sandbox/linux/services/namespace_sandbox.cc

   1 // Copyright 2015 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "sandbox/linux/services/namespace_sandbox.h"
   6
   7 #include <sched.h>
   8 #include <signal.h>
   9 #include <stdlib.h>
  10 #include <sys/types.h>
  11 #include <unistd.h>
  12
  13 #include <string>
  14 #include <utility>
  15 #include <vector>
  16
  17 #include "base/command_line.h"
  18 #include "base/environment.h"
  19 #include "base/files/scoped_file.h"
  20 #include "base/logging.h"
  21 #include "base/macros.h"
  22 #include "base/posix/eintr_wrapper.h"
  23 #include "base/process/launch.h"
  24 #include "base/process/process.h"
  25 #include "sandbox/linux/services/credentials.h"
  26 #include "sandbox/linux/services/namespace_utils.h"
  27
  28 namespace sandbox {
  29
  30 namespace {
  31
  32 const char kSandboxUSERNSEnvironmentVarName[] = "SBX_USER_NS";
  33 const char kSandboxPIDNSEnvironmentVarName[] = "SBX_PID_NS";
  34 const char kSandboxNETNSEnvironmentVarName[] = "SBX_NET_NS";
  35
  36 #if !defined(OS_NACL_NONSFI)
  37 class WriteUidGidMapDelegate : public base::LaunchOptions::PreExecDelegate {
  38  public:
  39   WriteUidGidMapDelegate()
  40       : uid_(getuid()),
  41         gid_(getgid()),
  42         supports_deny_setgroups_(
  43             NamespaceUtils::KernelSupportsDenySetgroups()) {}
  44
  45   ~WriteUidGidMapDelegate() override {}
  46
  47   void RunAsyncSafe() override {
  48     if (supports_deny_setgroups_) {
  49       RAW_CHECK(NamespaceUtils::DenySetgroups());
  50     }
  51     RAW_CHECK(NamespaceUtils::WriteToIdMapFile("/proc/self/uid_map", uid_));
  52     RAW_CHECK(NamespaceUtils::WriteToIdMapFile("/proc/self/gid_map", gid_));
  53   }
  54
  55  private:
  56   const uid_t uid_;
  57   const gid_t gid_;
  58   const bool supports_deny_setgroups_;
  59   DISALLOW_COPY_AND_ASSIGN(WriteUidGidMapDelegate);
  60 };
  61
  62 void SetEnvironForNamespaceType(base::EnvironmentMap* environ,
  63                                 base::NativeEnvironmentString env_var,
  64                                 bool value) {
  65   // An empty string causes the env var to be unset in the child process.
  66   (*environ)[env_var] = value ? "1" : "";
  67 }
  68
  69 // Linux supports up to 64 signals. This should be updated if that ever changes.
  70 int g_signal_exit_codes[64];
  71
  72 void TerminationSignalHandler(int sig) {
  73   // Return a special exit code so that the process is detected as terminated by
  74   // a signal.
  75   const size_t sig_idx = static_cast<size_t>(sig);
  76   if (sig_idx < arraysize(g_signal_exit_codes)) {
  77     _exit(g_signal_exit_codes[sig_idx]);
  78   }
  79
  80   _exit(NamespaceSandbox::kDefaultExitCode);
  81 }
  82 #endif  // !defined(OS_NACL_NONSFI)
  83
  84 }  // namespace
  85
  86 #if !defined(OS_NACL_NONSFI)
  87 // static
  88 base::Process NamespaceSandbox::LaunchProcess(
  89     const base::CommandLine& cmdline,
  90     const base::LaunchOptions& options) {
  91   return LaunchProcess(cmdline.argv(), options);
  92 }
  93
  94 // static
  95 base::Process NamespaceSandbox::LaunchProcess(
  96     const std::vector<std::string>& argv,
  97     const base::LaunchOptions& options) {
  98   int clone_flags = 0;
  99   int ns_types[] = {CLONE_NEWUSER, CLONE_NEWPID, CLONE_NEWNET};
 100   for (const int ns_type : ns_types) {
 101     if (NamespaceUtils::KernelSupportsUnprivilegedNamespace(ns_type)) {
 102       clone_flags |= ns_type;
 103     }
 104   }
 105   CHECK(clone_flags & CLONE_NEWUSER);
 106
 107   // These fields may not be set by the caller.
 108   CHECK(options.pre_exec_delegate == nullptr);
 109   CHECK_EQ(0, options.clone_flags);
 110
 111   WriteUidGidMapDelegate write_uid_gid_map_delegate;
 112
 113   base::LaunchOptions launch_options = options;
 114   launch_options.pre_exec_delegate = &write_uid_gid_map_delegate;
 115   launch_options.clone_flags = clone_flags;
 116
 117   const std::pair<int, const char*> clone_flag_environ[] = {
 118       std::make_pair(CLONE_NEWUSER, kSandboxUSERNSEnvironmentVarName),
 119       std::make_pair(CLONE_NEWPID, kSandboxPIDNSEnvironmentVarName),
 120       std::make_pair(CLONE_NEWNET, kSandboxNETNSEnvironmentVarName),
 121   };
 122
 123   base::EnvironmentMap* environ = &launch_options.environ;
 124   for (const auto& entry : clone_flag_environ) {
 125     const int flag = entry.first;
 126     const char* environ_name = entry.second;
 127     SetEnvironForNamespaceType(environ, environ_name, clone_flags & flag);
 128   }
 129
 130   return base::LaunchProcess(argv, launch_options);
 131 }
 132
 133 // static
 134 pid_t NamespaceSandbox::ForkInNewPidNamespace(bool drop_capabilities_in_child) {
 135   const pid_t pid =
 136       base::ForkWithFlags(CLONE_NEWPID | SIGCHLD, nullptr, nullptr);
 137   if (pid < 0) {
 138     return pid;
 139   }
 140
 141   if (pid == 0) {
 142     DCHECK_EQ(1, getpid());
 143     if (drop_capabilities_in_child) {
 144       // Since we just forked, we are single-threaded, so this should be safe.
 145       CHECK(Credentials::DropAllCapabilitiesOnCurrentThread());
 146     }
 147     return 0;
 148   }
 149
 150   return pid;
 151 }
 152
 153 // static
 154 void NamespaceSandbox::InstallDefaultTerminationSignalHandlers() {
 155   static const int kDefaultTermSignals[] = {
 156       SIGHUP, SIGINT, SIGABRT, SIGQUIT, SIGPIPE, SIGTERM, SIGUSR1, SIGUSR2,
 157   };
 158
 159   for (const int sig : kDefaultTermSignals) {
 160     InstallTerminationSignalHandler(sig, kDefaultExitCode);
 161   }
 162 }
 163
 164 // static
 165 bool NamespaceSandbox::InstallTerminationSignalHandler(
 166     int sig,
 167     int exit_code) {
 168   struct sigaction old_action;
 169   PCHECK(sigaction(sig, nullptr, &old_action) == 0);
 170
 171   if (old_action.sa_flags & SA_SIGINFO &&
 172       old_action.sa_sigaction != nullptr) {
 173     return false;
 174   } else if (old_action.sa_handler != SIG_DFL) {
 175     return false;
 176   }
 177
 178   const size_t sig_idx = static_cast<size_t>(sig);
 179   CHECK_LT(sig_idx, arraysize(g_signal_exit_codes));
 180
 181   DCHECK_GE(exit_code, 0);
 182   DCHECK_LT(exit_code, 256);
 183
 184   g_signal_exit_codes[sig_idx] = exit_code;
 185
 186   struct sigaction action = {};
 187   action.sa_handler = &TerminationSignalHandler;
 188   PCHECK(sigaction(sig, &action, nullptr) == 0);
 189   return true;
 190 }
 191 #endif  // !defined(OS_NACL_NONSFI)
 192
 193 // static
 194 bool NamespaceSandbox::InNewUserNamespace() {
 195   return getenv(kSandboxUSERNSEnvironmentVarName) != nullptr;
 196 }
 197
 198 // static
 199 bool NamespaceSandbox::InNewPidNamespace() {
 200   return getenv(kSandboxPIDNSEnvironmentVarName) != nullptr;
 201 }
 202
 203 // static
 204 bool NamespaceSandbox::InNewNetNamespace() {
 205   return getenv(kSandboxNETNSEnvironmentVarName) != nullptr;
 206 }
 207
 208 }  // namespace sandbox