sandbox/linux/services/namespace_sandbox.cc

   1 // Copyright 2015 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "sandbox/linux/services/namespace_sandbox.h"
   6
   7 #include <sched.h>
   8 #include <stdlib.h>
   9 #include <sys/types.h>
  10 #include <unistd.h>
  11
  12 #include <string>
  13 #include <utility>
  14 #include <vector>
  15
  16 #include "base/command_line.h"
  17 #include "base/environment.h"
  18 #include "base/files/scoped_file.h"
  19 #include "base/logging.h"
  20 #include "base/posix/eintr_wrapper.h"
  21 #include "base/process/launch.h"
  22 #include "base/process/process.h"
  23 #include "sandbox/linux/services/namespace_utils.h"
  24
  25 namespace sandbox {
  26
  27 namespace {
  28
  29 class WriteUidGidMapDelegate : public base::LaunchOptions::PreExecDelegate {
  30  public:
  31   WriteUidGidMapDelegate()
  32       : uid_(getuid()),
  33         gid_(getgid()),
  34         supports_deny_setgroups_(
  35             NamespaceUtils::KernelSupportsDenySetgroups()) {}
  36
  37   ~WriteUidGidMapDelegate() override {}
  38
  39   void RunAsyncSafe() override {
  40     if (supports_deny_setgroups_) {
  41       RAW_CHECK(NamespaceUtils::DenySetgroups());
  42     }
  43     RAW_CHECK(NamespaceUtils::WriteToIdMapFile("/proc/self/uid_map", uid_));
  44     RAW_CHECK(NamespaceUtils::WriteToIdMapFile("/proc/self/gid_map", gid_));
  45   }
  46
  47  private:
  48   const uid_t uid_;
  49   const gid_t gid_;
  50   const bool supports_deny_setgroups_;
  51   DISALLOW_COPY_AND_ASSIGN(WriteUidGidMapDelegate);
  52 };
  53
  54 void SetEnvironForNamespaceType(base::EnvironmentMap* environ,
  55                                 base::NativeEnvironmentString env_var,
  56                                 bool value) {
  57   // An empty string causes the env var to be unset in the child process.
  58   (*environ)[env_var] = value ? "1" : "";
  59 }
  60
  61 const char kSandboxUSERNSEnvironmentVarName[] = "SBX_USER_NS";
  62 const char kSandboxPIDNSEnvironmentVarName[] = "SBX_PID_NS";
  63 const char kSandboxNETNSEnvironmentVarName[] = "SBX_NET_NS";
  64
  65 }  // namespace
  66
  67 // static
  68 base::Process NamespaceSandbox::LaunchProcess(
  69     const base::CommandLine& cmdline,
  70     const base::LaunchOptions& options) {
  71   return LaunchProcess(cmdline.argv(), options);
  72 }
  73
  74 // static
  75 base::Process NamespaceSandbox::LaunchProcess(
  76     const std::vector<std::string>& argv,
  77     const base::LaunchOptions& options) {
  78   int clone_flags = 0;
  79   int ns_types[] = {CLONE_NEWUSER, CLONE_NEWPID, CLONE_NEWNET};
  80   for (const int ns_type : ns_types) {
  81     if (NamespaceUtils::KernelSupportsUnprivilegedNamespace(ns_type)) {
  82       clone_flags |= ns_type;
  83     }
  84   }
  85   CHECK(clone_flags & CLONE_NEWUSER);
  86
  87   // These fields may not be set by the caller.
  88   CHECK(options.pre_exec_delegate == nullptr);
  89   CHECK_EQ(0, options.clone_flags);
  90
  91   WriteUidGidMapDelegate write_uid_gid_map_delegate;
  92
  93   base::LaunchOptions launch_options = options;
  94   launch_options.pre_exec_delegate = &write_uid_gid_map_delegate;
  95   launch_options.clone_flags = clone_flags;
  96
  97   const std::pair<int, const char*> clone_flag_environ[] = {
  98       std::make_pair(CLONE_NEWUSER, kSandboxUSERNSEnvironmentVarName),
  99       std::make_pair(CLONE_NEWPID, kSandboxPIDNSEnvironmentVarName),
 100       std::make_pair(CLONE_NEWNET, kSandboxNETNSEnvironmentVarName),
 101   };
 102
 103   base::EnvironmentMap* environ = &launch_options.environ;
 104   for (const auto& entry : clone_flag_environ) {
 105     const int flag = entry.first;
 106     const char* environ_name = entry.second;
 107     SetEnvironForNamespaceType(environ, environ_name, clone_flags & flag);
 108   }
 109
 110   return base::LaunchProcess(argv, launch_options);
 111 }
 112
 113 // static
 114 bool NamespaceSandbox::InNewUserNamespace() {
 115   return getenv(kSandboxUSERNSEnvironmentVarName) != nullptr;
 116 }
 117
 118 // static
 119 bool NamespaceSandbox::InNewPidNamespace() {
 120   return getenv(kSandboxPIDNSEnvironmentVarName) != nullptr;
 121 }
 122
 123 // static
 124 bool NamespaceSandbox::InNewNetNamespace() {
 125   return getenv(kSandboxNETNSEnvironmentVarName) != nullptr;
 126 }
 127
 128 }  // namespace sandbox