1 // Copyright 2018 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
4
5 #include "sandbox/linux/services/libc_interceptor.h"
6
7 #include <dlfcn.h>
8 #include <fcntl.h>
9 #include <pthread.h>
10 #include <signal.h>
11 #include <stddef.h>
12 #include <stdint.h>
13 #include <string.h>
14 #if !defined(OS_BSD)
15 #include <sys/prctl.h>
16 #endif
17 #include <sys/socket.h>
18 #include <sys/types.h>
19 #include <time.h>
20 #include <unistd.h>
21
22 #include <set>
23 #include <string>
24
25 #include "base/compiler_specific.h"
26 #include "base/lazy_instance.h"
27 #include "base/logging.h"
28 #include "base/pickle.h"
29 #include "base/posix/eintr_wrapper.h"
30 #include "base/posix/global_descriptors.h"
31 #include "base/posix/unix_domain_socket.h"
32 #include "base/synchronization/lock.h"
33
34 namespace sandbox {
35
36 namespace {
37
38 // The global |g_am_zygote_or_renderer| is true iff we are in a zygote or
39 // renderer process. It's set in ZygoteMain and inherited by the renderers when
40 // they fork. (This means that it'll be incorrect for global constructor
41 // functions and before ZygoteMain is called - beware).
42 bool g_am_zygote_or_renderer = false;
43 int g_backchannel_fd = -1;
44
45 base::LazyInstance<std::set<std::string>>::Leaky g_timezones =
46 LAZY_INSTANCE_INITIALIZER;
47
48 base::LazyInstance<base::Lock>::Leaky g_timezones_lock =
49 LAZY_INSTANCE_INITIALIZER;
50
ReadTimeStruct(base::PickleIterator * iter,struct tm * output,char * timezone_out,size_t timezone_out_len)51 bool ReadTimeStruct(base::PickleIterator* iter,
52 struct tm* output,
53 char* timezone_out,
54 size_t timezone_out_len) {
55 int result;
56 if (!iter->ReadInt(&result))
57 return false;
58 output->tm_sec = result;
59 if (!iter->ReadInt(&result))
60 return false;
61 output->tm_min = result;
62 if (!iter->ReadInt(&result))
63 return false;
64 output->tm_hour = result;
65 if (!iter->ReadInt(&result))
66 return false;
67 output->tm_mday = result;
68 if (!iter->ReadInt(&result))
69 return false;
70 output->tm_mon = result;
71 if (!iter->ReadInt(&result))
72 return false;
73 output->tm_year = result;
74 if (!iter->ReadInt(&result))
75 return false;
76 output->tm_wday = result;
77 if (!iter->ReadInt(&result))
78 return false;
79 output->tm_yday = result;
80 if (!iter->ReadInt(&result))
81 return false;
82 output->tm_isdst = result;
83 if (!iter->ReadInt(&result))
84 return false;
85 output->tm_gmtoff = result;
86
87 std::string timezone;
88 if (!iter->ReadString(&timezone))
89 return false;
90 if (timezone_out_len) {
91 const size_t copy_len = std::min(timezone_out_len - 1, timezone.size());
92 memcpy(timezone_out, timezone.data(), copy_len);
93 timezone_out[copy_len] = 0;
94 output->tm_zone = timezone_out;
95 } else {
96 base::AutoLock lock(g_timezones_lock.Get());
97 auto ret_pair = g_timezones.Get().insert(timezone);
98 output->tm_zone = (char *)ret_pair.first->c_str();
99 }
100
101 return true;
102 }
103
WriteTimeStruct(base::Pickle * pickle,const struct tm & time)104 void WriteTimeStruct(base::Pickle* pickle, const struct tm& time) {
105 pickle->WriteInt(time.tm_sec);
106 pickle->WriteInt(time.tm_min);
107 pickle->WriteInt(time.tm_hour);
108 pickle->WriteInt(time.tm_mday);
109 pickle->WriteInt(time.tm_mon);
110 pickle->WriteInt(time.tm_year);
111 pickle->WriteInt(time.tm_wday);
112 pickle->WriteInt(time.tm_yday);
113 pickle->WriteInt(time.tm_isdst);
114 pickle->WriteInt(time.tm_gmtoff);
115 pickle->WriteString(time.tm_zone);
116 }
117
118 // See
119 // https://chromium.googlesource.com/chromium/src/+/master/docs/linux/zygote.md
ProxyLocaltimeCallToBrowser(time_t input,struct tm * output,char * timezone_out,size_t timezone_out_len)120 void ProxyLocaltimeCallToBrowser(time_t input,
121 struct tm* output,
122 char* timezone_out,
123 size_t timezone_out_len) {
124 base::Pickle request;
125 request.WriteInt(METHOD_LOCALTIME);
126 request.WriteString(
127 std::string(reinterpret_cast<char*>(&input), sizeof(input)));
128
129 memset(output, 0, sizeof(struct tm));
130
131 uint8_t reply_buf[512];
132 const ssize_t r = base::UnixDomainSocket::SendRecvMsg(
133 g_backchannel_fd, reply_buf, sizeof(reply_buf), nullptr, request);
134 if (r == -1)
135 return;
136
137 base::Pickle reply(reinterpret_cast<char*>(reply_buf), r);
138 base::PickleIterator iter(reply);
139 if (!ReadTimeStruct(&iter, output, timezone_out, timezone_out_len)) {
140 memset(output, 0, sizeof(struct tm));
141 }
142 }
143
144 // The other side of this call is ProxyLocaltimeCallToBrowser().
HandleLocalTime(int fd,base::PickleIterator iter,const std::vector<base::ScopedFD> & fds)145 bool HandleLocalTime(int fd,
146 base::PickleIterator iter,
147 const std::vector<base::ScopedFD>& fds) {
148 std::string time_string;
149 if (!iter.ReadString(&time_string) || time_string.size() != sizeof(time_t))
150 return false;
151
152 time_t time;
153 memcpy(&time, time_string.data(), sizeof(time));
154 struct tm expanded_time = {};
155 localtime_r(&time, &expanded_time);
156
157 base::Pickle reply;
158 WriteTimeStruct(&reply, expanded_time);
159
160 struct msghdr msg;
161 memset(&msg, 0, sizeof(msg));
162
163 struct iovec iov = {const_cast<void*>(reply.data()), reply.size()};
164 msg.msg_iov = &iov;
165 msg.msg_iovlen = 1;
166
167 if (HANDLE_EINTR(sendmsg(fds[0].get(), &msg, MSG_DONTWAIT)) < 0)
168 PLOG(ERROR) << "sendmsg";
169
170 return true;
171 }
172
173 } // namespace
174
175 typedef struct tm* (*LocaltimeFunction)(const time_t* timep);
176 typedef struct tm* (*LocaltimeRFunction)(const time_t* timep,
177 struct tm* result);
178
179 static pthread_once_t g_libc_localtime_funcs_guard = PTHREAD_ONCE_INIT;
180 static LocaltimeFunction g_libc_localtime;
181 static LocaltimeFunction g_libc_localtime64;
182 static LocaltimeRFunction g_libc_localtime_r;
183 static LocaltimeRFunction g_libc_localtime64_r;
184
InitLibcLocaltimeFunctionsImpl()185 static void InitLibcLocaltimeFunctionsImpl() {
186 g_libc_localtime =
187 reinterpret_cast<LocaltimeFunction>(dlsym(RTLD_NEXT, "localtime"));
188 g_libc_localtime64 =
189 reinterpret_cast<LocaltimeFunction>(dlsym(RTLD_NEXT, "localtime64"));
190 g_libc_localtime_r =
191 reinterpret_cast<LocaltimeRFunction>(dlsym(RTLD_NEXT, "localtime_r"));
192 g_libc_localtime64_r =
193 reinterpret_cast<LocaltimeRFunction>(dlsym(RTLD_NEXT, "localtime64_r"));
194
195 if (!g_libc_localtime || !g_libc_localtime_r) {
196 // https://bugs.chromium.org/p/chromium/issues/detail?id=16800
197 //
198 // Nvidia's libGL.so overrides dlsym for an unknown reason and replaces
199 // it with a version which doesn't work. In this case we'll get a NULL
200 // result. There's not a lot we can do at this point, so we just bodge it!
201 LOG(ERROR) << "Your system is broken: dlsym doesn't work! This has been "
202 "reported to be caused by Nvidia's libGL. You should expect"
203 " time related functions to misbehave. "
204 "https://bugs.chromium.org/p/chromium/issues/detail?id=16800";
205 }
206
207 if (!g_libc_localtime)
208 g_libc_localtime = gmtime;
209 if (!g_libc_localtime64)
210 g_libc_localtime64 = g_libc_localtime;
211 if (!g_libc_localtime_r)
212 g_libc_localtime_r = gmtime_r;
213 if (!g_libc_localtime64_r)
214 g_libc_localtime64_r = g_libc_localtime_r;
215 }
216
217 // Define localtime_override() function with asm name "localtime", so that all
218 // references to localtime() will resolve to this function. Notice that we need
219 // to set visibility attribute to "default" to export the symbol, as it is set
220 // to "hidden" by default in chrome per build/common.gypi.
221 __attribute__((__visibility__("default"))) struct tm* localtime_override(
222 const time_t* timep) __asm__("localtime");
223
224 NO_SANITIZE("cfi-icall")
localtime_override(const time_t * timep)225 __attribute__((__visibility__("default"))) struct tm* localtime_override(
226 const time_t* timep) {
227 if (g_am_zygote_or_renderer) {
228 static struct tm time_struct;
229 static char timezone_string[64];
230 ProxyLocaltimeCallToBrowser(*timep, &time_struct, timezone_string,
231 sizeof(timezone_string));
232 return &time_struct;
233 }
234
235 InitLibcLocaltimeFunctions();
236 struct tm* res = g_libc_localtime(timep);
237 #if defined(MEMORY_SANITIZER)
238 if (res)
239 __msan_unpoison(res, sizeof(*res));
240 if (res->tm_zone)
241 __msan_unpoison_string(res->tm_zone);
242 #endif
243 return res;
244 }
245
246 // Use same trick to override localtime64(), localtime_r() and localtime64_r().
247 __attribute__((__visibility__("default"))) struct tm* localtime64_override(
248 const time_t* timep) __asm__("localtime64");
249
250 NO_SANITIZE("cfi-icall")
localtime64_override(const time_t * timep)251 __attribute__((__visibility__("default"))) struct tm* localtime64_override(
252 const time_t* timep) {
253 if (g_am_zygote_or_renderer) {
254 static struct tm time_struct;
255 static char timezone_string[64];
256 ProxyLocaltimeCallToBrowser(*timep, &time_struct, timezone_string,
257 sizeof(timezone_string));
258 return &time_struct;
259 }
260
261 InitLibcLocaltimeFunctions();
262 struct tm* res = g_libc_localtime64(timep);
263 #if defined(MEMORY_SANITIZER)
264 if (res)
265 __msan_unpoison(res, sizeof(*res));
266 if (res->tm_zone)
267 __msan_unpoison_string(res->tm_zone);
268 #endif
269 return res;
270 }
271
272 __attribute__((__visibility__("default"))) struct tm* localtime_r_override(
273 const time_t* timep,
274 struct tm* result) __asm__("localtime_r");
275
276 NO_SANITIZE("cfi-icall")
localtime_r_override(const time_t * timep,struct tm * result)277 __attribute__((__visibility__("default"))) struct tm* localtime_r_override(
278 const time_t* timep,
279 struct tm* result) {
280 if (g_am_zygote_or_renderer) {
281 ProxyLocaltimeCallToBrowser(*timep, result, nullptr, 0);
282 return result;
283 }
284
285 InitLibcLocaltimeFunctions();
286 struct tm* res = g_libc_localtime_r(timep, result);
287 #if defined(MEMORY_SANITIZER)
288 if (res)
289 __msan_unpoison(res, sizeof(*res));
290 if (res->tm_zone)
291 __msan_unpoison_string(res->tm_zone);
292 #endif
293 return res;
294 }
295
296 __attribute__((__visibility__("default"))) struct tm* localtime64_r_override(
297 const time_t* timep,
298 struct tm* result) __asm__("localtime64_r");
299
300 NO_SANITIZE("cfi-icall")
localtime64_r_override(const time_t * timep,struct tm * result)301 __attribute__((__visibility__("default"))) struct tm* localtime64_r_override(
302 const time_t* timep,
303 struct tm* result) {
304 if (g_am_zygote_or_renderer) {
305 ProxyLocaltimeCallToBrowser(*timep, result, nullptr, 0);
306 return result;
307 }
308
309 InitLibcLocaltimeFunctions();
310 struct tm* res = g_libc_localtime64_r(timep, result);
311 #if defined(MEMORY_SANITIZER)
312 if (res)
313 __msan_unpoison(res, sizeof(*res));
314 if (res->tm_zone)
315 __msan_unpoison_string(res->tm_zone);
316 #endif
317 return res;
318 }
319
SetAmZygoteOrRenderer(bool enable,int backchannel_fd)320 void SetAmZygoteOrRenderer(bool enable, int backchannel_fd) {
321 g_am_zygote_or_renderer = enable;
322 g_backchannel_fd = backchannel_fd;
323 }
324
HandleInterceptedCall(int kind,int fd,base::PickleIterator iter,const std::vector<base::ScopedFD> & fds)325 bool HandleInterceptedCall(int kind,
326 int fd,
327 base::PickleIterator iter,
328 const std::vector<base::ScopedFD>& fds) {
329 if (kind != METHOD_LOCALTIME)
330 return false;
331
332 return HandleLocalTime(fd, iter, fds);
333 }
334
InitLibcLocaltimeFunctions()335 void InitLibcLocaltimeFunctions() {
336 CHECK_EQ(0, pthread_once(&g_libc_localtime_funcs_guard,
337 InitLibcLocaltimeFunctionsImpl));
338 }
339
340 } // namespace sandbox
341