sandbox/linux/services/namespace_sandbox.cc

   1 // Copyright 2015 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "sandbox/linux/services/namespace_sandbox.h"
   6
   7 #include <sched.h>
   8 #include <signal.h>
   9 #include <stdlib.h>
  10 #include <sys/types.h>
  11 #include <unistd.h>
  12
  13 #include <string>
  14 #include <utility>
  15 #include <vector>
  16
  17 #include "base/command_line.h"
  18 #include "base/environment.h"
  19 #include "base/files/scoped_file.h"
  20 #include "base/logging.h"
  21 #include "base/macros.h"
  22 #include "base/posix/eintr_wrapper.h"
  23 #include "base/process/launch.h"
  24 #include "base/process/process.h"
  25 #include "sandbox/linux/services/credentials.h"
  26 #include "sandbox/linux/services/namespace_utils.h"
  27 #include "sandbox/linux/services/syscall_wrappers.h"
  28 #include "sandbox/linux/system_headers/linux_signal.h"
  29
  30 namespace sandbox {
  31
  32 namespace {
  33
  34 const char kSandboxUSERNSEnvironmentVarName[] = "SBX_USER_NS";
  35 const char kSandboxPIDNSEnvironmentVarName[] = "SBX_PID_NS";
  36 const char kSandboxNETNSEnvironmentVarName[] = "SBX_NET_NS";
  37
  38 #if !defined(OS_NACL_NONSFI)
  39 class WriteUidGidMapDelegate : public base::LaunchOptions::PreExecDelegate {
  40  public:
  41   WriteUidGidMapDelegate()
  42       : uid_(getuid()),
  43         gid_(getgid()),
  44         supports_deny_setgroups_(
  45             NamespaceUtils::KernelSupportsDenySetgroups()) {}
  46
  47   ~WriteUidGidMapDelegate() override {}
  48
  49   void RunAsyncSafe() override {
  50     if (supports_deny_setgroups_) {
  51       RAW_CHECK(NamespaceUtils::DenySetgroups());
  52     }
  53     RAW_CHECK(NamespaceUtils::WriteToIdMapFile("/proc/self/uid_map", uid_));
  54     RAW_CHECK(NamespaceUtils::WriteToIdMapFile("/proc/self/gid_map", gid_));
  55   }
  56
  57  private:
  58   const uid_t uid_;
  59   const gid_t gid_;
  60   const bool supports_deny_setgroups_;
  61   DISALLOW_COPY_AND_ASSIGN(WriteUidGidMapDelegate);
  62 };
  63
  64 void SetEnvironForNamespaceType(base::EnvironmentMap* environ,
  65                                 base::NativeEnvironmentString env_var,
  66                                 bool value) {
  67   // An empty string causes the env var to be unset in the child process.
  68   (*environ)[env_var] = value ? "1" : "";
  69 }
  70 #endif  // !defined(OS_NACL_NONSFI)
  71
  72 // Linux supports up to 64 signals. This should be updated if that ever changes.
  73 int g_signal_exit_codes[64];
  74
  75 void TerminationSignalHandler(int sig) {
  76   // Return a special exit code so that the process is detected as terminated by
  77   // a signal.
  78   const size_t sig_idx = static_cast<size_t>(sig);
  79   if (sig_idx < arraysize(g_signal_exit_codes)) {
  80     _exit(g_signal_exit_codes[sig_idx]);
  81   }
  82
  83   _exit(NamespaceSandbox::SignalExitCode(sig));
  84 }
  85
  86 }  // namespace
  87
  88 #if !defined(OS_NACL_NONSFI)
  89 NamespaceSandbox::Options::Options()
  90     : ns_types(CLONE_NEWUSER | CLONE_NEWPID | CLONE_NEWNET),
  91       fail_on_unsupported_ns_type(false) {}
  92
  93 NamespaceSandbox::Options::~Options() {}
  94
  95 // static
  96 base::Process NamespaceSandbox::LaunchProcess(
  97     const base::CommandLine& cmdline,
  98     const base::LaunchOptions& launch_options) {
  99   return LaunchProcessWithOptions(cmdline.argv(), launch_options, Options());
 100 }
 101
 102 // static
 103 base::Process NamespaceSandbox::LaunchProcess(
 104     const std::vector<std::string>& argv,
 105     const base::LaunchOptions& launch_options) {
 106   return LaunchProcessWithOptions(argv, launch_options, Options());
 107 }
 108
 109 // static
 110 base::Process NamespaceSandbox::LaunchProcessWithOptions(
 111     const base::CommandLine& cmdline,
 112     const base::LaunchOptions& launch_options,
 113     const Options& ns_sandbox_options) {
 114   return LaunchProcessWithOptions(cmdline.argv(), launch_options,
 115                                   ns_sandbox_options);
 116 }
 117
 118 // static
 119 base::Process NamespaceSandbox::LaunchProcessWithOptions(
 120     const std::vector<std::string>& argv,
 121     const base::LaunchOptions& launch_options,
 122     const Options& ns_sandbox_options) {
 123   // These fields may not be set by the caller.
 124   CHECK(launch_options.pre_exec_delegate == nullptr);
 125   CHECK_EQ(0, launch_options.clone_flags);
 126
 127   int clone_flags = 0;
 128   const int kSupportedTypes[] = {CLONE_NEWUSER, CLONE_NEWPID, CLONE_NEWNET};
 129   for (const int ns_type : kSupportedTypes) {
 130     if ((ns_type & ns_sandbox_options.ns_types) == 0) {
 131       continue;
 132     }
 133
 134     if (NamespaceUtils::KernelSupportsUnprivilegedNamespace(ns_type)) {
 135       clone_flags |= ns_type;
 136     } else if (ns_sandbox_options.fail_on_unsupported_ns_type) {
 137       return base::Process();
 138     }
 139   }
 140   CHECK(clone_flags & CLONE_NEWUSER);
 141
 142   WriteUidGidMapDelegate write_uid_gid_map_delegate;
 143
 144   base::LaunchOptions launch_options_copy = launch_options;
 145   launch_options_copy.pre_exec_delegate = &write_uid_gid_map_delegate;
 146   launch_options_copy.clone_flags = clone_flags;
 147
 148   const std::pair<int, const char*> clone_flag_environ[] = {
 149       std::make_pair(CLONE_NEWUSER, kSandboxUSERNSEnvironmentVarName),
 150       std::make_pair(CLONE_NEWPID, kSandboxPIDNSEnvironmentVarName),
 151       std::make_pair(CLONE_NEWNET, kSandboxNETNSEnvironmentVarName),
 152   };
 153
 154   base::EnvironmentMap* environ = &launch_options_copy.environ;
 155   for (const auto& entry : clone_flag_environ) {
 156     const int flag = entry.first;
 157     const char* environ_name = entry.second;
 158     SetEnvironForNamespaceType(environ, environ_name, clone_flags & flag);
 159   }
 160
 161   return base::LaunchProcess(argv, launch_options_copy);
 162 }
 163 #endif  // !defined(OS_NACL_NONSFI)
 164
 165 // static
 166 pid_t NamespaceSandbox::ForkInNewPidNamespace(bool drop_capabilities_in_child) {
 167   const pid_t pid =
 168       base::ForkWithFlags(CLONE_NEWPID | LINUX_SIGCHLD, nullptr, nullptr);
 169   if (pid < 0) {
 170     return pid;
 171   }
 172
 173   if (pid == 0) {
 174     DCHECK_EQ(1, getpid());
 175     if (drop_capabilities_in_child) {
 176       // Since we just forked, we are single-threaded, so this should be safe.
 177       CHECK(Credentials::DropAllCapabilitiesOnCurrentThread());
 178     }
 179     return 0;
 180   }
 181
 182   return pid;
 183 }
 184
 185 // static
 186 void NamespaceSandbox::InstallDefaultTerminationSignalHandlers() {
 187   static const int kDefaultTermSignals[] = {
 188       LINUX_SIGHUP,  LINUX_SIGINT,  LINUX_SIGABRT, LINUX_SIGQUIT,
 189       LINUX_SIGPIPE, LINUX_SIGTERM, LINUX_SIGUSR1, LINUX_SIGUSR2,
 190   };
 191
 192   for (const int sig : kDefaultTermSignals) {
 193     InstallTerminationSignalHandler(sig, SignalExitCode(sig));
 194   }
 195 }
 196
 197 // static
 198 bool NamespaceSandbox::InstallTerminationSignalHandler(
 199     int sig,
 200     int exit_code) {
 201   struct sigaction old_action;
 202   PCHECK(sys_sigaction(sig, nullptr, &old_action) == 0);
 203
 204 #if !defined(OS_NACL_NONSFI)
 205   if (old_action.sa_flags & SA_SIGINFO &&
 206       old_action.sa_sigaction != nullptr) {
 207     return false;
 208   }
 209 #endif
 210
 211   if (old_action.sa_handler != LINUX_SIG_DFL) {
 212     return false;
 213   }
 214
 215   const size_t sig_idx = static_cast<size_t>(sig);
 216   CHECK_LT(sig_idx, arraysize(g_signal_exit_codes));
 217
 218   DCHECK_GE(exit_code, 0);
 219   DCHECK_LT(exit_code, 256);
 220
 221   g_signal_exit_codes[sig_idx] = exit_code;
 222
 223   struct sigaction action = {};
 224   action.sa_handler = &TerminationSignalHandler;
 225   PCHECK(sys_sigaction(sig, &action, nullptr) == 0);
 226   return true;
 227 }
 228
 229 // static
 230 bool NamespaceSandbox::InNewUserNamespace() {
 231   return getenv(kSandboxUSERNSEnvironmentVarName) != nullptr;
 232 }
 233
 234 // static
 235 bool NamespaceSandbox::InNewPidNamespace() {
 236   return getenv(kSandboxPIDNSEnvironmentVarName) != nullptr;
 237 }
 238
 239 // static
 240 bool NamespaceSandbox::InNewNetNamespace() {
 241   return getenv(kSandboxNETNSEnvironmentVarName) != nullptr;
 242 }
 243
 244 }  // namespace sandbox