sandbox/linux/services/namespace_sandbox.cc

   1 // Copyright 2015 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "sandbox/linux/services/namespace_sandbox.h"
   6
   7 #include <sched.h>
   8 #include <signal.h>
   9 #include <stdlib.h>
  10 #include <sys/types.h>
  11 #include <unistd.h>
  12
  13 #include <string>
  14 #include <utility>
  15 #include <vector>
  16
  17 #include "base/command_line.h"
  18 #include "base/environment.h"
  19 #include "base/files/scoped_file.h"
  20 #include "base/logging.h"
  21 #include "base/macros.h"
  22 #include "base/posix/eintr_wrapper.h"
  23 #include "base/process/launch.h"
  24 #include "base/process/process.h"
  25 #include "sandbox/linux/services/credentials.h"
  26 #include "sandbox/linux/services/namespace_utils.h"
  27 #include "sandbox/linux/services/syscall_wrappers.h"
  28 #include "sandbox/linux/system_headers/linux_signal.h"
  29
  30 namespace sandbox {
  31
  32 namespace {
  33
  34 const char kSandboxUSERNSEnvironmentVarName[] = "SBX_USER_NS";
  35 const char kSandboxPIDNSEnvironmentVarName[] = "SBX_PID_NS";
  36 const char kSandboxNETNSEnvironmentVarName[] = "SBX_NET_NS";
  37
  38 #if !defined(OS_NACL_NONSFI)
  39 class WriteUidGidMapDelegate : public base::LaunchOptions::PreExecDelegate {
  40  public:
  41   WriteUidGidMapDelegate()
  42       : uid_(getuid()),
  43         gid_(getgid()),
  44         supports_deny_setgroups_(
  45             NamespaceUtils::KernelSupportsDenySetgroups()) {}
  46
  47   ~WriteUidGidMapDelegate() override {}
  48
  49   void RunAsyncSafe() override {
  50     if (supports_deny_setgroups_) {
  51       RAW_CHECK(NamespaceUtils::DenySetgroups());
  52     }
  53     RAW_CHECK(NamespaceUtils::WriteToIdMapFile("/proc/self/uid_map", uid_));
  54     RAW_CHECK(NamespaceUtils::WriteToIdMapFile("/proc/self/gid_map", gid_));
  55   }
  56
  57  private:
  58   const uid_t uid_;
  59   const gid_t gid_;
  60   const bool supports_deny_setgroups_;
  61   DISALLOW_COPY_AND_ASSIGN(WriteUidGidMapDelegate);
  62 };
  63
  64 void SetEnvironForNamespaceType(base::EnvironmentMap* environ,
  65                                 base::NativeEnvironmentString env_var,
  66                                 bool value) {
  67   // An empty string causes the env var to be unset in the child process.
  68   (*environ)[env_var] = value ? "1" : "";
  69 }
  70 #endif  // !defined(OS_NACL_NONSFI)
  71
  72 // Linux supports up to 64 signals. This should be updated if that ever changes.
  73 int g_signal_exit_codes[64];
  74
  75 void TerminationSignalHandler(int sig) {
  76   // Return a special exit code so that the process is detected as terminated by
  77   // a signal.
  78   const size_t sig_idx = static_cast<size_t>(sig);
  79   if (sig_idx < arraysize(g_signal_exit_codes)) {
  80     _exit(g_signal_exit_codes[sig_idx]);
  81   }
  82
  83   _exit(NamespaceSandbox::SignalExitCode(sig));
  84 }
  85
  86 }  // namespace
  87
  88 #if !defined(OS_NACL_NONSFI)
  89 // static
  90 base::Process NamespaceSandbox::LaunchProcess(
  91     const base::CommandLine& cmdline,
  92     const base::LaunchOptions& options) {
  93   return LaunchProcess(cmdline.argv(), options);
  94 }
  95
  96 // static
  97 base::Process NamespaceSandbox::LaunchProcess(
  98     const std::vector<std::string>& argv,
  99     const base::LaunchOptions& options) {
 100   int clone_flags = 0;
 101   int ns_types[] = {CLONE_NEWUSER, CLONE_NEWPID, CLONE_NEWNET};
 102   for (const int ns_type : ns_types) {
 103     if (NamespaceUtils::KernelSupportsUnprivilegedNamespace(ns_type)) {
 104       clone_flags |= ns_type;
 105     }
 106   }
 107   CHECK(clone_flags & CLONE_NEWUSER);
 108
 109   // These fields may not be set by the caller.
 110   CHECK(options.pre_exec_delegate == nullptr);
 111   CHECK_EQ(0, options.clone_flags);
 112
 113   WriteUidGidMapDelegate write_uid_gid_map_delegate;
 114
 115   base::LaunchOptions launch_options = options;
 116   launch_options.pre_exec_delegate = &write_uid_gid_map_delegate;
 117   launch_options.clone_flags = clone_flags;
 118
 119   const std::pair<int, const char*> clone_flag_environ[] = {
 120       std::make_pair(CLONE_NEWUSER, kSandboxUSERNSEnvironmentVarName),
 121       std::make_pair(CLONE_NEWPID, kSandboxPIDNSEnvironmentVarName),
 122       std::make_pair(CLONE_NEWNET, kSandboxNETNSEnvironmentVarName),
 123   };
 124
 125   base::EnvironmentMap* environ = &launch_options.environ;
 126   for (const auto& entry : clone_flag_environ) {
 127     const int flag = entry.first;
 128     const char* environ_name = entry.second;
 129     SetEnvironForNamespaceType(environ, environ_name, clone_flags & flag);
 130   }
 131
 132   return base::LaunchProcess(argv, launch_options);
 133 }
 134 #endif  // !defined(OS_NACL_NONSFI)
 135
 136 // static
 137 pid_t NamespaceSandbox::ForkInNewPidNamespace(bool drop_capabilities_in_child) {
 138   const pid_t pid =
 139       base::ForkWithFlags(CLONE_NEWPID | LINUX_SIGCHLD, nullptr, nullptr);
 140   if (pid < 0) {
 141     return pid;
 142   }
 143
 144   if (pid == 0) {
 145     DCHECK_EQ(1, getpid());
 146     if (drop_capabilities_in_child) {
 147       // Since we just forked, we are single-threaded, so this should be safe.
 148       CHECK(Credentials::DropAllCapabilitiesOnCurrentThread());
 149     }
 150     return 0;
 151   }
 152
 153   return pid;
 154 }
 155
 156 // static
 157 void NamespaceSandbox::InstallDefaultTerminationSignalHandlers() {
 158   static const int kDefaultTermSignals[] = {
 159       LINUX_SIGHUP,  LINUX_SIGINT,  LINUX_SIGABRT, LINUX_SIGQUIT,
 160       LINUX_SIGPIPE, LINUX_SIGTERM, LINUX_SIGUSR1, LINUX_SIGUSR2,
 161   };
 162
 163   for (const int sig : kDefaultTermSignals) {
 164     InstallTerminationSignalHandler(sig, SignalExitCode(sig));
 165   }
 166 }
 167
 168 // static
 169 bool NamespaceSandbox::InstallTerminationSignalHandler(
 170     int sig,
 171     int exit_code) {
 172   struct sigaction old_action;
 173   PCHECK(sys_sigaction(sig, nullptr, &old_action) == 0);
 174
 175 #if !defined(OS_NACL_NONSFI)
 176   if (old_action.sa_flags & SA_SIGINFO &&
 177       old_action.sa_sigaction != nullptr) {
 178     return false;
 179   }
 180 #endif
 181
 182   if (old_action.sa_handler != LINUX_SIG_DFL) {
 183     return false;
 184   }
 185
 186   const size_t sig_idx = static_cast<size_t>(sig);
 187   CHECK_LT(sig_idx, arraysize(g_signal_exit_codes));
 188
 189   DCHECK_GE(exit_code, 0);
 190   DCHECK_LT(exit_code, 256);
 191
 192   g_signal_exit_codes[sig_idx] = exit_code;
 193
 194   struct sigaction action = {};
 195   action.sa_handler = &TerminationSignalHandler;
 196   PCHECK(sys_sigaction(sig, &action, nullptr) == 0);
 197   return true;
 198 }
 199
 200 // static
 201 bool NamespaceSandbox::InNewUserNamespace() {
 202   return getenv(kSandboxUSERNSEnvironmentVarName) != nullptr;
 203 }
 204
 205 // static
 206 bool NamespaceSandbox::InNewPidNamespace() {
 207   return getenv(kSandboxPIDNSEnvironmentVarName) != nullptr;
 208 }
 209
 210 // static
 211 bool NamespaceSandbox::InNewNetNamespace() {
 212   return getenv(kSandboxNETNSEnvironmentVarName) != nullptr;
 213 }
 214
 215 }  // namespace sandbox