Adding Peter Thatcher to the owners file.
[chromium-blink-merge.git] / sandbox / linux / services / namespace_sandbox.cc
blobdfee8b27a7b00d283102605c24aafc2f43f443c4
1 // Copyright 2015 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
5 #include "sandbox/linux/services/namespace_sandbox.h"
7 #include <sched.h>
8 #include <signal.h>
9 #include <stdlib.h>
10 #include <sys/types.h>
11 #include <unistd.h>
13 #include <string>
14 #include <utility>
15 #include <vector>
17 #include "base/command_line.h"
18 #include "base/environment.h"
19 #include "base/files/scoped_file.h"
20 #include "base/logging.h"
21 #include "base/macros.h"
22 #include "base/posix/eintr_wrapper.h"
23 #include "base/process/launch.h"
24 #include "base/process/process.h"
25 #include "sandbox/linux/services/credentials.h"
26 #include "sandbox/linux/services/namespace_utils.h"
28 namespace sandbox {
30 namespace {
32 class WriteUidGidMapDelegate : public base::LaunchOptions::PreExecDelegate {
33 public:
34 WriteUidGidMapDelegate()
35 : uid_(getuid()),
36 gid_(getgid()),
37 supports_deny_setgroups_(
38 NamespaceUtils::KernelSupportsDenySetgroups()) {}
40 ~WriteUidGidMapDelegate() override {}
42 void RunAsyncSafe() override {
43 if (supports_deny_setgroups_) {
44 RAW_CHECK(NamespaceUtils::DenySetgroups());
46 RAW_CHECK(NamespaceUtils::WriteToIdMapFile("/proc/self/uid_map", uid_));
47 RAW_CHECK(NamespaceUtils::WriteToIdMapFile("/proc/self/gid_map", gid_));
50 private:
51 const uid_t uid_;
52 const gid_t gid_;
53 const bool supports_deny_setgroups_;
54 DISALLOW_COPY_AND_ASSIGN(WriteUidGidMapDelegate);
57 void SetEnvironForNamespaceType(base::EnvironmentMap* environ,
58 base::NativeEnvironmentString env_var,
59 bool value) {
60 // An empty string causes the env var to be unset in the child process.
61 (*environ)[env_var] = value ? "1" : "";
64 const char kSandboxUSERNSEnvironmentVarName[] = "SBX_USER_NS";
65 const char kSandboxPIDNSEnvironmentVarName[] = "SBX_PID_NS";
66 const char kSandboxNETNSEnvironmentVarName[] = "SBX_NET_NS";
68 // Linux supports up to 64 signals. This should be updated if that ever changes.
69 int g_signal_exit_codes[64];
71 void TerminationSignalHandler(int sig) {
72 // Return a special exit code so that the process is detected as terminated by
73 // a signal.
74 const size_t sig_idx = static_cast<size_t>(sig);
75 if (sig_idx < arraysize(g_signal_exit_codes)) {
76 _exit(g_signal_exit_codes[sig_idx]);
79 _exit(NamespaceSandbox::kDefaultExitCode);
82 } // namespace
84 // static
85 base::Process NamespaceSandbox::LaunchProcess(
86 const base::CommandLine& cmdline,
87 const base::LaunchOptions& options) {
88 return LaunchProcess(cmdline.argv(), options);
91 // static
92 base::Process NamespaceSandbox::LaunchProcess(
93 const std::vector<std::string>& argv,
94 const base::LaunchOptions& options) {
95 int clone_flags = 0;
96 int ns_types[] = {CLONE_NEWUSER, CLONE_NEWPID, CLONE_NEWNET};
97 for (const int ns_type : ns_types) {
98 if (NamespaceUtils::KernelSupportsUnprivilegedNamespace(ns_type)) {
99 clone_flags |= ns_type;
102 CHECK(clone_flags & CLONE_NEWUSER);
104 // These fields may not be set by the caller.
105 CHECK(options.pre_exec_delegate == nullptr);
106 CHECK_EQ(0, options.clone_flags);
108 WriteUidGidMapDelegate write_uid_gid_map_delegate;
110 base::LaunchOptions launch_options = options;
111 launch_options.pre_exec_delegate = &write_uid_gid_map_delegate;
112 launch_options.clone_flags = clone_flags;
114 const std::pair<int, const char*> clone_flag_environ[] = {
115 std::make_pair(CLONE_NEWUSER, kSandboxUSERNSEnvironmentVarName),
116 std::make_pair(CLONE_NEWPID, kSandboxPIDNSEnvironmentVarName),
117 std::make_pair(CLONE_NEWNET, kSandboxNETNSEnvironmentVarName),
120 base::EnvironmentMap* environ = &launch_options.environ;
121 for (const auto& entry : clone_flag_environ) {
122 const int flag = entry.first;
123 const char* environ_name = entry.second;
124 SetEnvironForNamespaceType(environ, environ_name, clone_flags & flag);
127 return base::LaunchProcess(argv, launch_options);
130 // static
131 pid_t NamespaceSandbox::ForkInNewPidNamespace(bool drop_capabilities_in_child) {
132 const pid_t pid =
133 base::ForkWithFlags(CLONE_NEWPID | SIGCHLD, nullptr, nullptr);
134 if (pid < 0) {
135 return pid;
138 if (pid == 0) {
139 DCHECK_EQ(1, getpid());
140 if (drop_capabilities_in_child) {
141 // Since we just forked, we are single-threaded, so this should be safe.
142 CHECK(Credentials::DropAllCapabilitiesOnCurrentThread());
144 return 0;
147 return pid;
150 // static
151 void NamespaceSandbox::InstallDefaultTerminationSignalHandlers() {
152 static const int kDefaultTermSignals[] = {
153 SIGHUP, SIGINT, SIGABRT, SIGQUIT, SIGPIPE, SIGTERM, SIGUSR1, SIGUSR2,
156 for (const int sig : kDefaultTermSignals) {
157 InstallTerminationSignalHandler(sig, kDefaultExitCode);
161 // static
162 bool NamespaceSandbox::InstallTerminationSignalHandler(
163 int sig,
164 int exit_code) {
165 struct sigaction old_action;
166 PCHECK(sigaction(sig, nullptr, &old_action) == 0);
168 if (old_action.sa_flags & SA_SIGINFO &&
169 old_action.sa_sigaction != nullptr) {
170 return false;
171 } else if (old_action.sa_handler != SIG_DFL) {
172 return false;
175 const size_t sig_idx = static_cast<size_t>(sig);
176 CHECK_LT(sig_idx, arraysize(g_signal_exit_codes));
178 DCHECK_GE(exit_code, 0);
179 DCHECK_LT(exit_code, 256);
181 g_signal_exit_codes[sig_idx] = exit_code;
183 struct sigaction action = {};
184 action.sa_handler = &TerminationSignalHandler;
185 PCHECK(sigaction(sig, &action, nullptr) == 0);
186 return true;
189 // static
190 bool NamespaceSandbox::InNewUserNamespace() {
191 return getenv(kSandboxUSERNSEnvironmentVarName) != nullptr;
194 // static
195 bool NamespaceSandbox::InNewPidNamespace() {
196 return getenv(kSandboxPIDNSEnvironmentVarName) != nullptr;
199 // static
200 bool NamespaceSandbox::InNewNetNamespace() {
201 return getenv(kSandboxNETNSEnvironmentVarName) != nullptr;
204 } // namespace sandbox