),
 107       seccomp_bpf_supported_(false),
 108       seccomp_bpf_with_tsync_supported_(false),
 109       yama_is_enforcing_(false),
 110       initialize_sandbox_ran_(false),
 111       setuid_sandbox_client_(sandbox::SetuidSandboxClient::Create()) {
 112   if (setuid_sandbox_client_ == NULL) {
 113     LOG(FATAL) << "Failed to instantiate the setuid sandbox client.";
 114   }
 115 #if defined(ANY_OF_AMTLU_SANITIZER)
 116   sanitizer_args_ = make_scoped_ptr(new __sanitizer_sandbox_arguments);
 117   *sanitizer_args_ = {0};
 118 #endif
 119 }
 120
 121 LinuxSandbox::~LinuxSandbox() {
 122   if (pre_initialized_) {
 123     CHECK(initialize_sandbox_ran_);
 124   }
 125 }
 126
 127 LinuxSandbox* LinuxSandbox::GetInstance() {
 128   LinuxSandbox* instance = base::Singleton<LinuxSandbox>::get();
 129   CHECK(instance);
 130   return instance;
 131 }
 132
 133 void LinuxSandbox::PreinitializeSandbox() {
 134   CHECK(!pre_initialized_);
 135   seccomp_bpf_supported_ = false;
 136 #if defined(ANY_OF_AMTLU_SANITIZER)
 137   // Sanitizers need to open some resources before the sandbox is enabled.
 138   // This should not fork, not launch threads, not open a directory.
 139   __sanitizer_sandbox_on_notify(sanitizer_args());
 140   sanitizer_args_.reset();
 141 #endif
 142
 143   // Open proc_fd_. It would break the security of the setuid sandbox if it was
 144   // not closed.
 145   // If LinuxSandbox::PreinitializeSandbox() runs, InitializeSandbox() must run
 146   // as well.
 147   proc_fd_ = HANDLE_EINTR(open("/proc", O_DIRECTORY | O_RDONLY | O_CLOEXEC));
 148   CHECK_GE(proc_fd_, 0);
 149   // We "pre-warm" the code that detects supports for seccomp BPF.
 150   if (SandboxSeccompBPF::IsSeccompBPFDesired()) {
 151     if (!SandboxSeccompBPF::SupportsSandbox()) {
 152       VLOG(1) << "Lacking support for seccomp-bpf sandbox.";
 153     } else {
 154       seccomp_bpf_supported_ = true;
 155     }
 156
 157     if (SandboxSeccompBPF::SupportsSandboxWithTsync()) {
 158       seccomp_bpf_with_tsync_supported_ = true;
 159     }
 160   }
 161
 162   // Yama is a "global", system-level status. We assume it will not regress
 163   // after startup.
 164   const int yama_status = Yama::GetStatus();
 165   yama_is_enforcing_ = (yama_status & Yama::STATUS_PRESENT) &&
 166                        (yama_status & Yama::STATUS_ENFORCING);
 167   pre_initialized_ = true;
 168 }
 169
 170 void LinuxSandbox::EngageNamespaceSandbox() {
 171   CHECK(pre_initialized_);
 172   // Check being in a new PID namespace created by the namespace sandbox and
 173   // being the init process.
 174   CHECK(sandbox::NamespaceSandbox::InNewPidNamespace());
 175   const pid_t pid = getpid();
 176   CHECK_EQ(1, pid);
 177
 178   CHECK(sandbox::Credentials::MoveToNewUserNS());
 179   // Note: this requires SealSandbox() to be called later in this process to be
 180   // safe, as this class is keeping a file descriptor to /proc/.
 181   CHECK(sandbox::Credentials::DropFileSystemAccess(proc_fd_));
 182
 183   // We do not drop CAP_SYS_ADMIN because we need it to place each child process
 184   // in its own PID namespace later on.
 185   std::vector<sandbox::Credentials::Capability> caps;
 186   caps.push_back(sandbox::Credentials::Capability::SYS_ADMIN);
 187   CHECK(sandbox::Credentials::SetCapabilities(proc_fd_, caps));
 188
 189   // This needs to happen after moving to a new user NS, since doing so involves
 190   // writing the UID/GID map.
 191   CHECK(SandboxDebugHandling::SetDumpableStatusAndHandlers());
 192 }
 193
 194 std::vector<int> LinuxSandbox::GetFileDescriptorsToClose() {
 195   std::vector<int> fds;
 196   if (proc_fd_ >= 0) {
 197     fds.push_back(proc_fd_);
 198   }
 199   return fds;
 200 }
 201
 202 bool LinuxSandbox::InitializeSandbox() {
 203   LinuxSandbox* linux_sandbox = LinuxSandbox::GetInstance();
 204   return linux_sandbox->InitializeSandboxImpl();
 205 }
 206
 207 void LinuxSandbox::StopThread(base::Thread* thread) {
 208   LinuxSandbox* linux_sandbox = LinuxSandbox::GetInstance();
 209   linux_sandbox->StopThreadImpl(thread);
 210 }
 211
 212 int LinuxSandbox::GetStatus() {
 213   if (!pre_initialized_) {
 214     return 0;
 215   }
 216   if (kSandboxLinuxInvalid == sandbox_status_flags_) {
 217     // Initialize sandbox_status_flags_.
 218     sandbox_status_flags_ = 0;
 219     if (setuid_sandbox_client_->IsSandboxed()) {
 220       sandbox_status_flags_ |= kSandboxLinuxSUID;
 221       if (setuid_sandbox_client_->IsInNewPIDNamespace())
 222         sandbox_status_flags_ |= kSandboxLinuxPIDNS;
 223       if (setuid_sandbox_client_->IsInNewNETNamespace())
 224         sandbox_status_flags_ |= kSandboxLinuxNetNS;
 225     } else if (sandbox::NamespaceSandbox::InNewUserNamespace()) {
 226       sandbox_status_flags_ |= kSandboxLinuxUserNS;
 227       if (sandbox::NamespaceSandbox::InNewPidNamespace())
 228         sandbox_status_flags_ |= kSandboxLinuxPIDNS;
 229       if (sandbox::NamespaceSandbox::InNewNetNamespace())
 230         sandbox_status_flags_ |= kSandboxLinuxNetNS;
 231     }
 232
 233     // We report whether the sandbox will be activated when renderers, workers
 234     // and PPAPI plugins go through sandbox initialization.
 235     if (seccomp_bpf_supported() &&
 236         SandboxSeccompBPF::ShouldEnableSeccompBPF(switches::kRendererProcess)) {
 237       sandbox_status_flags_ |= kSandboxLinuxSeccompBPF;
 238     }
 239
 240     if (seccomp_bpf_with_tsync_supported() &&
 241         SandboxSeccompBPF::ShouldEnableSeccompBPF(switches::kRendererProcess)) {
 242       sandbox_status_flags_ |= kSandboxLinuxSeccompTSYNC;
 243     }
 244
 245     if (yama_is_enforcing_) {
 246       sandbox_status_flags_ |= kSandboxLinuxYama;
 247     }
 248   }
 249
 250   return sandbox_status_flags_;
 251 }
 252
 253 // Threads are counted via /proc/self/task. This is a little hairy because of
 254 // PID namespaces and existing sandboxes, so "self" must really be used instead
 255 // of using the pid.
 256 bool LinuxSandbox::IsSingleThreaded() const {
 257   base::ScopedFD proc_fd(OpenProc(proc_fd_));
 258
 259   CHECK(proc_fd.is_valid()) << "Could not count threads, the sandbox was not "
 260                             << "pre-initialized properly.";
 261
 262   const bool is_single_threaded =
 263       sandbox::ThreadHelpers::IsSingleThreaded(proc_fd.get());
 264
 265   return is_single_threaded;
 266 }
 267
 268 bool LinuxSandbox::seccomp_bpf_started() const {
 269   return seccomp_bpf_started_;
 270 }
 271
 272 sandbox::SetuidSandboxClient*
 273     LinuxSandbox::setuid_sandbox_client() const {
 274   return setuid_sandbox_client_.get();
 275 }
 276
 277 // For seccomp-bpf, we use the SandboxSeccompBPF class.
 278 bool LinuxSandbox::StartSeccompBPF(const std::string& process_type) {
 279   CHECK(!seccomp_bpf_started_);
 280   CHECK(pre_initialized_);
 281   if (seccomp_bpf_supported()) {
 282     seccomp_bpf_started_ =
 283         SandboxSeccompBPF::StartSandbox(process_type, OpenProc(proc_fd_));
 284   }
 285
 286   if (seccomp_bpf_started_) {
 287     LogSandboxStarted("seccomp-bpf");
 288   }
 289
 290   return seccomp_bpf_started_;
 291 }
 292
 293 bool LinuxSandbox::InitializeSandboxImpl() {
 294   DCHECK(!initialize_sandbox_ran_);
 295   initialize_sandbox_ran_ = true;
 296
 297   base::CommandLine* command_line = base::CommandLine::ForCurrentProcess();
 298   const std::string process_type =
 299       command_line->GetSwitchValueASCII(switches::kProcessType);
 300
 301   // We need to make absolutely sure that our sandbox is "sealed" before
 302   // returning.
 303   // Unretained() since the current object is a Singleton.
 304   base::ScopedClosureRunner sandbox_sealer(
 305       base::Bind(&LinuxSandbox::SealSandbox, base::Unretained(this)));
 306   // Make sure that this function enables sandboxes as promised by GetStatus().
 307   // Unretained() since the current object is a Singleton.
 308   base::ScopedClosureRunner sandbox_promise_keeper(
 309       base::Bind(&LinuxSandbox::CheckForBrokenPromises,
 310                  base::Unretained(this),
 311                  process_type));
 312
 313   // No matter what, it's always an error to call InitializeSandbox() after
 314   // threads have been created.
 315   if (!IsSingleThreaded()) {
 316     std::string error_message = "InitializeSandbox() called with multiple "
 317                                 "threads in process " + process_type;
 318     // TSAN starts a helper thread, so we don't start the sandbox and don't
 319     // even report an error about it.
 320     if (IsRunningTSAN())
 321       return false;
 322
 323     // The GPU process is allowed to call InitializeSandbox() with threads.
 324     bool sandbox_failure_fatal = process_type != switches::kGpuProcess;
 325     // This can be disabled with the '--gpu-sandbox-failures-fatal' flag.
 326     // Setting the flag with no value or any value different than 'yes' or 'no'
 327     // is equal to setting '--gpu-sandbox-failures-fatal=yes'.
 328     if (process_type == switches::kGpuProcess &&
 329         command_line->HasSwitch(switches::kGpuSandboxFailuresFatal)) {
 330       const std::string switch_value =
 331           command_line->GetSwitchValueASCII(switches::kGpuSandboxFailuresFatal);
 332       sandbox_failure_fatal = switch_value != "no";
 333     }
 334
 335     if (sandbox_failure_fatal)
 336       LOG(FATAL) << error_message;
 337
 338     LOG(ERROR) << error_message;
 339     return false;
 340   }
 341
 342   // Only one thread is running, pre-initialize if not already done.
 343   if (!pre_initialized_)
 344     PreinitializeSandbox();
 345
 346   DCHECK(!HasOpenDirectories()) <<
 347       "InitializeSandbox() called after unexpected directories have been " <<
 348       "opened. This breaks the security of the setuid sandbox.";
 349
 350   // Attempt to limit the future size of the address space of the process.
 351   LimitAddressSpace(process_type);
 352
 353   // Try to enable seccomp-bpf.
 354   bool seccomp_bpf_started = StartSeccompBPF(process_type);
 355
 356   return seccomp_bpf_started;
 357 }
 358
 359 void LinuxSandbox::StopThreadImpl(base::Thread* thread) {
 360   DCHECK(thread);
 361   StopThreadAndEnsureNotCounted(thread);
 362 }
 363
 364 bool LinuxSandbox::seccomp_bpf_supported() const {
 365   CHECK(pre_initialized_);
 366   return seccomp_bpf_supported_;
 367 }
 368
 369 bool LinuxSandbox::seccomp_bpf_with_tsync_supported() const {
 370   CHECK(pre_initialized_);
 371   return seccomp_bpf_with_tsync_supported_;
 372 }
 373
 374 bool LinuxSandbox::LimitAddressSpace(const std::string& process_type) {
 375   (void) process_type;
 376 #if !defined(ANY_OF_AMTLU_SANITIZER)
 377   base::CommandLine* command_line = base::CommandLine::ForCurrentProcess();
 378   if (command_line->HasSwitch(switches::kNoSandbox)) {
 379     return false;
 380   }
 381
 382   // Limit the address space to 4GB.
 383   // This is in the hope of making some kernel exploits more complex and less
 384   // reliable. It also limits sprays a little on 64-bit.
 385   rlim_t address_space_limit = std::numeric_limits<uint32_t>::max();
 386 #if defined(__LP64__)
 387   // On 64 bits, V8 and possibly others will reserve massive memory ranges and
 388   // rely on on-demand paging for allocation.  Unfortunately, even
 389   // MADV_DONTNEED ranges  count towards RLIMIT_AS so this is not an option.
 390   // See crbug.com/169327 for a discussion.
 391   // On the GPU process, irrespective of V8, we can exhaust a 4GB address space
 392   // under normal usage, see crbug.com/271119
 393   // For now, increase limit to 16GB for renderer and worker and gpu processes
 394   // to accomodate.
 395   if (process_type == switches::kRendererProcess ||
 396       process_type == switches::kGpuProcess) {
 397     address_space_limit = 1L << 34;
 398   }
 399 #endif  // defined(__LP64__)
 400
 401   // On all platforms, add a limit to the brk() heap that would prevent
 402   // allocations that can't be index by an int.
 403   const rlim_t kNewDataSegmentMaxSize = std::numeric_limits<int>::max();
 404
 405   bool limited_as =
 406       sandbox::ResourceLimits::Lower(RLIMIT_AS, address_space_limit);
 407   bool limited_data =
 408       sandbox::ResourceLimits::Lower(RLIMIT_DATA, kNewDataSegmentMaxSize);
 409
 410   // Cache the resource limit before turning on the sandbox.
 411   base::SysInfo::AmountOfVirtualMemory();
 412
 413   return limited_as && limited_data;
 414 #else
 415   base::SysInfo::AmountOfVirtualMemory();
 416   return false;
 417 #endif  // !defined(ADDRESS_SANITIZER) && !defined(MEMORY_SANITIZER) &&
 418         // !defined(THREAD_SANITIZER)
 419 }
 420
 421 bool LinuxSandbox::HasOpenDirectories() const {
 422   return sandbox::ProcUtil::HasOpenDirectory(proc_fd_);
 423 }
 424
 425 void LinuxSandbox::SealSandbox() {
 426   if (proc_fd_ >= 0) {
 427     int ret = IGNORE_EINTR(close(proc_fd_));
 428     CHECK_EQ(0, ret);
 429     proc_fd_ = -1;
 430   }
 431 }
 432
 433 void LinuxSandbox::CheckForBrokenPromises(const std::string& process_type) {
 434   // Make sure that any promise made with GetStatus() wasn't broken.
 435   bool promised_seccomp_bpf_would_start = false;
 436   if (process_type == switches::kRendererProcess ||
 437       process_type == switches::kPpapiPluginProcess) {
 438     promised_seccomp_bpf_would_start =
 439         (sandbox_status_flags_ != kSandboxLinuxInvalid) &&
 440         (GetStatus() & kSandboxLinuxSeccompBPF);
 441   }
 442   if (promised_seccomp_bpf_would_start) {
 443     CHECK(seccomp_bpf_started_);
 444   }
 445 }
 446
 447 void LinuxSandbox::StopThreadAndEnsureNotCounted(base::Thread* thread) const {
 448   DCHECK(thread);
 449   base::ScopedFD proc_fd(OpenProc(proc_fd_));
 450   PCHECK(proc_fd.is_valid());
 451   CHECK(
 452       sandbox::ThreadHelpers::StopThreadAndWatchProcFS(proc_fd.get(), thread));
 453 }
 454
 455 }  // namespace content