sandbox/mac/bootstrap_sandbox.cc

   1 // Copyright 2014 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "sandbox/mac/bootstrap_sandbox.h"
   6
   7 #include "base/logging.h"
   8 #include "base/mac/mach_logging.h"
   9
  10 #include "sandbox/mac/launchd_interception_server.h"
  11
  12 namespace sandbox {
  13
  14 const int kNotAPolicy = -1;
  15
  16 // static
  17 scoped_ptr<BootstrapSandbox> BootstrapSandbox::Create() {
  18   scoped_ptr<BootstrapSandbox> null;  // Used for early returns.
  19   scoped_ptr<BootstrapSandbox> sandbox(new BootstrapSandbox());
  20   sandbox->server_.reset(new LaunchdInterceptionServer(sandbox.get()));
  21
  22   if (!sandbox->server_->Initialize())
  23     return null.Pass();
  24
  25   mach_port_t port = sandbox->server_->server_port();
  26   kern_return_t kr = mach_port_insert_right(mach_task_self(), port, port,
  27       MACH_MSG_TYPE_MAKE_SEND);
  28   if (kr != KERN_SUCCESS) {
  29     MACH_LOG(ERROR, kr) << "Failed to insert send right on bootstrap port.";
  30     return null.Pass();
  31   }
  32   base::mac::ScopedMachSendRight scoped_right(port);
  33
  34   // Note that the extern global bootstrap_port (in bootstrap.h) will not
  35   // be changed here. The parent only has its bootstrap port replaced
  36   // permanently because changing it repeatedly in a multi-threaded program
  37   // could lead to unsafe access patterns. In a single-threaded program,
  38   // the port would be restored after fork(). See the design document for
  39   // a larger discussion.
  40   //
  41   // By not changing the global bootstrap_port, users of the bootstrap port
  42   // in the parent can potentially skip an unnecessary indirection through
  43   // the sandbox server.
  44   kr = task_set_special_port(mach_task_self(), TASK_BOOTSTRAP_PORT, port);
  45   if (kr != KERN_SUCCESS) {
  46     MACH_LOG(ERROR, kr) << "Failed to set new bootstrap port.";
  47     return null.Pass();
  48   }
  49
  50   return sandbox.Pass();
  51 }
  52
  53 BootstrapSandbox::~BootstrapSandbox() {
  54   kern_return_t kr = task_set_special_port(mach_task_self(),
  55       TASK_BOOTSTRAP_PORT, real_bootstrap_port_);
  56   MACH_CHECK(kr == KERN_SUCCESS, kr);
  57 }
  58
  59 void BootstrapSandbox::RegisterSandboxPolicy(
  60     int sandbox_policy_id,
  61     const BootstrapSandboxPolicy& policy) {
  62   CHECK(IsPolicyValid(policy));
  63   CHECK_GT(sandbox_policy_id, 0);
  64   base::AutoLock lock(lock_);
  65   DCHECK(policies_.find(sandbox_policy_id) == policies_.end());
  66   policies_.insert(std::make_pair(sandbox_policy_id, policy));
  67 }
  68
  69 void BootstrapSandbox::PrepareToForkWithPolicy(int sandbox_policy_id) {
  70   base::AutoLock lock(lock_);
  71
  72   CHECK(policies_.find(sandbox_policy_id) != policies_.end());
  73   CHECK_EQ(kNotAPolicy, effective_policy_id_)
  74       << "Cannot nest calls to PrepareToForkWithPolicy()";
  75
  76   // Store the policy for the process we're about to create.
  77   effective_policy_id_ = sandbox_policy_id;
  78 }
  79
  80 // TODO(rsesek): The |lock_| needs to be taken twice because
  81 // base::LaunchProcess handles both fork+exec, and holding the lock for the
  82 // duration would block servicing of other bootstrap messages. If a better
  83 // LaunchProcess existed (do arbitrary work without layering violations), this
  84 // could be avoided.
  85
  86 void BootstrapSandbox::FinishedFork(base::ProcessHandle handle) {
  87   base::AutoLock lock(lock_);
  88
  89   CHECK_NE(kNotAPolicy, effective_policy_id_)
  90       << "Must PrepareToForkWithPolicy() before FinishedFork()";
  91
  92   if (handle != base::kNullProcessHandle) {
  93     const auto& existing_process = sandboxed_processes_.find(handle);
  94     CHECK(existing_process == sandboxed_processes_.end());
  95     sandboxed_processes_.insert(std::make_pair(handle, effective_policy_id_));
  96     VLOG(3) << "Bootstrap sandbox enforced for pid " << handle;
  97   }
  98
  99   effective_policy_id_ = kNotAPolicy;
 100 }
 101
 102 void BootstrapSandbox::ChildDied(base::ProcessHandle handle) {
 103   base::AutoLock lock(lock_);
 104   const auto& it = sandboxed_processes_.find(handle);
 105   CHECK(it != sandboxed_processes_.end());
 106   sandboxed_processes_.erase(it);
 107 }
 108
 109 const BootstrapSandboxPolicy* BootstrapSandbox::PolicyForProcess(
 110     pid_t pid) const {
 111   base::AutoLock lock(lock_);
 112   const auto& process = sandboxed_processes_.find(pid);
 113
 114   // The new child could send bootstrap requests before the parent calls
 115   // FinishedFork().
 116   int policy_id = effective_policy_id_;
 117   if (process != sandboxed_processes_.end()) {
 118     policy_id = process->second;
 119   }
 120
 121   if (policy_id == kNotAPolicy)
 122     return NULL;
 123
 124   return &policies_.find(policy_id)->second;
 125 }
 126
 127 BootstrapSandbox::BootstrapSandbox()
 128     : real_bootstrap_port_(MACH_PORT_NULL),
 129       effective_policy_id_(kNotAPolicy) {
 130   mach_port_t port = MACH_PORT_NULL;
 131   kern_return_t kr = task_get_special_port(
 132       mach_task_self(), TASK_BOOTSTRAP_PORT, &port);
 133   MACH_CHECK(kr == KERN_SUCCESS, kr);
 134   real_bootstrap_port_.reset(port);
 135 }
 136
 137 }  // namespace sandbox