content/browser/renderer_host/render_sandbox_host_linux.cc

   1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "content/browser/renderer_host/render_sandbox_host_linux.h"
   6
   7 #include <sys/socket.h>
   8
   9 #include "base/memory/singleton.h"
  10 #include "base/posix/eintr_wrapper.h"
  11 #include "content/browser/renderer_host/sandbox_ipc_linux.h"
  12
  13 namespace content {
  14
  15 // Runs on the main thread at startup.
  16 RenderSandboxHostLinux::RenderSandboxHostLinux()
  17     : initialized_(false),
  18       renderer_socket_(0),
  19       childs_lifeline_fd_(0),
  20       pid_(0) {
  21 }
  22
  23 // static
  24 RenderSandboxHostLinux* RenderSandboxHostLinux::GetInstance() {
  25   return Singleton<RenderSandboxHostLinux>::get();
  26 }
  27
  28 void RenderSandboxHostLinux::Init(const std::string& sandbox_path) {
  29   DCHECK(!initialized_);
  30   initialized_ = true;
  31
  32   int fds[2];
  33   // We use SOCK_SEQPACKET rather than SOCK_DGRAM to prevent the renderer from
  34   // sending datagrams to other sockets on the system. The sandbox may prevent
  35   // the renderer from calling socket() to create new sockets, but it'll still
  36   // inherit some sockets. With AF_UNIX+SOCK_DGRAM, it can call sendmsg to send
  37   // a datagram to any (abstract) socket on the same system. With
  38   // SOCK_SEQPACKET, this is prevented.
  39   CHECK(socketpair(AF_UNIX, SOCK_SEQPACKET, 0, fds) == 0);
  40
  41   renderer_socket_ = fds[0];
  42   // The SandboxIPC client is not expected to read from |renderer_socket_|.
  43   // Instead, it reads from a temporary socket sent with the request.
  44   PCHECK(0 == shutdown(renderer_socket_, SHUT_RD)) << "shutdown";
  45
  46   const int browser_socket = fds[1];
  47   // The SandboxIPC handler is not expected to write to |browser_socket|.
  48   // Instead, it replies on a temporary socket provided by the caller.
  49   PCHECK(0 == shutdown(browser_socket, SHUT_WR)) << "shutdown";
  50
  51   int pipefds[2];
  52   CHECK(0 == pipe(pipefds));
  53   const int child_lifeline_fd = pipefds[0];
  54   childs_lifeline_fd_ = pipefds[1];
  55
  56   // We need to be monothreaded before we fork().
  57 #if !defined(THREAD_SANITIZER)
  58   DCHECK_EQ(1, base::GetNumberOfThreads(base::GetCurrentProcessHandle()));
  59 #endif  // !defined(THREAD_SANITIZER)
  60   pid_ = fork();
  61   if (pid_ == 0) {
  62     if (IGNORE_EINTR(close(fds[0])) < 0)
  63       DPLOG(ERROR) << "close";
  64     if (IGNORE_EINTR(close(pipefds[1])) < 0)
  65       DPLOG(ERROR) << "close";
  66
  67     SandboxIPCProcess handler(child_lifeline_fd, browser_socket, sandbox_path);
  68     handler.Run();
  69     _exit(0);
  70   }
  71 }
  72
  73 RenderSandboxHostLinux::~RenderSandboxHostLinux() {
  74   if (initialized_) {
  75     if (IGNORE_EINTR(close(renderer_socket_)) < 0)
  76       PLOG(ERROR) << "close";
  77     if (IGNORE_EINTR(close(childs_lifeline_fd_)) < 0)
  78       PLOG(ERROR) << "close";
  79   }
  80 }
  81
  82 }  // namespace content