content/common/sandbox_linux/bpf_gpu_policy_linux.cc

   1 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "content/common/sandbox_linux/bpf_gpu_policy_linux.h"
   6
   7 #include <dlfcn.h>
   8 #include <errno.h>
   9 #include <fcntl.h>
  10 #include <sys/socket.h>
  11 #include <sys/stat.h>
  12 #include <sys/types.h>
  13 #include <unistd.h>
  14
  15 #include <string>
  16 #include <vector>
  17
  18 #include "base/bind.h"
  19 #include "base/command_line.h"
  20 #include "base/compiler_specific.h"
  21 #include "base/logging.h"
  22 #include "base/memory/scoped_ptr.h"
  23 #include "build/build_config.h"
  24 #include "content/common/sandbox_linux/sandbox_bpf_base_policy_linux.h"
  25 #include "content/common/sandbox_linux/sandbox_seccomp_bpf_linux.h"
  26 #include "content/common/set_process_title.h"
  27 #include "content/public/common/content_switches.h"
  28 #include "sandbox/linux/bpf_dsl/bpf_dsl.h"
  29 #include "sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.h"
  30 #include "sandbox/linux/seccomp-bpf-helpers/syscall_sets.h"
  31 #include "sandbox/linux/services/linux_syscalls.h"
  32 #include "sandbox/linux/syscall_broker/broker_file_permission.h"
  33 #include "sandbox/linux/syscall_broker/broker_process.h"
  34
  35 using sandbox::arch_seccomp_data;
  36 using sandbox::bpf_dsl::Allow;
  37 using sandbox::bpf_dsl::ResultExpr;
  38 using sandbox::bpf_dsl::Trap;
  39 using sandbox::syscall_broker::BrokerFilePermission;
  40 using sandbox::syscall_broker::BrokerProcess;
  41 using sandbox::SyscallSets;
  42
  43 namespace content {
  44
  45 namespace {
  46
  47 inline bool IsChromeOS() {
  48 #if defined(OS_CHROMEOS)
  49   return true;
  50 #else
  51   return false;
  52 #endif
  53 }
  54
  55 inline bool IsArchitectureX86_64() {
  56 #if defined(__x86_64__)
  57   return true;
  58 #else
  59   return false;
  60 #endif
  61 }
  62
  63 inline bool IsArchitectureI386() {
  64 #if defined(__i386__)
  65   return true;
  66 #else
  67   return false;
  68 #endif
  69 }
  70
  71 inline bool IsArchitectureArm() {
  72 #if defined(__arm__)
  73   return true;
  74 #else
  75   return false;
  76 #endif
  77 }
  78
  79 bool IsAcceleratedVideoEnabled() {
  80   const base::CommandLine& command_line =
  81       *base::CommandLine::ForCurrentProcess();
  82   bool accelerated_encode_enabled = false;
  83 #if defined(OS_CHROMEOS)
  84   accelerated_encode_enabled =
  85       !command_line.HasSwitch(switches::kDisableVaapiAcceleratedVideoEncode);
  86 #endif
  87   return !command_line.HasSwitch(switches::kDisableAcceleratedVideoDecode) ||
  88          accelerated_encode_enabled;
  89 }
  90
  91 intptr_t GpuSIGSYS_Handler(const struct arch_seccomp_data& args,
  92                            void* aux_broker_process) {
  93   RAW_CHECK(aux_broker_process);
  94   BrokerProcess* broker_process =
  95       static_cast<BrokerProcess*>(aux_broker_process);
  96   switch (args.nr) {
  97     case __NR_access:
  98       return broker_process->Access(reinterpret_cast<const char*>(args.args[0]),
  99                                     static_cast<int>(args.args[1]));
 100     case __NR_open:
 101 #if defined(MEMORY_SANITIZER)
 102       // http://crbug.com/372840
 103       __msan_unpoison_string(reinterpret_cast<const char*>(args.args[0]));
 104 #endif
 105       return broker_process->Open(reinterpret_cast<const char*>(args.args[0]),
 106                                   static_cast<int>(args.args[1]));
 107     case __NR_openat:
 108       // Allow using openat() as open().
 109       if (static_cast<int>(args.args[0]) == AT_FDCWD) {
 110         return
 111             broker_process->Open(reinterpret_cast<const char*>(args.args[1]),
 112                                  static_cast<int>(args.args[2]));
 113       } else {
 114         return -EPERM;
 115       }
 116     default:
 117       RAW_CHECK(false);
 118       return -ENOSYS;
 119   }
 120 }
 121
 122 class GpuBrokerProcessPolicy : public GpuProcessPolicy {
 123  public:
 124   static sandbox::bpf_dsl::Policy* Create() {
 125     return new GpuBrokerProcessPolicy();
 126   }
 127   ~GpuBrokerProcessPolicy() override {}
 128
 129   ResultExpr EvaluateSyscall(int system_call_number) const override;
 130
 131  private:
 132   GpuBrokerProcessPolicy() {}
 133   DISALLOW_COPY_AND_ASSIGN(GpuBrokerProcessPolicy);
 134 };
 135
 136 // x86_64/i386 or desktop ARM.
 137 // A GPU broker policy is the same as a GPU policy with access, open,
 138 // openat and in the non-Chrome OS case unlink allowed.
 139 ResultExpr GpuBrokerProcessPolicy::EvaluateSyscall(int sysno) const {
 140   switch (sysno) {
 141     case __NR_access:
 142     case __NR_open:
 143     case __NR_openat:
 144 #if !defined(OS_CHROMEOS)
 145     // The broker process needs to able to unlink the temporary
 146     // files that it may create. This is used by DRI3.
 147     case __NR_unlink:
 148 #endif
 149       return Allow();
 150     default:
 151       return GpuProcessPolicy::EvaluateSyscall(sysno);
 152   }
 153 }
 154
 155 void UpdateProcessTypeToGpuBroker() {
 156   base::CommandLine::StringVector exec =
 157       base::CommandLine::ForCurrentProcess()->GetArgs();
 158   base::CommandLine::Reset();
 159   base::CommandLine::Init(0, NULL);
 160   base::CommandLine::ForCurrentProcess()->InitFromArgv(exec);
 161   base::CommandLine::ForCurrentProcess()->AppendSwitchASCII(
 162       switches::kProcessType, "gpu-broker");
 163
 164   // Update the process title. The argv was already cached by the call to
 165   // SetProcessTitleFromCommandLine in content_main_runner.cc, so we can pass
 166   // NULL here (we don't have the original argv at this point).
 167   SetProcessTitleFromCommandLine(NULL);
 168 }
 169
 170 bool UpdateProcessTypeAndEnableSandbox(
 171     sandbox::bpf_dsl::Policy* (*broker_sandboxer_allocator)(void)) {
 172   DCHECK(broker_sandboxer_allocator);
 173   UpdateProcessTypeToGpuBroker();
 174   return SandboxSeccompBPF::StartSandboxWithExternalPolicy(
 175       make_scoped_ptr(broker_sandboxer_allocator()), base::ScopedFD());
 176 }
 177
 178 }  // namespace
 179
 180 GpuProcessPolicy::GpuProcessPolicy() : GpuProcessPolicy(false) {
 181 }
 182
 183 GpuProcessPolicy::GpuProcessPolicy(bool allow_mincore)
 184     : broker_process_(NULL), allow_mincore_(allow_mincore) {
 185 }
 186
 187 GpuProcessPolicy::~GpuProcessPolicy() {}
 188
 189 // Main policy for x86_64/i386. Extended by CrosArmGpuProcessPolicy.
 190 ResultExpr GpuProcessPolicy::EvaluateSyscall(int sysno) const {
 191   switch (sysno) {
 192 #if !defined(OS_CHROMEOS)
 193     case __NR_ftruncate:
 194 #endif
 195     case __NR_ioctl:
 196       return Allow();
 197     case __NR_mincore:
 198       if (allow_mincore_) {
 199         return Allow();
 200       } else {
 201         return SandboxBPFBasePolicy::EvaluateSyscall(sysno);
 202       }
 203 #if defined(__i386__) || defined(__x86_64__) || defined(__mips__)
 204     // The Nvidia driver uses flags not in the baseline policy
 205     // (MAP_LOCKED | MAP_EXECUTABLE | MAP_32BIT)
 206     case __NR_mmap:
 207 #endif
 208     // We also hit this on the linux_chromeos bot but don't yet know what
 209     // weird flags were involved.
 210     case __NR_mprotect:
 211     // TODO(jln): restrict prctl.
 212     case __NR_prctl:
 213       return Allow();
 214     case __NR_access:
 215     case __NR_open:
 216     case __NR_openat:
 217       DCHECK(broker_process_);
 218       return Trap(GpuSIGSYS_Handler, broker_process_);
 219     case __NR_setpriority:
 220       return sandbox::RestrictGetSetpriority(GetPolicyPid());
 221     case __NR_sched_getaffinity:
 222     case __NR_sched_setaffinity:
 223       return sandbox::RestrictSchedTarget(GetPolicyPid(), sysno);
 224     default:
 225       if (SyscallSets::IsEventFd(sysno))
 226         return Allow();
 227
 228       // Default on the baseline policy.
 229       return SandboxBPFBasePolicy::EvaluateSyscall(sysno);
 230   }
 231 }
 232
 233 bool GpuProcessPolicy::PreSandboxHook() {
 234   // Warm up resources needed by the policy we're about to enable and
 235   // eventually start a broker process.
 236   const bool chromeos_arm_gpu = IsChromeOS() && IsArchitectureArm();
 237   // This policy is for x86 or Desktop.
 238   DCHECK(!chromeos_arm_gpu);
 239
 240   DCHECK(!broker_process());
 241   // Create a new broker process.
 242   InitGpuBrokerProcess(
 243       GpuBrokerProcessPolicy::Create,
 244       std::vector<BrokerFilePermission>());  // No extra files in whitelist.
 245
 246   if (IsArchitectureX86_64() || IsArchitectureI386()) {
 247     // Accelerated video dlopen()'s some shared objects
 248     // inside the sandbox, so preload them now.
 249     if (IsAcceleratedVideoEnabled()) {
 250       const char* I965DrvVideoPath = NULL;
 251
 252       if (IsArchitectureX86_64()) {
 253         I965DrvVideoPath = "/usr/lib64/va/drivers/i965_drv_video.so";
 254       } else if (IsArchitectureI386()) {
 255         I965DrvVideoPath = "/usr/lib/va/drivers/i965_drv_video.so";
 256       }
 257
 258       dlopen(I965DrvVideoPath, RTLD_NOW|RTLD_GLOBAL|RTLD_NODELETE);
 259       dlopen("libva.so.1", RTLD_NOW|RTLD_GLOBAL|RTLD_NODELETE);
 260       dlopen("libva-x11.so.1", RTLD_NOW|RTLD_GLOBAL|RTLD_NODELETE);
 261     }
 262   }
 263
 264   return true;
 265 }
 266
 267 void GpuProcessPolicy::InitGpuBrokerProcess(
 268     sandbox::bpf_dsl::Policy* (*broker_sandboxer_allocator)(void),
 269     const std::vector<BrokerFilePermission>& permissions_extra) {
 270   static const char kDriRcPath[] = "/etc/drirc";
 271   static const char kDriCard0Path[] = "/dev/dri/card0";
 272   static const char kDevShm[] = "/dev/shm/";
 273
 274   CHECK(broker_process_ == NULL);
 275
 276   // All GPU process policies need these files brokered out.
 277   std::vector<BrokerFilePermission> permissions;
 278   permissions.push_back(BrokerFilePermission::ReadWrite(kDriCard0Path));
 279   permissions.push_back(BrokerFilePermission::ReadOnly(kDriRcPath));
 280   if (!IsChromeOS()) {
 281     permissions.push_back(
 282         BrokerFilePermission::ReadWriteCreateUnlinkRecursive(kDevShm));
 283   }
 284
 285   // Add eventual extra files from permissions_extra.
 286   for (const auto& perm : permissions_extra) {
 287     permissions.push_back(perm);
 288   }
 289
 290   broker_process_ = new BrokerProcess(GetFSDeniedErrno(), permissions);
 291   // The initialization callback will perform generic initialization and then
 292   // call broker_sandboxer_callback.
 293   CHECK(broker_process_->Init(base::Bind(&UpdateProcessTypeAndEnableSandbox,
 294                                          broker_sandboxer_allocator)));
 295 }
 296
 297 }  // namespace content