content/common/sandbox_linux/sandbox_linux.h

   1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #ifndef CONTENT_COMMON_SANDBOX_LINUX_SANDBOX_LINUX_H_
   6 #define CONTENT_COMMON_SANDBOX_LINUX_SANDBOX_LINUX_H_
   7
   8 #include <string>
   9 #include <vector>
  10
  11 #include "base/basictypes.h"
  12 #include "base/logging.h"
  13 #include "base/memory/scoped_ptr.h"
  14 #include "content/public/common/sandbox_linux.h"
  15
  16 #if defined(ADDRESS_SANITIZER) || defined(MEMORY_SANITIZER) || \
  17     defined(THREAD_SANITIZER) || defined(LEAK_SANITIZER) || \
  18     defined(UNDEFINED_SANITIZER) || defined(SANITIZER_COVERAGE)
  19 #include <sanitizer/common_interface_defs.h>
  20 #define ANY_OF_AMTLU_SANITIZER 1
  21 #endif
  22
  23 namespace base {
  24 template <typename T>
  25 struct DefaultSingletonTraits;
  26 class Thread;
  27 }
  28 namespace sandbox { class SetuidSandboxClient; }
  29
  30 namespace content {
  31
  32 // A singleton class to represent and change our sandboxing state for the
  33 // three main Linux sandboxes.
  34 // The sandboxing model allows using two layers of sandboxing. The first layer
  35 // can be implemented either with unprivileged namespaces or with the setuid
  36 // sandbox. This class provides a way to engage the namespace sandbox, but does
  37 // not deal with the legacy setuid sandbox directly.
  38 // The second layer is mainly based on seccomp-bpf and is engaged with
  39 // InitializeSandbox(). InitializeSandbox() is also responsible for "sealing"
  40 // the first layer of sandboxing. That is, InitializeSandbox must always be
  41 // called to have any meaningful sandboxing at all.
  42 class LinuxSandbox {
  43  public:
  44   // This is a list of sandbox IPC methods which the renderer may send to the
  45   // sandbox host. See http://code.google.com/p/chromium/wiki/LinuxSandboxIPC
  46   // This isn't the full list, values < 32 are reserved for methods called from
  47   // Skia.
  48   enum LinuxSandboxIPCMethods {
  49     METHOD_GET_FALLBACK_FONT_FOR_CHAR = 32,
  50     METHOD_LOCALTIME = 33,
  51     DEPRECATED_METHOD_GET_CHILD_WITH_INODE = 34,
  52     METHOD_GET_STYLE_FOR_STRIKE = 35,
  53     METHOD_MAKE_SHARED_MEMORY_SEGMENT = 36,
  54     METHOD_MATCH_WITH_FALLBACK = 37,
  55   };
  56
  57   // Get our singleton instance.
  58   static LinuxSandbox* GetInstance();
  59
  60   // Do some initialization that can only be done before any of the sandboxes
  61   // are enabled. If using the setuid sandbox, this should be called manually
  62   // before the setuid sandbox is engaged.
  63   // Security: When this runs, it is imperative that either InitializeSandbox()
  64   // runs as well or that all file descriptors returned in
  65   // GetFileDescriptorsToClose() get closed.
  66   // Otherwise file descriptors that bypass the security of the setuid sandbox
  67   // would be kept open. One must be particularly careful if a process performs
  68   // a fork().
  69   void PreinitializeSandbox();
  70
  71   // Check that the current process is the init process of a new PID
  72   // namespace and then proceed to drop access to the file system by using
  73   // a new unprivileged namespace. This is a layer-1 sandbox.
  74   // In order for this sandbox to be effective, it must be "sealed" by calling
  75   // InitializeSandbox().
  76   void EngageNamespaceSandbox();
  77
  78   // Return a list of file descriptors to close if PreinitializeSandbox() ran
  79   // but InitializeSandbox() won't. Avoid using.
  80   // TODO(jln): get rid of this hack.
  81   std::vector<int> GetFileDescriptorsToClose();
  82
  83   // Seal an eventual layer-1 sandbox and initialize the layer-2 sandbox with
  84   // an adequate policy depending on the process type and command line
  85   // arguments.
  86   // Currently the layer-2 sandbox is composed of seccomp-bpf and address space
  87   // limitations. This will instantiate the LinuxSandbox singleton if it
  88   // doesn't already exist.
  89   // This function should only be called without any thread running.
  90   static bool InitializeSandbox();
  91
  92   // Stop |thread| in a way that can be trusted by the sandbox.
  93   static void StopThread(base::Thread* thread);
  94
  95   // Returns the status of the renderer, worker and ppapi sandbox. Can only
  96   // be queried after going through PreinitializeSandbox(). This is a bitmask
  97   // and uses the constants defined in "enum LinuxSandboxStatus". Since the
  98   // status needs to be provided before the sandboxes are actually started,
  99   // this returns what will actually happen once InitializeSandbox()
 100   // is called from inside these processes.
 101   int GetStatus();
 102   // Returns true if the current process is single-threaded or if the number
 103   // of threads cannot be determined.
 104   bool IsSingleThreaded() const;
 105   // Did we start Seccomp BPF?
 106   bool seccomp_bpf_started() const;
 107
 108   // Simple accessor for our instance of the setuid sandbox. Will never return
 109   // NULL.
 110   // There is no StartSetuidSandbox(), the SetuidSandboxClient instance should
 111   // be used directly.
 112   sandbox::SetuidSandboxClient* setuid_sandbox_client() const;
 113
 114   // Check the policy and eventually start the seccomp-bpf sandbox. This should
 115   // never be called with threads started. If we detect that threads have
 116   // started we will crash.
 117   bool StartSeccompBPF(const std::string& process_type);
 118
 119   // Limit the address space of the current process (and its children).
 120   // to make some vulnerabilities harder to exploit.
 121   bool LimitAddressSpace(const std::string& process_type);
 122
 123   // Returns a file descriptor to proc. The file descriptor is no longer valid
 124   // after the sandbox has been sealed.
 125   int proc_fd() const {
 126     DCHECK_NE(-1, proc_fd_);
 127     return proc_fd_;
 128   }
 129
 130 #if defined(ANY_OF_AMTLU_SANITIZER)
 131   __sanitizer_sandbox_arguments* sanitizer_args() const {
 132     return sanitizer_args_.get();
 133   };
 134 #endif
 135
 136  private:
 137   friend struct base::DefaultSingletonTraits<LinuxSandbox>;
 138
 139   LinuxSandbox();
 140   ~LinuxSandbox();
 141
 142   // Some methods are static and get an instance of the Singleton. These
 143   // are the non-static implementations.
 144   bool InitializeSandboxImpl();
 145   void StopThreadImpl(base::Thread* thread);
 146   // We must have been pre_initialized_ before using these.
 147   bool seccomp_bpf_supported() const;
 148   bool seccomp_bpf_with_tsync_supported() const;
 149   // Returns true if it can be determined that the current process has open
 150   // directories that are not managed by the LinuxSandbox class. This would
 151   // be a vulnerability as it would allow to bypass the setuid sandbox.
 152   bool HasOpenDirectories() const;
 153   // The last part of the initialization is to make sure any temporary "hole"
 154   // in the sandbox is closed. For now, this consists of closing proc_fd_.
 155   void SealSandbox();
 156   // GetStatus() makes promises as to how the sandbox will behave. This
 157   // checks that no promises have been broken.
 158   void CheckForBrokenPromises(const std::string& process_type);
 159   // Stop |thread| and make sure it does not appear in /proc/self/tasks/
 160   // anymore.
 161   void StopThreadAndEnsureNotCounted(base::Thread* thread) const;
 162
 163   // A file descriptor to /proc. It's dangerous to have it around as it could
 164   // allow for sandbox bypasses. It needs to be closed before we consider
 165   // ourselves sandboxed.
 166   int proc_fd_;
 167   bool seccomp_bpf_started_;
 168   // The value returned by GetStatus(). Gets computed once and then cached.
 169   int sandbox_status_flags_;
 170   // Did PreinitializeSandbox() run?
 171   bool pre_initialized_;
 172   bool seccomp_bpf_supported_;  // Accurate if pre_initialized_.
 173   bool seccomp_bpf_with_tsync_supported_;  // Accurate if pre_initialized_.
 174   bool yama_is_enforcing_;  // Accurate if pre_initialized_.
 175   bool initialize_sandbox_ran_;  // InitializeSandbox() was called.
 176   scoped_ptr<sandbox::SetuidSandboxClient> setuid_sandbox_client_;
 177 #if defined(ANY_OF_AMTLU_SANITIZER)
 178   scoped_ptr<__sanitizer_sandbox_arguments> sanitizer_args_;
 179 #endif
 180
 181   DISALLOW_COPY_AND_ASSIGN(LinuxSandbox);
 182 };
 183
 184 }  // namespace content
 185
 186 #endif  // CONTENT_COMMON_SANDBOX_LINUX_SANDBOX_LINUX_H_