content/browser/mach_broker_mac.mm

   1 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "content/browser/mach_broker_mac.h"
   6
   7 #include <bsm/libbsm.h>
   8 #include <servers/bootstrap.h>
   9
  10 #include "base/bind.h"
  11 #include "base/bind_helpers.h"
  12 #include "base/command_line.h"
  13 #include "base/logging.h"
  14 #include "base/mac/foundation_util.h"
  15 #include "base/mac/mach_logging.h"
  16 #include "base/mac/scoped_mach_port.h"
  17 #include "base/strings/string_util.h"
  18 #include "base/strings/stringprintf.h"
  19 #include "base/strings/sys_string_conversions.h"
  20 #include "base/threading/platform_thread.h"
  21 #include "content/browser/renderer_host/render_process_host_impl.h"
  22 #include "content/public/browser/browser_thread.h"
  23 #include "content/public/browser/child_process_data.h"
  24 #include "content/public/browser/notification_service.h"
  25 #include "content/public/browser/notification_types.h"
  26 #include "content/public/common/content_switches.h"
  27
  28 namespace content {
  29
  30 namespace {
  31
  32 // Mach message structure used in the child as a sending message.
  33 struct MachBroker_ChildSendMsg {
  34   mach_msg_header_t header;
  35   mach_msg_body_t body;
  36   mach_msg_port_descriptor_t child_task_port;
  37 };
  38
  39 // Complement to the ChildSendMsg, this is used in the parent for receiving
  40 // a message. Contains a message trailer with audit information.
  41 struct MachBroker_ParentRecvMsg : public MachBroker_ChildSendMsg {
  42   mach_msg_audit_trailer_t trailer;
  43 };
  44
  45 }  // namespace
  46
  47 class MachListenerThreadDelegate : public base::PlatformThread::Delegate {
  48  public:
  49   explicit MachListenerThreadDelegate(MachBroker* broker)
  50       : broker_(broker),
  51         server_port_(MACH_PORT_NULL) {
  52     DCHECK(broker_);
  53   }
  54
  55   bool Init() {
  56     DCHECK(server_port_.get() == MACH_PORT_NULL);
  57
  58     mach_port_t port;
  59     kern_return_t kr = mach_port_allocate(mach_task_self(),
  60                                           MACH_PORT_RIGHT_RECEIVE,
  61                                           &port);
  62     if (kr != KERN_SUCCESS) {
  63       MACH_LOG(ERROR, kr) << "mach_port_allocate";
  64       return false;
  65     }
  66     server_port_.reset(port);
  67
  68     // Allocate a send right for the server port.
  69     kr = mach_port_insert_right(
  70         mach_task_self(), port, port, MACH_MSG_TYPE_MAKE_SEND);
  71     if (kr != KERN_SUCCESS) {
  72       MACH_LOG(ERROR, kr) << "mach_port_insert_right";
  73       return false;
  74     }
  75     // Deallocate the right after registering with the bootstrap server.
  76     base::mac::ScopedMachSendRight send_right(port);
  77
  78     // Register the port with the bootstrap server. Because bootstrap_register
  79     // is deprecated, this has to be wraped in an ObjC interface.
  80     NSPort* ns_port = [NSMachPort portWithMachPort:port
  81                                            options:NSMachPortDeallocateNone];
  82     NSString* name = base::SysUTF8ToNSString(broker_->GetMachPortName());
  83     return [[NSMachBootstrapServer sharedInstance] registerPort:ns_port
  84                                                            name:name];
  85   }
  86
  87   // Implement |PlatformThread::Delegate|.
  88   void ThreadMain() override {
  89     MachBroker_ParentRecvMsg msg;
  90     bzero(&msg, sizeof(msg));
  91     msg.header.msgh_size = sizeof(msg);
  92     msg.header.msgh_local_port = server_port_.get();
  93
  94     const mach_msg_option_t options = MACH_RCV_MSG |
  95         MACH_RCV_TRAILER_TYPE(MACH_RCV_TRAILER_AUDIT) |
  96         MACH_RCV_TRAILER_ELEMENTS(MACH_RCV_TRAILER_AUDIT);
  97
  98     kern_return_t kr;
  99     while ((kr = mach_msg(&msg.header,
 100                           options,
 101                           0,
 102                           sizeof(msg),
 103                           server_port_,
 104                           MACH_MSG_TIMEOUT_NONE,
 105                           MACH_PORT_NULL)) == KERN_SUCCESS) {
 106       // Use the kernel audit information to make sure this message is from
 107       // a task that this process spawned. The kernel audit token contains the
 108       // unspoofable pid of the task that sent the message.
 109       //
 110       // TODO(rsesek): In the 10.7 SDK, there's audit_token_to_pid().
 111       pid_t child_pid;
 112       audit_token_to_au32(msg.trailer.msgh_audit,
 113           NULL, NULL, NULL, NULL, NULL, &child_pid, NULL, NULL);
 114
 115       mach_port_t child_task_port = msg.child_task_port.name;
 116
 117       // Take the lock and update the broker information.
 118       base::AutoLock lock(broker_->GetLock());
 119       broker_->FinalizePid(child_pid, child_task_port);
 120     }
 121
 122     MACH_LOG(ERROR, kr) << "mach_msg";
 123   }
 124
 125  private:
 126   // The MachBroker to use when new child task rights are received.  Can be
 127   // NULL.
 128   MachBroker* broker_;  // weak
 129
 130   base::mac::ScopedMachReceiveRight server_port_;
 131
 132   DISALLOW_COPY_AND_ASSIGN(MachListenerThreadDelegate);
 133 };
 134
 135 bool MachBroker::ChildSendTaskPortToParent() {
 136   // Look up the named MachBroker port that's been registered with the
 137   // bootstrap server.
 138   mach_port_t parent_port;
 139   kern_return_t kr = bootstrap_look_up(bootstrap_port,
 140       const_cast<char*>(GetMachPortName().c_str()), &parent_port);
 141   if (kr != KERN_SUCCESS) {
 142     BOOTSTRAP_LOG(ERROR, kr) << "bootstrap_look_up";
 143     return false;
 144   }
 145   base::mac::ScopedMachSendRight scoped_right(parent_port);
 146
 147   // Create the check in message. This will copy a send right on this process'
 148   // (the child's) task port and send it to the parent.
 149   MachBroker_ChildSendMsg msg;
 150   bzero(&msg, sizeof(msg));
 151   msg.header.msgh_bits = MACH_MSGH_BITS_REMOTE(MACH_MSG_TYPE_COPY_SEND) |
 152                          MACH_MSGH_BITS_COMPLEX;
 153   msg.header.msgh_remote_port = parent_port;
 154   msg.header.msgh_size = sizeof(msg);
 155   msg.body.msgh_descriptor_count = 1;
 156   msg.child_task_port.name = mach_task_self();
 157   msg.child_task_port.disposition = MACH_MSG_TYPE_PORT_SEND;
 158   msg.child_task_port.type = MACH_MSG_PORT_DESCRIPTOR;
 159
 160   kr = mach_msg(&msg.header, MACH_SEND_MSG | MACH_SEND_TIMEOUT, sizeof(msg),
 161       0, MACH_PORT_NULL, 100 /*milliseconds*/, MACH_PORT_NULL);
 162   if (kr != KERN_SUCCESS) {
 163     MACH_LOG(ERROR, kr) << "mach_msg";
 164     return false;
 165   }
 166
 167   return true;
 168 }
 169
 170 MachBroker* MachBroker::GetInstance() {
 171   return Singleton<MachBroker, LeakySingletonTraits<MachBroker> >::get();
 172 }
 173
 174 base::Lock& MachBroker::GetLock() {
 175   return lock_;
 176 }
 177
 178 void MachBroker::EnsureRunning() {
 179   lock_.AssertAcquired();
 180
 181   if (!listener_thread_started_) {
 182     listener_thread_started_ = true;
 183
 184     BrowserThread::PostTask(
 185         BrowserThread::UI, FROM_HERE,
 186         base::Bind(&MachBroker::RegisterNotifications, base::Unretained(this)));
 187
 188     // Intentional leak.  This thread is never joined or reaped.
 189     MachListenerThreadDelegate* thread = new MachListenerThreadDelegate(this);
 190     if (thread->Init()) {
 191       base::PlatformThread::CreateNonJoinable(0, thread);
 192     } else {
 193       LOG(ERROR) << "Failed to initialize the MachListenerThreadDelegate";
 194     }
 195   }
 196 }
 197
 198 void MachBroker::AddPlaceholderForPid(base::ProcessHandle pid,
 199                                       int child_process_id) {
 200   lock_.AssertAcquired();
 201
 202   DCHECK_EQ(0u, mach_map_.count(pid));
 203   mach_map_[pid] = MACH_PORT_NULL;
 204   child_process_id_map_[child_process_id] = pid;
 205 }
 206
 207 mach_port_t MachBroker::TaskForPid(base::ProcessHandle pid) const {
 208   base::AutoLock lock(lock_);
 209   MachBroker::MachMap::const_iterator it = mach_map_.find(pid);
 210   if (it == mach_map_.end())
 211     return MACH_PORT_NULL;
 212   return it->second;
 213 }
 214
 215 void MachBroker::BrowserChildProcessHostDisconnected(
 216     const ChildProcessData& data) {
 217   InvalidateChildProcessId(data.id);
 218 }
 219
 220 void MachBroker::BrowserChildProcessCrashed(const ChildProcessData& data) {
 221   InvalidateChildProcessId(data.id);
 222 }
 223
 224 void MachBroker::Observe(int type,
 225                          const NotificationSource& source,
 226                          const NotificationDetails& details) {
 227   switch (type) {
 228     case NOTIFICATION_RENDERER_PROCESS_TERMINATED:
 229     case NOTIFICATION_RENDERER_PROCESS_CLOSED: {
 230       RenderProcessHost* host = Source<RenderProcessHost>(source).ptr();
 231       InvalidateChildProcessId(host->GetID());
 232       break;
 233     }
 234     default:
 235       NOTREACHED() << "Unexpected notification";
 236       break;
 237   }
 238 }
 239
 240 MachBroker::MachBroker() : listener_thread_started_(false) {
 241 }
 242
 243 MachBroker::~MachBroker() {}
 244
 245 void MachBroker::FinalizePid(base::ProcessHandle pid,
 246                              mach_port_t task_port) {
 247   lock_.AssertAcquired();
 248
 249   MachMap::iterator it = mach_map_.find(pid);
 250   if (it == mach_map_.end()) {
 251     // Do nothing for unknown pids.
 252     LOG(ERROR) << "Unknown process " << pid << " is sending Mach IPC messages!";
 253     return;
 254   }
 255
 256   DCHECK(it->second == MACH_PORT_NULL);
 257   if (it->second == MACH_PORT_NULL)
 258     it->second = task_port;
 259 }
 260
 261 void MachBroker::InvalidateChildProcessId(int child_process_id) {
 262   base::AutoLock lock(lock_);
 263   MachBroker::ChildProcessIdMap::iterator it =
 264       child_process_id_map_.find(child_process_id);
 265   if (it == child_process_id_map_.end())
 266     return;
 267
 268   MachMap::iterator mach_it = mach_map_.find(it->second);
 269   if (mach_it != mach_map_.end()) {
 270     kern_return_t kr = mach_port_deallocate(mach_task_self(),
 271                                             mach_it->second);
 272     MACH_LOG_IF(WARNING, kr != KERN_SUCCESS, kr) << "mach_port_deallocate";
 273     mach_map_.erase(mach_it);
 274   }
 275   child_process_id_map_.erase(it);
 276 }
 277
 278 // static
 279 std::string MachBroker::GetMachPortName() {
 280   const base::CommandLine* command_line =
 281       base::CommandLine::ForCurrentProcess();
 282   const bool is_child = command_line->HasSwitch(switches::kProcessType);
 283
 284   // In non-browser (child) processes, use the parent's pid.
 285   const pid_t pid = is_child ? getppid() : getpid();
 286   return base::StringPrintf("%s.rohitfork.%d", base::mac::BaseBundleID(), pid);
 287 }
 288
 289 void MachBroker::RegisterNotifications() {
 290   registrar_.Add(this, NOTIFICATION_RENDERER_PROCESS_CLOSED,
 291                  NotificationService::AllBrowserContextsAndSources());
 292   registrar_.Add(this, NOTIFICATION_RENDERER_PROCESS_TERMINATED,
 293                  NotificationService::AllBrowserContextsAndSources());
 294
 295   // No corresponding StopObservingBrowserChildProcesses,
 296   // we leak this singleton.
 297   BrowserChildProcessObserver::Add(this);
 298 }
 299
 300 }  // namespace content