content/zygote/zygote_main_linux.cc

   1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "content/zygote/zygote_main.h"
   6
   7 #include <dlfcn.h>
   8 #include <fcntl.h>
   9 #include <pthread.h>
  10 #include <signal.h>
  11 #include <string.h>
  12 #include <sys/socket.h>
  13 #include <sys/types.h>
  14 #include <unistd.h>
  15
  16 #include "base/basictypes.h"
  17 #include "base/bind.h"
  18 #include "base/command_line.h"
  19 #include "base/compiler_specific.h"
  20 #include "base/memory/scoped_vector.h"
  21 #include "base/native_library.h"
  22 #include "base/pickle.h"
  23 #include "base/posix/eintr_wrapper.h"
  24 #include "base/posix/unix_domain_socket_linux.h"
  25 #include "base/rand_util.h"
  26 #include "base/strings/safe_sprintf.h"
  27 #include "base/strings/string_number_conversions.h"
  28 #include "base/sys_info.h"
  29 #include "build/build_config.h"
  30 #include "content/common/child_process_sandbox_support_impl_linux.h"
  31 #include "content/common/font_config_ipc_linux.h"
  32 #include "content/common/sandbox_linux/sandbox_linux.h"
  33 #include "content/common/zygote_commands_linux.h"
  34 #include "content/public/common/content_switches.h"
  35 #include "content/public/common/main_function_params.h"
  36 #include "content/public/common/sandbox_linux.h"
  37 #include "content/public/common/zygote_fork_delegate_linux.h"
  38 #include "content/zygote/zygote_linux.h"
  39 #include "crypto/nss_util.h"
  40 #include "sandbox/linux/services/init_process_reaper.h"
  41 #include "sandbox/linux/services/libc_urandom_override.h"
  42 #include "sandbox/linux/suid/client/setuid_sandbox_client.h"
  43 #include "third_party/icu/source/i18n/unicode/timezone.h"
  44 #include "third_party/skia/include/ports/SkFontConfigInterface.h"
  45
  46 #if defined(OS_LINUX)
  47 #include <sys/prctl.h>
  48 #endif
  49
  50 #if defined(USE_OPENSSL)
  51 #include <openssl/rand.h>
  52 #endif
  53
  54 #if defined(ENABLE_PLUGINS)
  55 #include "content/common/pepper_plugin_list.h"
  56 #include "content/public/common/pepper_plugin_info.h"
  57 #endif
  58
  59 #if defined(ENABLE_WEBRTC)
  60 #include "third_party/libjingle/overrides/init_webrtc.h"
  61 #endif
  62
  63 #if defined(ADDRESS_SANITIZER)
  64 #include <sanitizer/asan_interface.h>
  65 #endif
  66
  67 namespace content {
  68
  69 namespace {
  70
  71 void DoChrootSignalHandler(int) {
  72   const int old_errno = errno;
  73   const char kFirstMessage[] = "Chroot signal handler called.\n";
  74   ignore_result(write(STDERR_FILENO, kFirstMessage, sizeof(kFirstMessage) - 1));
  75
  76   const int chroot_ret = chroot("/");
  77
  78   char kSecondMessage[100];
  79   const ssize_t printed =
  80       base::strings::SafeSPrintf(kSecondMessage,
  81                                  "chroot() returned %d. Errno is %d.\n",
  82                                  chroot_ret,
  83                                  errno);
  84   if (printed > 0 && printed < static_cast<ssize_t>(sizeof(kSecondMessage))) {
  85     ignore_result(write(STDERR_FILENO, kSecondMessage, printed));
  86   }
  87   errno = old_errno;
  88 }
  89
  90 // This is a quick hack to allow testing sandbox crash reports in production
  91 // binaries.
  92 // This installs a signal handler for SIGUSR2 that performs a chroot().
  93 // In most of our BPF policies, it is a "watched" system call which will
  94 // trigger a SIGSYS signal whose handler will crash.
  95 // This has been added during the investigation of https://crbug.com/415842.
  96 void InstallSandboxCrashTestHandler() {
  97   struct sigaction act = {};
  98   act.sa_handler = DoChrootSignalHandler;
  99   CHECK_EQ(0, sigemptyset(&act.sa_mask));
 100   act.sa_flags = 0;
 101
 102   PCHECK(0 == sigaction(SIGUSR2, &act, NULL));
 103 }
 104 }  // namespace
 105
 106 // See http://code.google.com/p/chromium/wiki/LinuxZygote
 107
 108 static void ProxyLocaltimeCallToBrowser(time_t input, struct tm* output,
 109                                         char* timezone_out,
 110                                         size_t timezone_out_len) {
 111   Pickle request;
 112   request.WriteInt(LinuxSandbox::METHOD_LOCALTIME);
 113   request.WriteString(
 114       std::string(reinterpret_cast<char*>(&input), sizeof(input)));
 115
 116   uint8_t reply_buf[512];
 117   const ssize_t r = UnixDomainSocket::SendRecvMsg(
 118       GetSandboxFD(), reply_buf, sizeof(reply_buf), NULL,
 119       request);
 120   if (r == -1) {
 121     memset(output, 0, sizeof(struct tm));
 122     return;
 123   }
 124
 125   Pickle reply(reinterpret_cast<char*>(reply_buf), r);
 126   PickleIterator iter(reply);
 127   std::string result, timezone;
 128   if (!reply.ReadString(&iter, &result) ||
 129       !reply.ReadString(&iter, &timezone) ||
 130       result.size() != sizeof(struct tm)) {
 131     memset(output, 0, sizeof(struct tm));
 132     return;
 133   }
 134
 135   memcpy(output, result.data(), sizeof(struct tm));
 136   if (timezone_out_len) {
 137     const size_t copy_len = std::min(timezone_out_len - 1, timezone.size());
 138     memcpy(timezone_out, timezone.data(), copy_len);
 139     timezone_out[copy_len] = 0;
 140     output->tm_zone = timezone_out;
 141   } else {
 142     output->tm_zone = NULL;
 143   }
 144 }
 145
 146 static bool g_am_zygote_or_renderer = false;
 147
 148 // Sandbox interception of libc calls.
 149 //
 150 // Because we are running in a sandbox certain libc calls will fail (localtime
 151 // being the motivating example - it needs to read /etc/localtime). We need to
 152 // intercept these calls and proxy them to the browser. However, these calls
 153 // may come from us or from our libraries. In some cases we can't just change
 154 // our code.
 155 //
 156 // It's for these cases that we have the following setup:
 157 //
 158 // We define global functions for those functions which we wish to override.
 159 // Since we will be first in the dynamic resolution order, the dynamic linker
 160 // will point callers to our versions of these functions. However, we have the
 161 // same binary for both the browser and the renderers, which means that our
 162 // overrides will apply in the browser too.
 163 //
 164 // The global |g_am_zygote_or_renderer| is true iff we are in a zygote or
 165 // renderer process. It's set in ZygoteMain and inherited by the renderers when
 166 // they fork. (This means that it'll be incorrect for global constructor
 167 // functions and before ZygoteMain is called - beware).
 168 //
 169 // Our replacement functions can check this global and either proxy
 170 // the call to the browser over the sandbox IPC
 171 // (http://code.google.com/p/chromium/wiki/LinuxSandboxIPC) or they can use
 172 // dlsym with RTLD_NEXT to resolve the symbol, ignoring any symbols in the
 173 // current module.
 174 //
 175 // Other avenues:
 176 //
 177 // Our first attempt involved some assembly to patch the GOT of the current
 178 // module. This worked, but was platform specific and doesn't catch the case
 179 // where a library makes a call rather than current module.
 180 //
 181 // We also considered patching the function in place, but this would again by
 182 // platform specific and the above technique seems to work well enough.
 183
 184 typedef struct tm* (*LocaltimeFunction)(const time_t* timep);
 185 typedef struct tm* (*LocaltimeRFunction)(const time_t* timep,
 186                                          struct tm* result);
 187
 188 static pthread_once_t g_libc_localtime_funcs_guard = PTHREAD_ONCE_INIT;
 189 static LocaltimeFunction g_libc_localtime;
 190 static LocaltimeFunction g_libc_localtime64;
 191 static LocaltimeRFunction g_libc_localtime_r;
 192 static LocaltimeRFunction g_libc_localtime64_r;
 193
 194 static void InitLibcLocaltimeFunctions() {
 195   g_libc_localtime = reinterpret_cast<LocaltimeFunction>(
 196       dlsym(RTLD_NEXT, "localtime"));
 197   g_libc_localtime64 = reinterpret_cast<LocaltimeFunction>(
 198       dlsym(RTLD_NEXT, "localtime64"));
 199   g_libc_localtime_r = reinterpret_cast<LocaltimeRFunction>(
 200       dlsym(RTLD_NEXT, "localtime_r"));
 201   g_libc_localtime64_r = reinterpret_cast<LocaltimeRFunction>(
 202       dlsym(RTLD_NEXT, "localtime64_r"));
 203
 204   if (!g_libc_localtime || !g_libc_localtime_r) {
 205     // http://code.google.com/p/chromium/issues/detail?id=16800
 206     //
 207     // Nvidia's libGL.so overrides dlsym for an unknown reason and replaces
 208     // it with a version which doesn't work. In this case we'll get a NULL
 209     // result. There's not a lot we can do at this point, so we just bodge it!
 210     LOG(ERROR) << "Your system is broken: dlsym doesn't work! This has been "
 211                   "reported to be caused by Nvidia's libGL. You should expect"
 212                   " time related functions to misbehave. "
 213                   "http://code.google.com/p/chromium/issues/detail?id=16800";
 214   }
 215
 216   if (!g_libc_localtime)
 217     g_libc_localtime = gmtime;
 218   if (!g_libc_localtime64)
 219     g_libc_localtime64 = g_libc_localtime;
 220   if (!g_libc_localtime_r)
 221     g_libc_localtime_r = gmtime_r;
 222   if (!g_libc_localtime64_r)
 223     g_libc_localtime64_r = g_libc_localtime_r;
 224 }
 225
 226 // Define localtime_override() function with asm name "localtime", so that all
 227 // references to localtime() will resolve to this function. Notice that we need
 228 // to set visibility attribute to "default" to export the symbol, as it is set
 229 // to "hidden" by default in chrome per build/common.gypi.
 230 __attribute__ ((__visibility__("default")))
 231 struct tm* localtime_override(const time_t* timep) __asm__ ("localtime");
 232
 233 __attribute__ ((__visibility__("default")))
 234 struct tm* localtime_override(const time_t* timep) {
 235   if (g_am_zygote_or_renderer) {
 236     static struct tm time_struct;
 237     static char timezone_string[64];
 238     ProxyLocaltimeCallToBrowser(*timep, &time_struct, timezone_string,
 239                                 sizeof(timezone_string));
 240     return &time_struct;
 241   } else {
 242     CHECK_EQ(0, pthread_once(&g_libc_localtime_funcs_guard,
 243                              InitLibcLocaltimeFunctions));
 244     struct tm* res = g_libc_localtime(timep);
 245 #if defined(MEMORY_SANITIZER)
 246     if (res) __msan_unpoison(res, sizeof(*res));
 247     if (res->tm_zone) __msan_unpoison_string(res->tm_zone);
 248 #endif
 249     return res;
 250   }
 251 }
 252
 253 // Use same trick to override localtime64(), localtime_r() and localtime64_r().
 254 __attribute__ ((__visibility__("default")))
 255 struct tm* localtime64_override(const time_t* timep) __asm__ ("localtime64");
 256
 257 __attribute__ ((__visibility__("default")))
 258 struct tm* localtime64_override(const time_t* timep) {
 259   if (g_am_zygote_or_renderer) {
 260     static struct tm time_struct;
 261     static char timezone_string[64];
 262     ProxyLocaltimeCallToBrowser(*timep, &time_struct, timezone_string,
 263                                 sizeof(timezone_string));
 264     return &time_struct;
 265   } else {
 266     CHECK_EQ(0, pthread_once(&g_libc_localtime_funcs_guard,
 267                              InitLibcLocaltimeFunctions));
 268     struct tm* res = g_libc_localtime64(timep);
 269 #if defined(MEMORY_SANITIZER)
 270     if (res) __msan_unpoison(res, sizeof(*res));
 271     if (res->tm_zone) __msan_unpoison_string(res->tm_zone);
 272 #endif
 273     return res;
 274   }
 275 }
 276
 277 __attribute__ ((__visibility__("default")))
 278 struct tm* localtime_r_override(const time_t* timep,
 279                                 struct tm* result) __asm__ ("localtime_r");
 280
 281 __attribute__ ((__visibility__("default")))
 282 struct tm* localtime_r_override(const time_t* timep, struct tm* result) {
 283   if (g_am_zygote_or_renderer) {
 284     ProxyLocaltimeCallToBrowser(*timep, result, NULL, 0);
 285     return result;
 286   } else {
 287     CHECK_EQ(0, pthread_once(&g_libc_localtime_funcs_guard,
 288                              InitLibcLocaltimeFunctions));
 289     struct tm* res = g_libc_localtime_r(timep, result);
 290 #if defined(MEMORY_SANITIZER)
 291     if (res) __msan_unpoison(res, sizeof(*res));
 292     if (res->tm_zone) __msan_unpoison_string(res->tm_zone);
 293 #endif
 294     return res;
 295   }
 296 }
 297
 298 __attribute__ ((__visibility__("default")))
 299 struct tm* localtime64_r_override(const time_t* timep,
 300                                   struct tm* result) __asm__ ("localtime64_r");
 301
 302 __attribute__ ((__visibility__("default")))
 303 struct tm* localtime64_r_override(const time_t* timep, struct tm* result) {
 304   if (g_am_zygote_or_renderer) {
 305     ProxyLocaltimeCallToBrowser(*timep, result, NULL, 0);
 306     return result;
 307   } else {
 308     CHECK_EQ(0, pthread_once(&g_libc_localtime_funcs_guard,
 309                              InitLibcLocaltimeFunctions));
 310     struct tm* res = g_libc_localtime64_r(timep, result);
 311 #if defined(MEMORY_SANITIZER)
 312     if (res) __msan_unpoison(res, sizeof(*res));
 313     if (res->tm_zone) __msan_unpoison_string(res->tm_zone);
 314 #endif
 315     return res;
 316   }
 317 }
 318
 319 #if defined(ENABLE_PLUGINS)
 320 // Loads the (native) libraries but does not initialize them (i.e., does not
 321 // call PPP_InitializeModule). This is needed by the zygote on Linux to get
 322 // access to the plugins before entering the sandbox.
 323 void PreloadPepperPlugins() {
 324   std::vector<PepperPluginInfo> plugins;
 325   ComputePepperPluginList(&plugins);
 326   for (size_t i = 0; i < plugins.size(); ++i) {
 327     if (!plugins[i].is_internal && plugins[i].is_sandboxed) {
 328       base::NativeLibraryLoadError error;
 329       base::NativeLibrary library = base::LoadNativeLibrary(plugins[i].path,
 330                                                             &error);
 331       VLOG_IF(1, !library) << "Unable to load plugin "
 332                            << plugins[i].path.value() << " "
 333                            << error.ToString();
 334
 335       (void)library;  // Prevent release-mode warning.
 336     }
 337   }
 338 }
 339 #endif
 340
 341 // This function triggers the static and lazy construction of objects that need
 342 // to be created before imposing the sandbox.
 343 static void ZygotePreSandboxInit() {
 344   base::RandUint64();
 345
 346   base::SysInfo::AmountOfPhysicalMemory();
 347   base::SysInfo::MaxSharedMemorySize();
 348   base::SysInfo::NumberOfProcessors();
 349
 350   // ICU DateFormat class (used in base/time_format.cc) needs to get the
 351   // Olson timezone ID by accessing the zoneinfo files on disk. After
 352   // TimeZone::createDefault is called once here, the timezone ID is
 353   // cached and there's no more need to access the file system.
 354   scoped_ptr<icu::TimeZone> zone(icu::TimeZone::createDefault());
 355
 356 #if defined(USE_NSS)
 357   // NSS libraries are loaded before sandbox is activated. This is to allow
 358   // successful initialization of NSS which tries to load extra library files.
 359   crypto::LoadNSSLibraries();
 360 #elif defined(USE_OPENSSL)
 361   // Read a random byte in order to cause BoringSSL to open a file descriptor
 362   // for /dev/urandom.
 363   uint8_t scratch;
 364   RAND_bytes(&scratch, 1);
 365 #else
 366   // It's possible that another hypothetical crypto stack would not require
 367   // pre-sandbox init, but more likely this is just a build configuration error.
 368   #error Which SSL library are you using?
 369 #endif
 370 #if defined(ENABLE_PLUGINS)
 371   // Ensure access to the Pepper plugins before the sandbox is turned on.
 372   PreloadPepperPlugins();
 373 #endif
 374 #if defined(ENABLE_WEBRTC)
 375   InitializeWebRtcModule();
 376 #endif
 377   SkFontConfigInterface::SetGlobal(
 378       new FontConfigIPC(GetSandboxFD()))->unref();
 379 }
 380
 381 static bool CreateInitProcessReaper(base::Closure* post_fork_parent_callback) {
 382   // The current process becomes init(1), this function returns from a
 383   // newly created process.
 384   const bool init_created =
 385       sandbox::CreateInitProcessReaper(post_fork_parent_callback);
 386   if (!init_created) {
 387     LOG(ERROR) << "Error creating an init process to reap zombies";
 388     return false;
 389   }
 390   return true;
 391 }
 392
 393 // Enter the setuid sandbox. This requires the current process to have been
 394 // created through the setuid sandbox.
 395 static bool EnterSuidSandbox(sandbox::SetuidSandboxClient* setuid_sandbox,
 396                              base::Closure* post_fork_parent_callback) {
 397   DCHECK(setuid_sandbox);
 398   DCHECK(setuid_sandbox->IsSuidSandboxChild());
 399
 400   // Use the SUID sandbox.  This still allows the seccomp sandbox to
 401   // be enabled by the process later.
 402
 403   if (!setuid_sandbox->IsSuidSandboxUpToDate()) {
 404     LOG(WARNING) <<
 405         "You are using a wrong version of the setuid binary!\n"
 406         "Please read "
 407         "https://code.google.com/p/chromium/wiki/LinuxSUIDSandboxDevelopment."
 408         "\n\n";
 409   }
 410
 411   if (!setuid_sandbox->ChrootMe())
 412     return false;
 413
 414   if (setuid_sandbox->IsInNewPIDNamespace()) {
 415     CHECK_EQ(1, getpid())
 416         << "The SUID sandbox created a new PID namespace but Zygote "
 417            "is not the init process. Please, make sure the SUID "
 418            "binary is up to date.";
 419   }
 420
 421   if (getpid() == 1) {
 422     // The setuid sandbox has created a new PID namespace and we need
 423     // to assume the role of init.
 424     CHECK(CreateInitProcessReaper(post_fork_parent_callback));
 425   }
 426
 427 #if !defined(OS_OPENBSD)
 428   // Previously, we required that the binary be non-readable. This causes the
 429   // kernel to mark the process as non-dumpable at startup. The thinking was
 430   // that, although we were putting the renderers into a PID namespace (with
 431   // the SUID sandbox), they would nonetheless be in the /same/ PID
 432   // namespace. So they could ptrace each other unless they were non-dumpable.
 433   //
 434   // If the binary was readable, then there would be a window between process
 435   // startup and the point where we set the non-dumpable flag in which a
 436   // compromised renderer could ptrace attach.
 437   //
 438   // However, now that we have a zygote model, only the (trusted) zygote
 439   // exists at this point and we can set the non-dumpable flag which is
 440   // inherited by all our renderer children.
 441   //
 442   // Note: a non-dumpable process can't be debugged. To debug sandbox-related
 443   // issues, one can specify --allow-sandbox-debugging to let the process be
 444   // dumpable.
 445   const CommandLine& command_line = *CommandLine::ForCurrentProcess();
 446   if (!command_line.HasSwitch(switches::kAllowSandboxDebugging)) {
 447     prctl(PR_SET_DUMPABLE, 0, 0, 0, 0);
 448     if (prctl(PR_GET_DUMPABLE, 0, 0, 0, 0)) {
 449       LOG(ERROR) << "Failed to set non-dumpable flag";
 450       return false;
 451     }
 452   } else {
 453     // If sandbox debugging is allowed, install a handler for sandbox-related
 454     // crash testing.
 455     InstallSandboxCrashTestHandler();
 456   }
 457
 458 #endif
 459
 460   return true;
 461 }
 462
 463 #if defined(ADDRESS_SANITIZER)
 464 const size_t kSanitizerMaxMessageLength = 1 * 1024 * 1024;
 465
 466 // A helper process which collects code coverage data from the renderers over a
 467 // socket and dumps it to a file. See http://crbug.com/336212 for discussion.
 468 static void SanitizerCoverageHelper(int socket_fd, int file_fd) {
 469   scoped_ptr<char[]> buffer(new char[kSanitizerMaxMessageLength]);
 470   while (true) {
 471     ssize_t received_size = HANDLE_EINTR(
 472         recv(socket_fd, buffer.get(), kSanitizerMaxMessageLength, 0));
 473     PCHECK(received_size >= 0);
 474     if (received_size == 0)
 475       // All clients have closed the socket. We should die.
 476       _exit(0);
 477     PCHECK(file_fd >= 0);
 478     ssize_t written_size = 0;
 479     while (written_size < received_size) {
 480       ssize_t write_res =
 481           HANDLE_EINTR(write(file_fd, buffer.get() + written_size,
 482                              received_size - written_size));
 483       PCHECK(write_res >= 0);
 484       written_size += write_res;
 485     }
 486     PCHECK(0 == HANDLE_EINTR(fsync(file_fd)));
 487   }
 488 }
 489
 490 // fds[0] is the read end, fds[1] is the write end.
 491 static void CreateSanitizerCoverageSocketPair(int fds[2]) {
 492   PCHECK(0 == socketpair(AF_UNIX, SOCK_SEQPACKET, 0, fds));
 493   PCHECK(0 == shutdown(fds[0], SHUT_WR));
 494   PCHECK(0 == shutdown(fds[1], SHUT_RD));
 495 }
 496
 497 static pid_t ForkSanitizerCoverageHelper(int child_fd, int parent_fd,
 498                                         base::ScopedFD file_fd) {
 499   pid_t pid = fork();
 500   PCHECK(pid >= 0);
 501   if (pid == 0) {
 502     // In the child.
 503     PCHECK(0 == IGNORE_EINTR(close(parent_fd)));
 504     SanitizerCoverageHelper(child_fd, file_fd.get());
 505     _exit(0);
 506   } else {
 507     // In the parent.
 508     PCHECK(0 == IGNORE_EINTR(close(child_fd)));
 509     return pid;
 510   }
 511 }
 512
 513 void CloseFdPair(const int fds[2]) {
 514   PCHECK(0 == IGNORE_EINTR(close(fds[0])));
 515   PCHECK(0 == IGNORE_EINTR(close(fds[1])));
 516 }
 517 #endif  // defined(ADDRESS_SANITIZER)
 518
 519 // If |is_suid_sandbox_child|, then make sure that the setuid sandbox is
 520 // engaged.
 521 static void EnterLayerOneSandbox(LinuxSandbox* linux_sandbox,
 522                                  bool is_suid_sandbox_child,
 523                                  base::Closure* post_fork_parent_callback) {
 524   DCHECK(linux_sandbox);
 525
 526   ZygotePreSandboxInit();
 527
 528   // Check that the pre-sandbox initialization didn't spawn threads.
 529 #if !defined(THREAD_SANITIZER)
 530   DCHECK(linux_sandbox->IsSingleThreaded());
 531 #endif
 532
 533   sandbox::SetuidSandboxClient* setuid_sandbox =
 534       linux_sandbox->setuid_sandbox_client();
 535
 536   if (is_suid_sandbox_child) {
 537     CHECK(EnterSuidSandbox(setuid_sandbox, post_fork_parent_callback))
 538         << "Failed to enter setuid sandbox";
 539   }
 540 }
 541
 542 bool ZygoteMain(const MainFunctionParams& params,
 543                 ScopedVector<ZygoteForkDelegate> fork_delegates) {
 544   g_am_zygote_or_renderer = true;
 545   sandbox::InitLibcUrandomOverrides();
 546
 547   base::Closure *post_fork_parent_callback = NULL;
 548
 549   LinuxSandbox* linux_sandbox = LinuxSandbox::GetInstance();
 550
 551 #if defined(ADDRESS_SANITIZER)
 552   const std::string sancov_file_name =
 553       "zygote." + base::Uint64ToString(base::RandUint64());
 554   base::ScopedFD sancov_file_fd(
 555       __sanitizer_maybe_open_cov_file(sancov_file_name.c_str()));
 556   int sancov_socket_fds[2] = {-1, -1};
 557   CreateSanitizerCoverageSocketPair(sancov_socket_fds);
 558   linux_sandbox->sanitizer_args()->coverage_sandboxed = 1;
 559   linux_sandbox->sanitizer_args()->coverage_fd = sancov_socket_fds[1];
 560   linux_sandbox->sanitizer_args()->coverage_max_block_size =
 561       kSanitizerMaxMessageLength;
 562   // Zygote termination will block until the helper process exits, which will
 563   // not happen until the write end of the socket is closed everywhere. Make
 564   // sure the init process does not hold on to it.
 565   base::Closure close_sancov_socket_fds =
 566       base::Bind(&CloseFdPair, sancov_socket_fds);
 567   post_fork_parent_callback = &close_sancov_socket_fds;
 568 #endif
 569
 570   // This will pre-initialize the various sandboxes that need it.
 571   linux_sandbox->PreinitializeSandbox();
 572
 573   const bool must_enable_setuid_sandbox =
 574       linux_sandbox->setuid_sandbox_client()->IsSuidSandboxChild();
 575   if (must_enable_setuid_sandbox) {
 576     linux_sandbox->setuid_sandbox_client()->CloseDummyFile();
 577
 578     // Let the ZygoteHost know we're booting up.
 579     CHECK(UnixDomainSocket::SendMsg(kZygoteSocketPairFd,
 580                                     kZygoteBootMessage,
 581                                     sizeof(kZygoteBootMessage),
 582                                     std::vector<int>()));
 583   }
 584
 585   VLOG(1) << "ZygoteMain: initializing " << fork_delegates.size()
 586           << " fork delegates";
 587   for (ScopedVector<ZygoteForkDelegate>::iterator i = fork_delegates.begin();
 588        i != fork_delegates.end();
 589        ++i) {
 590     (*i)->Init(GetSandboxFD(), must_enable_setuid_sandbox);
 591   }
 592
 593   // Turn on the first layer of the sandbox if the configuration warrants it.
 594   EnterLayerOneSandbox(linux_sandbox, must_enable_setuid_sandbox,
 595                        post_fork_parent_callback);
 596
 597   std::vector<pid_t> extra_children;
 598   std::vector<int> extra_fds;
 599
 600 #if defined(ADDRESS_SANITIZER)
 601   pid_t sancov_helper_pid = ForkSanitizerCoverageHelper(
 602       sancov_socket_fds[0], sancov_socket_fds[1], sancov_file_fd.Pass());
 603   // It's important that the zygote reaps the helper before dying. Otherwise,
 604   // the destruction of the PID namespace could kill the helper before it
 605   // completes its I/O tasks. |sancov_helper_pid| will exit once the last
 606   // renderer holding the write end of |sancov_socket_fds| closes it.
 607   extra_children.push_back(sancov_helper_pid);
 608   // Sanitizer code in the renderers will inherit the write end of the socket
 609   // from the zygote. We must keep it open until the very end of the zygote's
 610   // lifetime, even though we don't explicitly use it.
 611   extra_fds.push_back(sancov_socket_fds[1]);
 612 #endif
 613
 614   int sandbox_flags = linux_sandbox->GetStatus();
 615   bool setuid_sandbox_engaged = sandbox_flags & kSandboxLinuxSUID;
 616   CHECK_EQ(must_enable_setuid_sandbox, setuid_sandbox_engaged);
 617
 618   Zygote zygote(sandbox_flags, fork_delegates.Pass(), extra_children,
 619                 extra_fds);
 620   // This function call can return multiple times, once per fork().
 621   return zygote.ProcessRequests();
 622 }
 623
 624 }  // namespace content