1 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
4
5 #include "content/common/sandbox_linux/bpf_gpu_policy_linux.h"
6
7 #include <dlfcn.h>
8 #include <errno.h>
9 #include <fcntl.h>
10 #include <sys/socket.h>
11 #include <sys/stat.h>
12 #include <sys/types.h>
13 #include <unistd.h>
14
15 #include <string>
16 #include <vector>
17
18 #include "base/bind.h"
19 #include "base/command_line.h"
20 #include "base/compiler_specific.h"
21 #include "base/logging.h"
22 #include "base/memory/scoped_ptr.h"
23 #include "build/build_config.h"
24 #include "content/common/sandbox_linux/sandbox_bpf_base_policy_linux.h"
25 #include "content/common/sandbox_linux/sandbox_seccomp_bpf_linux.h"
26 #include "content/common/set_process_title.h"
27 #include "content/public/common/content_switches.h"
28 #include "sandbox/linux/seccomp-bpf-helpers/syscall_sets.h"
29 #include "sandbox/linux/seccomp-bpf/sandbox_bpf.h"
30 #include "sandbox/linux/services/broker_process.h"
31 #include "sandbox/linux/services/linux_syscalls.h"
32
33 using sandbox::BrokerProcess;
34 using sandbox::ErrorCode;
35 using sandbox::SandboxBPF;
36 using sandbox::SyscallSets;
37 using sandbox::arch_seccomp_data;
38
39 namespace content {
40
41 namespace {
42
IsChromeOS()43 inline bool IsChromeOS() {
44 #if defined(OS_CHROMEOS)
45 return true;
46 #else
47 return false;
48 #endif
49 }
50
IsArchitectureX86_64()51 inline bool IsArchitectureX86_64() {
52 #if defined(__x86_64__)
53 return true;
54 #else
55 return false;
56 #endif
57 }
58
IsArchitectureI386()59 inline bool IsArchitectureI386() {
60 #if defined(__i386__)
61 return true;
62 #else
63 return false;
64 #endif
65 }
66
IsArchitectureArm()67 inline bool IsArchitectureArm() {
68 #if defined(__arm__)
69 return true;
70 #else
71 return false;
72 #endif
73 }
74
IsAcceleratedVideoDecodeEnabled()75 bool IsAcceleratedVideoDecodeEnabled() {
76 const CommandLine& command_line = *CommandLine::ForCurrentProcess();
77 return !command_line.HasSwitch(switches::kDisableAcceleratedVideoDecode);
78 }
79
GpuSIGSYS_Handler(const struct arch_seccomp_data & args,void * aux_broker_process)80 intptr_t GpuSIGSYS_Handler(const struct arch_seccomp_data& args,
81 void* aux_broker_process) {
82 RAW_CHECK(aux_broker_process);
83 BrokerProcess* broker_process =
84 static_cast<BrokerProcess*>(aux_broker_process);
85 switch (args.nr) {
86 case __NR_access:
87 return broker_process->Access(reinterpret_cast<const char*>(args.args[0]),
88 static_cast<int>(args.args[1]));
89 case __NR_open:
90 #if defined(MEMORY_SANITIZER)
91 // http://crbug.com/372840
92 __msan_unpoison_string(reinterpret_cast<const char*>(args.args[0]));
93 #endif
94 return broker_process->Open(reinterpret_cast<const char*>(args.args[0]),
95 static_cast<int>(args.args[1]));
96 case __NR_openat:
97 // Allow using openat() as open().
98 if (static_cast<int>(args.args[0]) == AT_FDCWD) {
99 return
100 broker_process->Open(reinterpret_cast<const char*>(args.args[1]),
101 static_cast<int>(args.args[2]));
102 } else {
103 return -EPERM;
104 }
105 default:
106 RAW_CHECK(false);
107 return -ENOSYS;
108 }
109 }
110
111 class GpuBrokerProcessPolicy : public GpuProcessPolicy {
112 public:
Create()113 static sandbox::SandboxBPFPolicy* Create() {
114 return new GpuBrokerProcessPolicy();
115 }
~GpuBrokerProcessPolicy()116 virtual ~GpuBrokerProcessPolicy() {}
117
118 virtual ErrorCode EvaluateSyscall(SandboxBPF* sandbox_compiler,
119 int system_call_number) const OVERRIDE;
120
121 private:
GpuBrokerProcessPolicy()122 GpuBrokerProcessPolicy() {}
123 DISALLOW_COPY_AND_ASSIGN(GpuBrokerProcessPolicy);
124 };
125
126 // x86_64/i386 or desktop ARM.
127 // A GPU broker policy is the same as a GPU policy with open and
128 // openat allowed.
EvaluateSyscall(SandboxBPF * sandbox,int sysno) const129 ErrorCode GpuBrokerProcessPolicy::EvaluateSyscall(SandboxBPF* sandbox,
130 int sysno) const {
131 switch (sysno) {
132 case __NR_access:
133 case __NR_open:
134 case __NR_openat:
135 return ErrorCode(ErrorCode::ERR_ALLOWED);
136 default:
137 return GpuProcessPolicy::EvaluateSyscall(sandbox, sysno);
138 }
139 }
140
UpdateProcessTypeToGpuBroker()141 void UpdateProcessTypeToGpuBroker() {
142 CommandLine::StringVector exec = CommandLine::ForCurrentProcess()->GetArgs();
143 CommandLine::Reset();
144 CommandLine::Init(0, NULL);
145 CommandLine::ForCurrentProcess()->InitFromArgv(exec);
146 CommandLine::ForCurrentProcess()->AppendSwitchASCII(switches::kProcessType,
147 "gpu-broker");
148
149 // Update the process title. The argv was already cached by the call to
150 // SetProcessTitleFromCommandLine in content_main_runner.cc, so we can pass
151 // NULL here (we don't have the original argv at this point).
152 SetProcessTitleFromCommandLine(NULL);
153 }
154
UpdateProcessTypeAndEnableSandbox(sandbox::SandboxBPFPolicy * (* broker_sandboxer_allocator)(void))155 bool UpdateProcessTypeAndEnableSandbox(
156 sandbox::SandboxBPFPolicy* (*broker_sandboxer_allocator)(void)) {
157 DCHECK(broker_sandboxer_allocator);
158 UpdateProcessTypeToGpuBroker();
159 return SandboxSeccompBPF::StartSandboxWithExternalPolicy(
160 make_scoped_ptr(broker_sandboxer_allocator()));
161 }
162
163 } // namespace
164
GpuProcessPolicy()165 GpuProcessPolicy::GpuProcessPolicy() : broker_process_(NULL) {}
166
~GpuProcessPolicy()167 GpuProcessPolicy::~GpuProcessPolicy() {}
168
169 // Main policy for x86_64/i386. Extended by CrosArmGpuProcessPolicy.
EvaluateSyscall(SandboxBPF * sandbox,int sysno) const170 ErrorCode GpuProcessPolicy::EvaluateSyscall(SandboxBPF* sandbox,
171 int sysno) const {
172 switch (sysno) {
173 case __NR_ioctl:
174 #if defined(__i386__) || defined(__x86_64__)
175 // The Nvidia driver uses flags not in the baseline policy
176 // (MAP_LOCKED | MAP_EXECUTABLE | MAP_32BIT)
177 case __NR_mmap:
178 #endif
179 // We also hit this on the linux_chromeos bot but don't yet know what
180 // weird flags were involved.
181 case __NR_mprotect:
182 // TODO(jln): restrict prctl.
183 case __NR_prctl:
184 case __NR_sched_getaffinity:
185 case __NR_sched_setaffinity:
186 case __NR_setpriority:
187 return ErrorCode(ErrorCode::ERR_ALLOWED);
188 case __NR_access:
189 case __NR_open:
190 case __NR_openat:
191 DCHECK(broker_process_);
192 return sandbox->Trap(GpuSIGSYS_Handler, broker_process_);
193 default:
194 if (SyscallSets::IsEventFd(sysno))
195 return ErrorCode(ErrorCode::ERR_ALLOWED);
196
197 // Default on the baseline policy.
198 return SandboxBPFBasePolicy::EvaluateSyscall(sandbox, sysno);
199 }
200 }
201
PreSandboxHook()202 bool GpuProcessPolicy::PreSandboxHook() {
203 // Warm up resources needed by the policy we're about to enable and
204 // eventually start a broker process.
205 const bool chromeos_arm_gpu = IsChromeOS() && IsArchitectureArm();
206 // This policy is for x86 or Desktop.
207 DCHECK(!chromeos_arm_gpu);
208
209 DCHECK(!broker_process());
210 // Create a new broker process.
211 InitGpuBrokerProcess(
212 GpuBrokerProcessPolicy::Create,
213 std::vector<std::string>(), // No extra files in whitelist.
214 std::vector<std::string>());
215
216 if (IsArchitectureX86_64() || IsArchitectureI386()) {
217 // Accelerated video decode dlopen()'s some shared objects
218 // inside the sandbox, so preload them now.
219 if (IsAcceleratedVideoDecodeEnabled()) {
220 const char* I965DrvVideoPath = NULL;
221
222 if (IsArchitectureX86_64()) {
223 I965DrvVideoPath = "/usr/lib64/va/drivers/i965_drv_video.so";
224 } else if (IsArchitectureI386()) {
225 I965DrvVideoPath = "/usr/lib/va/drivers/i965_drv_video.so";
226 }
227
228 dlopen(I965DrvVideoPath, RTLD_NOW|RTLD_GLOBAL|RTLD_NODELETE);
229 dlopen("libva.so.1", RTLD_NOW|RTLD_GLOBAL|RTLD_NODELETE);
230 dlopen("libva-x11.so.1", RTLD_NOW|RTLD_GLOBAL|RTLD_NODELETE);
231 }
232 }
233
234 return true;
235 }
236
InitGpuBrokerProcess(sandbox::SandboxBPFPolicy * (* broker_sandboxer_allocator)(void),const std::vector<std::string> & read_whitelist_extra,const std::vector<std::string> & write_whitelist_extra)237 void GpuProcessPolicy::InitGpuBrokerProcess(
238 sandbox::SandboxBPFPolicy* (*broker_sandboxer_allocator)(void),
239 const std::vector<std::string>& read_whitelist_extra,
240 const std::vector<std::string>& write_whitelist_extra) {
241 static const char kDriRcPath[] = "/etc/drirc";
242 static const char kDriCard0Path[] = "/dev/dri/card0";
243
244 CHECK(broker_process_ == NULL);
245
246 // All GPU process policies need these files brokered out.
247 std::vector<std::string> read_whitelist;
248 read_whitelist.push_back(kDriCard0Path);
249 read_whitelist.push_back(kDriRcPath);
250 // Add eventual extra files from read_whitelist_extra.
251 read_whitelist.insert(read_whitelist.end(),
252 read_whitelist_extra.begin(),
253 read_whitelist_extra.end());
254
255 std::vector<std::string> write_whitelist;
256 write_whitelist.push_back(kDriCard0Path);
257 // Add eventual extra files from write_whitelist_extra.
258 write_whitelist.insert(write_whitelist.end(),
259 write_whitelist_extra.begin(),
260 write_whitelist_extra.end());
261
262 broker_process_ = new BrokerProcess(GetFSDeniedErrno(),
263 read_whitelist,
264 write_whitelist);
265 // The initialization callback will perform generic initialization and then
266 // call broker_sandboxer_callback.
267 CHECK(broker_process_->Init(base::Bind(&UpdateProcessTypeAndEnableSandbox,
268 broker_sandboxer_allocator)));
269 }
270
271 } // namespace content
272