components/nacl/loader/nacl_listener.cc

   1 // Copyright 2013 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "components/nacl/loader/nacl_listener.h"
   6
   7 #include <errno.h>
   8 #include <fcntl.h>
   9 #include <stdlib.h>
  10 #include <string.h>
  11
  12 #if defined(OS_POSIX)
  13 #include <unistd.h>
  14 #endif
  15
  16 #include "base/command_line.h"
  17 #include "base/logging.h"
  18 #include "base/memory/scoped_ptr.h"
  19 #include "base/message_loop/message_loop.h"
  20 #include "base/rand_util.h"
  21 #include "components/nacl/common/nacl_messages.h"
  22 #include "components/nacl/common/nacl_renderer_messages.h"
  23 #include "components/nacl/loader/nacl_ipc_adapter.h"
  24 #include "components/nacl/loader/nacl_validation_db.h"
  25 #include "components/nacl/loader/nacl_validation_query.h"
  26 #include "ipc/ipc_channel_handle.h"
  27 #include "ipc/ipc_switches.h"
  28 #include "ipc/ipc_sync_channel.h"
  29 #include "ipc/ipc_sync_message_filter.h"
  30 #include "native_client/src/public/chrome_main.h"
  31 #include "native_client/src/public/nacl_app.h"
  32 #include "native_client/src/public/nacl_file_info.h"
  33 #include "native_client/src/trusted/service_runtime/include/sys/fcntl.h"
  34
  35 #if defined(OS_POSIX)
  36 #include "base/file_descriptor_posix.h"
  37 #endif
  38
  39 #if defined(OS_LINUX)
  40 #include "content/public/common/child_process_sandbox_support_linux.h"
  41 #endif
  42
  43 #if defined(OS_WIN)
  44 #include <fcntl.h>
  45 #include <io.h>
  46
  47 #include "content/public/common/sandbox_init.h"
  48 #endif
  49
  50 namespace {
  51
  52 NaClListener* g_listener;
  53
  54 void FatalLogHandler(const char* data, size_t bytes) {
  55   // We use uint32_t rather than size_t for the case when the browser and NaCl
  56   // processes are a mix of 32-bit and 64-bit processes.
  57   uint32_t copy_bytes = std::min<uint32_t>(static_cast<uint32_t>(bytes),
  58                                            nacl::kNaClCrashInfoMaxLogSize);
  59
  60   // We copy the length of the crash data to the start of the shared memory
  61   // segment so we know how much to copy.
  62   memcpy(g_listener->crash_info_shmem_memory(), &copy_bytes, sizeof(uint32_t));
  63
  64   memcpy((char*)g_listener->crash_info_shmem_memory() + sizeof(uint32_t),
  65          data,
  66          copy_bytes);
  67 }
  68
  69 #if defined(OS_MACOSX)
  70
  71 // On Mac OS X, shm_open() works in the sandbox but does not give us
  72 // an FD that we can map as PROT_EXEC.  Rather than doing an IPC to
  73 // get an executable SHM region when CreateMemoryObject() is called,
  74 // we preallocate one on startup, since NaCl's sel_ldr only needs one
  75 // of them.  This saves a round trip.
  76
  77 base::subtle::Atomic32 g_shm_fd = -1;
  78
  79 int CreateMemoryObject(size_t size, int executable) {
  80   if (executable && size > 0) {
  81     int result_fd = base::subtle::NoBarrier_AtomicExchange(&g_shm_fd, -1);
  82     if (result_fd != -1) {
  83       // ftruncate() is disallowed by the Mac OS X sandbox and
  84       // returns EPERM.  Luckily, we can get the same effect with
  85       // lseek() + write().
  86       if (lseek(result_fd, size - 1, SEEK_SET) == -1) {
  87         LOG(ERROR) << "lseek() failed: " << errno;
  88         return -1;
  89       }
  90       if (write(result_fd, "", 1) != 1) {
  91         LOG(ERROR) << "write() failed: " << errno;
  92         return -1;
  93       }
  94       return result_fd;
  95     }
  96   }
  97   // Fall back to NaCl's default implementation.
  98   return -1;
  99 }
 100
 101 #elif defined(OS_LINUX)
 102
 103 int CreateMemoryObject(size_t size, int executable) {
 104   return content::MakeSharedMemorySegmentViaIPC(size, executable);
 105 }
 106
 107 #elif defined(OS_WIN)
 108 // We wrap the function to convert the bool return value to an int.
 109 int BrokerDuplicateHandle(NaClHandle source_handle,
 110                           uint32_t process_id,
 111                           NaClHandle* target_handle,
 112                           uint32_t desired_access,
 113                           uint32_t options) {
 114   return content::BrokerDuplicateHandle(source_handle, process_id,
 115                                         target_handle, desired_access,
 116                                         options);
 117 }
 118
 119 int AttachDebugExceptionHandler(const void* info, size_t info_size) {
 120   std::string info_string(reinterpret_cast<const char*>(info), info_size);
 121   bool result = false;
 122   if (!g_listener->Send(new NaClProcessMsg_AttachDebugExceptionHandler(
 123            info_string, &result)))
 124     return false;
 125   return result;
 126 }
 127
 128 void DebugStubPortSelectedHandler(uint16_t port) {
 129   g_listener->Send(new NaClProcessHostMsg_DebugStubPortSelected(port));
 130 }
 131
 132 #endif
 133
 134 // Creates the PPAPI IPC channel between the NaCl IRT and the host
 135 // (browser/renderer) process, and starts to listen it on the thread where
 136 // the given message_loop_proxy runs.
 137 // Also, creates and sets the corresponding NaClDesc to the given nap with
 138 // the FD #.
 139 void SetUpIPCAdapter(IPC::ChannelHandle* handle,
 140                      scoped_refptr<base::MessageLoopProxy> message_loop_proxy,
 141                      struct NaClApp* nap,
 142                      int nacl_fd) {
 143   scoped_refptr<NaClIPCAdapter> ipc_adapter(
 144       new NaClIPCAdapter(*handle, message_loop_proxy.get()));
 145   ipc_adapter->ConnectChannel();
 146 #if defined(OS_POSIX)
 147   handle->socket =
 148       base::FileDescriptor(ipc_adapter->TakeClientFileDescriptor(), true);
 149 #endif
 150
 151   // Pass a NaClDesc to the untrusted side. This will hold a ref to the
 152   // NaClIPCAdapter.
 153   NaClAppSetDesc(nap, nacl_fd, ipc_adapter->MakeNaClDesc());
 154 }
 155
 156 }  // namespace
 157
 158 class BrowserValidationDBProxy : public NaClValidationDB {
 159  public:
 160   explicit BrowserValidationDBProxy(NaClListener* listener)
 161       : listener_(listener) {
 162   }
 163
 164   virtual bool QueryKnownToValidate(const std::string& signature) OVERRIDE {
 165     // Initialize to false so that if the Send fails to write to the return
 166     // value we're safe.  For example if the message is (for some reason)
 167     // dispatched as an async message the return parameter will not be written.
 168     bool result = false;
 169     if (!listener_->Send(new NaClProcessMsg_QueryKnownToValidate(signature,
 170                                                                  &result))) {
 171       LOG(ERROR) << "Failed to query NaCl validation cache.";
 172       result = false;
 173     }
 174     return result;
 175   }
 176
 177   virtual void SetKnownToValidate(const std::string& signature) OVERRIDE {
 178     // Caching is optional: NaCl will still work correctly if the IPC fails.
 179     if (!listener_->Send(new NaClProcessMsg_SetKnownToValidate(signature))) {
 180       LOG(ERROR) << "Failed to update NaCl validation cache.";
 181     }
 182   }
 183
 184   virtual bool ResolveFileToken(struct NaClFileToken* file_token,
 185                                 int32* fd, std::string* path) OVERRIDE {
 186     *fd = -1;
 187     *path = "";
 188     if (!NaClFileTokenIsValid(file_token)) {
 189       return false;
 190     }
 191     IPC::PlatformFileForTransit ipc_fd = IPC::InvalidPlatformFileForTransit();
 192     base::FilePath ipc_path;
 193     if (!listener_->Send(new NaClProcessMsg_ResolveFileToken(file_token->lo,
 194                                                              file_token->hi,
 195                                                              &ipc_fd,
 196                                                              &ipc_path))) {
 197       return false;
 198     }
 199     if (ipc_fd == IPC::InvalidPlatformFileForTransit()) {
 200       return false;
 201     }
 202     base::PlatformFile handle =
 203         IPC::PlatformFileForTransitToPlatformFile(ipc_fd);
 204 #if defined(OS_WIN)
 205     // On Windows, valid handles are 32 bit unsigned integers so this is safe.
 206     *fd = reinterpret_cast<uintptr_t>(handle);
 207 #else
 208     *fd = handle;
 209 #endif
 210     // It doesn't matter if the path is invalid UTF8 as long as it's consistent
 211     // and unforgeable.
 212     *path = ipc_path.AsUTF8Unsafe();
 213     return true;
 214   }
 215
 216  private:
 217   // The listener never dies, otherwise this might be a dangling reference.
 218   NaClListener* listener_;
 219 };
 220
 221
 222 NaClListener::NaClListener() : shutdown_event_(true, false),
 223                                io_thread_("NaCl_IOThread"),
 224 #if defined(OS_LINUX)
 225                                prereserved_sandbox_size_(0),
 226 #endif
 227 #if defined(OS_POSIX)
 228                                number_of_cores_(-1),  // unknown/error
 229 #endif
 230                                main_loop_(NULL) {
 231   io_thread_.StartWithOptions(
 232       base::Thread::Options(base::MessageLoop::TYPE_IO, 0));
 233   DCHECK(g_listener == NULL);
 234   g_listener = this;
 235 }
 236
 237 NaClListener::~NaClListener() {
 238   NOTREACHED();
 239   shutdown_event_.Signal();
 240   g_listener = NULL;
 241 }
 242
 243 bool NaClListener::Send(IPC::Message* msg) {
 244   DCHECK(main_loop_ != NULL);
 245   if (base::MessageLoop::current() == main_loop_) {
 246     // This thread owns the channel.
 247     return channel_->Send(msg);
 248   } else {
 249     // This thread does not own the channel.
 250     return filter_->Send(msg);
 251   }
 252 }
 253
 254 void NaClListener::Listen() {
 255   std::string channel_name =
 256       CommandLine::ForCurrentProcess()->GetSwitchValueASCII(
 257           switches::kProcessChannelID);
 258   channel_ = IPC::SyncChannel::Create(
 259       this, io_thread_.message_loop_proxy().get(), &shutdown_event_);
 260   filter_ = new IPC::SyncMessageFilter(&shutdown_event_);
 261   channel_->AddFilter(filter_.get());
 262   channel_->Init(channel_name, IPC::Channel::MODE_CLIENT, true);
 263   main_loop_ = base::MessageLoop::current();
 264   main_loop_->Run();
 265 }
 266
 267 bool NaClListener::OnMessageReceived(const IPC::Message& msg) {
 268   bool handled = true;
 269   IPC_BEGIN_MESSAGE_MAP(NaClListener, msg)
 270       IPC_MESSAGE_HANDLER(NaClProcessMsg_Start, OnStart)
 271       IPC_MESSAGE_UNHANDLED(handled = false)
 272   IPC_END_MESSAGE_MAP()
 273   return handled;
 274 }
 275
 276 void NaClListener::OnStart(const nacl::NaClStartParams& params) {
 277 #if defined(OS_LINUX) || defined(OS_MACOSX)
 278   int urandom_fd = dup(base::GetUrandomFD());
 279   if (urandom_fd < 0) {
 280     LOG(ERROR) << "Failed to dup() the urandom FD";
 281     return;
 282   }
 283   NaClChromeMainSetUrandomFd(urandom_fd);
 284 #endif
 285   struct NaClApp* nap = NULL;
 286   NaClChromeMainInit();
 287
 288   crash_info_shmem_.reset(new base::SharedMemory(params.crash_info_shmem_handle,
 289                                                  false));
 290   CHECK(crash_info_shmem_->Map(nacl::kNaClCrashInfoShmemSize));
 291   NaClSetFatalErrorCallback(&FatalLogHandler);
 292
 293   nap = NaClAppCreate();
 294   if (nap == NULL) {
 295     LOG(ERROR) << "NaClAppCreate() failed";
 296     return;
 297   }
 298
 299   IPC::ChannelHandle browser_handle;
 300   IPC::ChannelHandle ppapi_renderer_handle;
 301
 302   if (params.enable_ipc_proxy) {
 303     browser_handle = IPC::Channel::GenerateVerifiedChannelID("nacl");
 304     ppapi_renderer_handle = IPC::Channel::GenerateVerifiedChannelID("nacl");
 305
 306     // Create the PPAPI IPC channels between the NaCl IRT and the host
 307     // (browser/renderer) processes. The IRT uses these channels to
 308     // communicate with the host and to initialize the IPC dispatchers.
 309     SetUpIPCAdapter(&browser_handle, io_thread_.message_loop_proxy(),
 310                     nap, NACL_CHROME_DESC_BASE);
 311     SetUpIPCAdapter(&ppapi_renderer_handle, io_thread_.message_loop_proxy(),
 312                     nap, NACL_CHROME_DESC_BASE + 1);
 313   }
 314
 315   trusted_listener_ = new NaClTrustedListener(
 316       IPC::Channel::GenerateVerifiedChannelID("nacl"),
 317       io_thread_.message_loop_proxy().get(),
 318       &shutdown_event_);
 319   if (!Send(new NaClProcessHostMsg_PpapiChannelsCreated(
 320           browser_handle,
 321           ppapi_renderer_handle,
 322           trusted_listener_->TakeClientChannelHandle(),
 323           IPC::ChannelHandle())))
 324     LOG(ERROR) << "Failed to send IPC channel handle to NaClProcessHost.";
 325
 326   std::vector<nacl::FileDescriptor> handles = params.handles;
 327   struct NaClChromeMainArgs* args = NaClChromeMainArgsCreate();
 328   if (args == NULL) {
 329     LOG(ERROR) << "NaClChromeMainArgsCreate() failed";
 330     return;
 331   }
 332
 333 #if defined(OS_LINUX) || defined(OS_MACOSX)
 334   args->number_of_cores = number_of_cores_;
 335   args->create_memory_object_func = CreateMemoryObject;
 336 # if defined(OS_MACOSX)
 337   CHECK(handles.size() >= 1);
 338   g_shm_fd = nacl::ToNativeHandle(handles[handles.size() - 1]);
 339   handles.pop_back();
 340 # endif
 341 #endif
 342
 343   if (params.uses_irt) {
 344     CHECK(handles.size() >= 1);
 345     NaClHandle irt_handle = nacl::ToNativeHandle(handles[handles.size() - 1]);
 346     handles.pop_back();
 347
 348 #if defined(OS_WIN)
 349     args->irt_fd = _open_osfhandle(reinterpret_cast<intptr_t>(irt_handle),
 350                                    _O_RDONLY | _O_BINARY);
 351     if (args->irt_fd < 0) {
 352       LOG(ERROR) << "_open_osfhandle() failed";
 353       return;
 354     }
 355 #else
 356     args->irt_fd = irt_handle;
 357 #endif
 358   } else {
 359     // Otherwise, the IRT handle is not even sent.
 360     args->irt_fd = -1;
 361   }
 362
 363   if (params.validation_cache_enabled) {
 364     // SHA256 block size.
 365     CHECK_EQ(params.validation_cache_key.length(), (size_t) 64);
 366     // The cache structure is not freed and exists until the NaCl process exits.
 367     args->validation_cache = CreateValidationCache(
 368         new BrowserValidationDBProxy(this), params.validation_cache_key,
 369         params.version);
 370   }
 371
 372   CHECK(handles.size() == 1);
 373   args->imc_bootstrap_handle = nacl::ToNativeHandle(handles[0]);
 374   args->enable_exception_handling = params.enable_exception_handling;
 375   args->enable_debug_stub = params.enable_debug_stub;
 376   args->enable_dyncode_syscalls = params.enable_dyncode_syscalls;
 377   if (!params.enable_dyncode_syscalls) {
 378     // Bound the initial nexe's code segment size under PNaCl to
 379     // reduce the chance of a code spraying attack succeeding (see
 380     // https://code.google.com/p/nativeclient/issues/detail?id=3572).
 381     // We assume that !params.enable_dyncode_syscalls is synonymous
 382     // with PNaCl.  We can't apply this arbitrary limit outside of
 383     // PNaCl because it might break existing NaCl apps, and this limit
 384     // is only useful if the dyncode syscalls are disabled.
 385     args->initial_nexe_max_code_bytes = 64 << 20;  // 64 MB
 386
 387     // Indicate that this is a PNaCl module.
 388     // TODO(jvoung): Plumb through something indicating that this is PNaCl
 389     // instead of relying on enable_dyncode_syscalls.
 390     args->pnacl_mode = 1;
 391   }
 392 #if defined(OS_LINUX) || defined(OS_MACOSX)
 393   args->debug_stub_server_bound_socket_fd = nacl::ToNativeHandle(
 394       params.debug_stub_server_bound_socket);
 395 #endif
 396 #if defined(OS_WIN)
 397   args->broker_duplicate_handle_func = BrokerDuplicateHandle;
 398   args->attach_debug_exception_handler_func = AttachDebugExceptionHandler;
 399   args->debug_stub_server_port_selected_handler_func =
 400       DebugStubPortSelectedHandler;
 401 #endif
 402 #if defined(OS_LINUX)
 403   args->prereserved_sandbox_size = prereserved_sandbox_size_;
 404 #endif
 405
 406   NaClFileInfo nexe_file_info;
 407   base::PlatformFile nexe_file = IPC::PlatformFileForTransitToPlatformFile(
 408       params.nexe_file);
 409 #if defined(OS_WIN)
 410   nexe_file_info.desc =
 411       _open_osfhandle(reinterpret_cast<intptr_t>(nexe_file),
 412                       _O_RDONLY | _O_BINARY);
 413 #elif defined(OS_POSIX)
 414   nexe_file_info.desc = nexe_file;
 415 #else
 416 #error Unsupported target platform.
 417 #endif
 418   nexe_file_info.file_token.lo = params.nexe_token_lo;
 419   nexe_file_info.file_token.hi = params.nexe_token_hi;
 420   args->nexe_desc = NaClDescIoFromFileInfo(nexe_file_info, NACL_ABI_O_RDONLY);
 421
 422   int exit_status;
 423   if (!NaClChromeMainStart(nap, args, &exit_status))
 424     NaClExit(1);
 425
 426   // Report the plugin's exit status if the application started successfully.
 427   trusted_listener_->Send(new NaClRendererMsg_ReportExitStatus(exit_status));
 428   NaClExit(exit_status);
 429 }