1 // Copyright 2015 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
4
5 #include "sandbox/linux/services/namespace_sandbox.h"
6
7 #include <sched.h>
8 #include <signal.h>
9 #include <stddef.h>
10 #include <stdlib.h>
11 #include <sys/types.h>
12 #include <unistd.h>
13
14 #include <string>
15 #include <utility>
16 #include <vector>
17
18 #include "base/command_line.h"
19 #include "base/environment.h"
20 #include "base/files/scoped_file.h"
21 #include "base/logging.h"
22 #include "base/posix/eintr_wrapper.h"
23 #include "base/process/launch.h"
24 #include "base/process/process.h"
25 #include "base/stl_util.h"
26 #include "build/build_config.h"
27 #include "sandbox/linux/services/credentials.h"
28 #include "sandbox/linux/services/namespace_utils.h"
29 #include "sandbox/linux/services/syscall_wrappers.h"
30 #include "sandbox/linux/system_headers/linux_signal.h"
31
32 namespace sandbox {
33
34 namespace {
35
36 const char kSandboxUSERNSEnvironmentVarName[] = "SBX_USER_NS";
37 const char kSandboxPIDNSEnvironmentVarName[] = "SBX_PID_NS";
38 const char kSandboxNETNSEnvironmentVarName[] = "SBX_NET_NS";
39
40 #if !defined(OS_NACL_NONSFI)
41 class WriteUidGidMapDelegate : public base::LaunchOptions::PreExecDelegate {
42 public:
WriteUidGidMapDelegate()43 WriteUidGidMapDelegate()
44 : uid_(getuid()),
45 gid_(getgid()),
46 supports_deny_setgroups_(
47 NamespaceUtils::KernelSupportsDenySetgroups()) {}
48
~WriteUidGidMapDelegate()49 ~WriteUidGidMapDelegate() override {}
50
RunAsyncSafe()51 void RunAsyncSafe() override {
52 if (supports_deny_setgroups_) {
53 RAW_CHECK(NamespaceUtils::DenySetgroups());
54 }
55 RAW_CHECK(NamespaceUtils::WriteToIdMapFile("/proc/self/uid_map", uid_));
56 RAW_CHECK(NamespaceUtils::WriteToIdMapFile("/proc/self/gid_map", gid_));
57 }
58
59 private:
60 const uid_t uid_;
61 const gid_t gid_;
62 const bool supports_deny_setgroups_;
63 DISALLOW_COPY_AND_ASSIGN(WriteUidGidMapDelegate);
64 };
65
SetEnvironForNamespaceType(base::EnvironmentMap * environ,base::NativeEnvironmentString env_var,bool value)66 void SetEnvironForNamespaceType(base::EnvironmentMap* environ,
67 base::NativeEnvironmentString env_var,
68 bool value) {
69 // An empty string causes the env var to be unset in the child process.
70 (*environ)[env_var] = value ? "1" : "";
71 }
72 #endif // !defined(OS_NACL_NONSFI)
73
74 // Linux supports up to 64 signals. This should be updated if that ever changes.
75 int g_signal_exit_codes[64];
76
TerminationSignalHandler(int sig)77 void TerminationSignalHandler(int sig) {
78 // Return a special exit code so that the process is detected as terminated by
79 // a signal.
80 const size_t sig_idx = static_cast<size_t>(sig);
81 if (sig_idx < base::size(g_signal_exit_codes)) {
82 _exit(g_signal_exit_codes[sig_idx]);
83 }
84
85 _exit(NamespaceSandbox::SignalExitCode(sig));
86 }
87
88 #if defined(LIBC_GLIBC)
89 // The first few fields of glibc's struct pthread. The full
90 // definition is in:
91 // https://sourceware.org/git/?p=glibc.git;a=blob;f=nptl/descr.h;hb=95a73392580761abc62fc9b1386d232cd55878e9#l121
92 struct glibc_pthread {
93 union {
94 #if defined(ARCH_CPU_X86_64)
95 // On x86_64, sizeof(tcbhead_t) > sizeof(void*)*24.
96 // https://sourceware.org/git/?p=glibc.git;a=blob;f=sysdeps/x86_64/nptl/tls.h;hb=95a73392580761abc62fc9b1386d232cd55878e9#l65
97 // For all other architectures, sizeof(tcbhead_t) <= sizeof(void*)*24.
98 // https://sourceware.org/git/?p=glibc.git&a=search&h=HEAD&st=grep&s=%7D+tcbhead_t
99 char header[704];
100 #endif
101 void* padding[24];
102 } header;
103 void* list[2];
104 pid_t tid;
105 };
106
GetGlibcCachedTid()107 pid_t GetGlibcCachedTid() {
108 pthread_mutex_t lock = PTHREAD_RECURSIVE_MUTEX_INITIALIZER_NP;
109 CHECK_EQ(0, pthread_mutex_lock(&lock));
110 pid_t tid = lock.__data.__owner;
111 CHECK_EQ(0, pthread_mutex_unlock(&lock));
112 CHECK_EQ(0, pthread_mutex_destroy(&lock));
113 return tid;
114 }
115
MaybeUpdateGlibcTidCache()116 void MaybeUpdateGlibcTidCache() {
117 // After the below CL, glibc does not does not reset the cached
118 // TID/PID on clone(), but pthread depends on it being up-to-date.
119 // This CL was introduced in glibc 2.25, and backported to 2.24 on
120 // at least Debian and Fedora. This is a workaround that updates
121 // the cache manually.
122 // https://sourceware.org/git/?p=glibc.git;a=commit;h=c579f48edba88380635ab98cb612030e3ed8691e
123 pid_t real_tid = sys_gettid();
124 pid_t cached_tid = GetGlibcCachedTid();
125 if (cached_tid != real_tid) {
126 pid_t* cached_tid_location =
127 &reinterpret_cast<struct glibc_pthread*>(pthread_self())->tid;
128 CHECK_EQ(cached_tid, *cached_tid_location);
129 *cached_tid_location = real_tid;
130 CHECK_EQ(real_tid, GetGlibcCachedTid());
131 }
132 }
133 #endif // defined(LIBC_GLIBC)
134
135 } // namespace
136
137 #if !defined(OS_NACL_NONSFI)
Options()138 NamespaceSandbox::Options::Options()
139 : ns_types(CLONE_NEWUSER | CLONE_NEWPID | CLONE_NEWNET),
140 fail_on_unsupported_ns_type(false) {}
141
~Options()142 NamespaceSandbox::Options::~Options() {}
143
144 // static
LaunchProcess(const base::CommandLine & cmdline,const base::LaunchOptions & launch_options)145 base::Process NamespaceSandbox::LaunchProcess(
146 const base::CommandLine& cmdline,
147 const base::LaunchOptions& launch_options) {
148 return LaunchProcessWithOptions(cmdline.argv(), launch_options, Options());
149 }
150
151 // static
LaunchProcess(const std::vector<std::string> & argv,const base::LaunchOptions & launch_options)152 base::Process NamespaceSandbox::LaunchProcess(
153 const std::vector<std::string>& argv,
154 const base::LaunchOptions& launch_options) {
155 return LaunchProcessWithOptions(argv, launch_options, Options());
156 }
157
158 // static
LaunchProcessWithOptions(const base::CommandLine & cmdline,const base::LaunchOptions & launch_options,const Options & ns_sandbox_options)159 base::Process NamespaceSandbox::LaunchProcessWithOptions(
160 const base::CommandLine& cmdline,
161 const base::LaunchOptions& launch_options,
162 const Options& ns_sandbox_options) {
163 return LaunchProcessWithOptions(cmdline.argv(), launch_options,
164 ns_sandbox_options);
165 }
166
167 // static
LaunchProcessWithOptions(const std::vector<std::string> & argv,const base::LaunchOptions & launch_options,const Options & ns_sandbox_options)168 base::Process NamespaceSandbox::LaunchProcessWithOptions(
169 const std::vector<std::string>& argv,
170 const base::LaunchOptions& launch_options,
171 const Options& ns_sandbox_options) {
172 // These fields may not be set by the caller.
173 CHECK(launch_options.pre_exec_delegate == nullptr);
174 CHECK_EQ(0, launch_options.clone_flags);
175
176 int clone_flags = 0;
177 const int kSupportedTypes[] = {CLONE_NEWUSER, CLONE_NEWPID, CLONE_NEWNET};
178 for (const int ns_type : kSupportedTypes) {
179 if ((ns_type & ns_sandbox_options.ns_types) == 0) {
180 continue;
181 }
182
183 if (NamespaceUtils::KernelSupportsUnprivilegedNamespace(ns_type)) {
184 clone_flags |= ns_type;
185 } else if (ns_sandbox_options.fail_on_unsupported_ns_type) {
186 return base::Process();
187 }
188 }
189 CHECK(clone_flags & CLONE_NEWUSER);
190
191 WriteUidGidMapDelegate write_uid_gid_map_delegate;
192
193 base::LaunchOptions launch_options_copy = launch_options;
194 launch_options_copy.pre_exec_delegate = &write_uid_gid_map_delegate;
195 launch_options_copy.clone_flags = clone_flags;
196
197 const std::pair<int, const char*> clone_flag_environ[] = {
198 std::make_pair(CLONE_NEWUSER, kSandboxUSERNSEnvironmentVarName),
199 std::make_pair(CLONE_NEWPID, kSandboxPIDNSEnvironmentVarName),
200 std::make_pair(CLONE_NEWNET, kSandboxNETNSEnvironmentVarName),
201 };
202
203 base::EnvironmentMap* environ = &launch_options_copy.environment;
204 for (const auto& entry : clone_flag_environ) {
205 const int flag = entry.first;
206 const char* environ_name = entry.second;
207 SetEnvironForNamespaceType(environ, environ_name, clone_flags & flag);
208 }
209
210 return base::LaunchProcess(argv, launch_options_copy);
211 }
212 #endif // !defined(OS_NACL_NONSFI)
213
214 // static
ForkInNewPidNamespace(bool drop_capabilities_in_child)215 pid_t NamespaceSandbox::ForkInNewPidNamespace(bool drop_capabilities_in_child) {
216 const pid_t pid =
217 base::ForkWithFlags(CLONE_NEWPID | LINUX_SIGCHLD, nullptr, nullptr);
218 if (pid < 0) {
219 return pid;
220 }
221
222 if (pid == 0) {
223 DCHECK_EQ(1, getpid());
224 if (drop_capabilities_in_child) {
225 // Since we just forked, we are single-threaded, so this should be safe.
226 CHECK(Credentials::DropAllCapabilitiesOnCurrentThread());
227 }
228 #if defined(LIBC_GLIBC)
229 MaybeUpdateGlibcTidCache();
230 #endif
231 return 0;
232 }
233
234 return pid;
235 }
236
237 // static
InstallDefaultTerminationSignalHandlers()238 void NamespaceSandbox::InstallDefaultTerminationSignalHandlers() {
239 static const int kDefaultTermSignals[] = {
240 LINUX_SIGHUP, LINUX_SIGINT, LINUX_SIGABRT, LINUX_SIGQUIT,
241 LINUX_SIGPIPE, LINUX_SIGTERM, LINUX_SIGUSR1, LINUX_SIGUSR2,
242 };
243
244 for (const int sig : kDefaultTermSignals) {
245 InstallTerminationSignalHandler(sig, SignalExitCode(sig));
246 }
247 }
248
249 // static
InstallTerminationSignalHandler(int sig,int exit_code)250 bool NamespaceSandbox::InstallTerminationSignalHandler(
251 int sig,
252 int exit_code) {
253 struct sigaction old_action;
254 PCHECK(sys_sigaction(sig, nullptr, &old_action) == 0);
255
256 #if !defined(OS_NACL_NONSFI)
257 if (old_action.sa_flags & SA_SIGINFO &&
258 old_action.sa_sigaction != nullptr) {
259 return false;
260 }
261 #endif
262
263 if (old_action.sa_handler != LINUX_SIG_DFL) {
264 return false;
265 }
266
267 const size_t sig_idx = static_cast<size_t>(sig);
268 CHECK_LT(sig_idx, base::size(g_signal_exit_codes));
269
270 DCHECK_GE(exit_code, 0);
271 DCHECK_LT(exit_code, 256);
272
273 g_signal_exit_codes[sig_idx] = exit_code;
274
275 struct sigaction action = {};
276 action.sa_handler = &TerminationSignalHandler;
277 PCHECK(sys_sigaction(sig, &action, nullptr) == 0);
278 return true;
279 }
280
281 // static
InNewUserNamespace()282 bool NamespaceSandbox::InNewUserNamespace() {
283 return getenv(kSandboxUSERNSEnvironmentVarName) != nullptr;
284 }
285
286 // static
InNewPidNamespace()287 bool NamespaceSandbox::InNewPidNamespace() {
288 return getenv(kSandboxPIDNSEnvironmentVarName) != nullptr;
289 }
290
291 // static
InNewNetNamespace()292 bool NamespaceSandbox::InNewNetNamespace() {
293 return getenv(kSandboxNETNSEnvironmentVarName) != nullptr;
294 }
295
296 } // namespace sandbox
297