1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
4
5 #include "components/nacl/zygote/nacl_fork_delegate_linux.h"
6
7 #include <signal.h>
8 #include <stdlib.h>
9 #include <sys/resource.h>
10 #include <sys/socket.h>
11
12 #include <set>
13
14 #include "base/basictypes.h"
15 #include "base/command_line.h"
16 #include "base/cpu.h"
17 #include "base/files/file_path.h"
18 #include "base/files/scoped_file.h"
19 #include "base/logging.h"
20 #include "base/memory/scoped_ptr.h"
21 #include "base/memory/scoped_vector.h"
22 #include "base/path_service.h"
23 #include "base/pickle.h"
24 #include "base/posix/eintr_wrapper.h"
25 #include "base/posix/global_descriptors.h"
26 #include "base/posix/unix_domain_socket_linux.h"
27 #include "base/process/kill.h"
28 #include "base/process/launch.h"
29 #include "base/strings/string_split.h"
30 #include "base/third_party/dynamic_annotations/dynamic_annotations.h"
31 #include "build/build_config.h"
32 #include "components/nacl/common/nacl_nonsfi_util.h"
33 #include "components/nacl/common/nacl_paths.h"
34 #include "components/nacl/common/nacl_switches.h"
35 #include "components/nacl/loader/nacl_helper_linux.h"
36 #include "content/public/common/content_descriptors.h"
37 #include "content/public/common/content_switches.h"
38 #include "sandbox/linux/suid/client/setuid_sandbox_client.h"
39 #include "sandbox/linux/suid/common/sandbox.h"
40
41 namespace {
42
43 // Note these need to match up with their counterparts in nacl_helper_linux.c
44 // and nacl_helper_bootstrap_linux.c.
45 const char kNaClHelperReservedAtZero[] =
46 "--reserved_at_zero=0xXXXXXXXXXXXXXXXX";
47 const char kNaClHelperRDebug[] = "--r_debug=0xXXXXXXXXXXXXXXXX";
48
49 // This is an environment variable which controls which (if any) other
50 // environment variables are passed through to NaCl processes. e.g.,
51 // NACL_ENV_PASSTHROUGH="PATH,CWD" would pass both $PATH and $CWD to the child
52 // process.
53 const char kNaClEnvPassthrough[] = "NACL_ENV_PASSTHROUGH";
54 char kNaClEnvPassthroughDelimiter = ',';
55
56 // The following environment variables are always passed through if they exist
57 // in the parent process.
58 const char kNaClExeStderr[] = "NACL_EXE_STDERR";
59 const char kNaClExeStdout[] = "NACL_EXE_STDOUT";
60 const char kNaClVerbosity[] = "NACLVERBOSITY";
61
62 #if defined(ARCH_CPU_X86)
NonZeroSegmentBaseIsSlow()63 bool NonZeroSegmentBaseIsSlow() {
64 base::CPU cpuid;
65 // Using a non-zero segment base is known to be very slow on Intel
66 // Atom CPUs. See "Segmentation-based Memory Protection Mechanism
67 // on Intel Atom Microarchitecture: Coding Optimizations" (Leonardo
68 // Potenza, Intel).
69 //
70 // The following list of CPU model numbers is taken from:
71 // "Intel 64 and IA-32 Architectures Software Developer's Manual"
72 // (http://download.intel.com/products/processor/manual/325462.pdf),
73 // "Table 35-1. CPUID Signature Values of DisplayFamily_DisplayModel"
74 // (Volume 3C, 35-1), which contains:
75 // "06_36H - Intel Atom S Processor Family
76 // 06_1CH, 06_26H, 06_27H, 06_35, 06_36 - Intel Atom Processor Family"
77 if (cpuid.family() == 6) {
78 switch (cpuid.model()) {
79 case 0x1c:
80 case 0x26:
81 case 0x27:
82 case 0x35:
83 case 0x36:
84 return true;
85 }
86 }
87 return false;
88 }
89 #endif
90
91 // Send an IPC request on |ipc_channel|. The request is contained in
92 // |request_pickle| and can have file descriptors attached in |attached_fds|.
93 // |reply_data_buffer| must be allocated by the caller and will contain the
94 // reply. The size of the reply will be written to |reply_size|.
95 // This code assumes that only one thread can write to |ipc_channel| to make
96 // requests.
SendIPCRequestAndReadReply(int ipc_channel,const std::vector<int> & attached_fds,const Pickle & request_pickle,char * reply_data_buffer,size_t reply_data_buffer_size,ssize_t * reply_size)97 bool SendIPCRequestAndReadReply(int ipc_channel,
98 const std::vector<int>& attached_fds,
99 const Pickle& request_pickle,
100 char* reply_data_buffer,
101 size_t reply_data_buffer_size,
102 ssize_t* reply_size) {
103 DCHECK_LE(static_cast<size_t>(kNaClMaxIPCMessageLength),
104 reply_data_buffer_size);
105 DCHECK(reply_size);
106
107 if (!UnixDomainSocket::SendMsg(ipc_channel, request_pickle.data(),
108 request_pickle.size(), attached_fds)) {
109 LOG(ERROR) << "SendIPCRequestAndReadReply: SendMsg failed";
110 return false;
111 }
112
113 // Then read the remote reply.
114 ScopedVector<base::ScopedFD> received_fds;
115 const ssize_t msg_len =
116 UnixDomainSocket::RecvMsg(ipc_channel, reply_data_buffer,
117 reply_data_buffer_size, &received_fds);
118 if (msg_len <= 0) {
119 LOG(ERROR) << "SendIPCRequestAndReadReply: RecvMsg failed";
120 return false;
121 }
122 *reply_size = msg_len;
123 return true;
124 }
125
126 } // namespace.
127
128 namespace nacl {
129
AddNaClZygoteForkDelegates(ScopedVector<content::ZygoteForkDelegate> * delegates)130 void AddNaClZygoteForkDelegates(
131 ScopedVector<content::ZygoteForkDelegate>* delegates) {
132 delegates->push_back(new NaClForkDelegate(false /* nonsfi_mode */));
133 delegates->push_back(new NaClForkDelegate(true /* nonsfi_mode */));
134 }
135
NaClForkDelegate(bool nonsfi_mode)136 NaClForkDelegate::NaClForkDelegate(bool nonsfi_mode)
137 : nonsfi_mode_(nonsfi_mode), status_(kNaClHelperUnused), fd_(-1) {
138 }
139
Init(const int sandboxdesc,const bool enable_layer1_sandbox)140 void NaClForkDelegate::Init(const int sandboxdesc,
141 const bool enable_layer1_sandbox) {
142 VLOG(1) << "NaClForkDelegate::Init()";
143
144 // Only launch the non-SFI helper process if non-SFI mode is enabled.
145 if (nonsfi_mode_ && !IsNonSFIModeEnabled()) {
146 return;
147 }
148
149 scoped_ptr<sandbox::SetuidSandboxClient> setuid_sandbox_client(
150 sandbox::SetuidSandboxClient::Create());
151
152 // For communications between the NaCl loader process and
153 // the SUID sandbox.
154 int nacl_sandbox_descriptor =
155 base::GlobalDescriptors::kBaseDescriptor + kSandboxIPCChannel;
156 // Confirm a hard-wired assumption.
157 DCHECK_EQ(sandboxdesc, nacl_sandbox_descriptor);
158
159 int fds[2];
160 PCHECK(0 == socketpair(PF_UNIX, SOCK_SEQPACKET, 0, fds));
161 base::FileHandleMappingVector fds_to_map;
162 fds_to_map.push_back(std::make_pair(fds[1], kNaClZygoteDescriptor));
163 fds_to_map.push_back(std::make_pair(sandboxdesc, nacl_sandbox_descriptor));
164
165 bool use_nacl_bootstrap = false;
166 // For non-SFI mode, we do not use fixed address space.
167 if (!nonsfi_mode_) {
168 // Using nacl_helper_bootstrap is not necessary on x86-64 because
169 // NaCl's x86-64 sandbox is not zero-address-based. Starting
170 // nacl_helper through nacl_helper_bootstrap works on x86-64, but it
171 // leaves nacl_helper_bootstrap mapped at a fixed address at the
172 // bottom of the address space, which is undesirable because it
173 // effectively defeats ASLR.
174 #if defined(ARCH_CPU_X86_64)
175 use_nacl_bootstrap = false;
176 #elif defined(ARCH_CPU_X86)
177 // Performance vs. security trade-off: We prefer using a
178 // non-zero-address-based sandbox on x86-32 because it provides some
179 // ASLR and so is more secure. However, on Atom CPUs, using a
180 // non-zero segment base is very slow, so we use a zero-based
181 // sandbox on those.
182 use_nacl_bootstrap = NonZeroSegmentBaseIsSlow();
183 #else
184 use_nacl_bootstrap = true;
185 #endif
186 }
187
188 status_ = kNaClHelperUnused;
189 base::FilePath helper_exe;
190 base::FilePath helper_bootstrap_exe;
191 if (!PathService::Get(nacl::FILE_NACL_HELPER, &helper_exe)) {
192 status_ = kNaClHelperMissing;
193 } else if (use_nacl_bootstrap &&
194 !PathService::Get(nacl::FILE_NACL_HELPER_BOOTSTRAP,
195 &helper_bootstrap_exe)) {
196 status_ = kNaClHelperBootstrapMissing;
197 } else if (RunningOnValgrind()) {
198 status_ = kNaClHelperValgrind;
199 } else {
200 CommandLine::StringVector argv_to_launch;
201 {
202 CommandLine cmd_line(CommandLine::NO_PROGRAM);
203 if (use_nacl_bootstrap)
204 cmd_line.SetProgram(helper_bootstrap_exe);
205 else
206 cmd_line.SetProgram(helper_exe);
207
208 // Append any switches that need to be forwarded to the NaCl helper.
209 static const char* kForwardSwitches[] = {
210 switches::kDisableSeccompFilterSandbox,
211 switches::kNaClDangerousNoSandboxNonSfi,
212 switches::kNoSandbox,
213 };
214 const CommandLine& current_cmd_line = *CommandLine::ForCurrentProcess();
215 cmd_line.CopySwitchesFrom(current_cmd_line, kForwardSwitches,
216 arraysize(kForwardSwitches));
217
218 // The command line needs to be tightly controlled to use
219 // |helper_bootstrap_exe|. So from now on, argv_to_launch should be
220 // modified directly.
221 argv_to_launch = cmd_line.argv();
222 }
223 if (use_nacl_bootstrap) {
224 // Arguments to the bootstrap helper which need to be at the start
225 // of the command line, right after the helper's path.
226 CommandLine::StringVector bootstrap_prepend;
227 bootstrap_prepend.push_back(helper_exe.value());
228 bootstrap_prepend.push_back(kNaClHelperReservedAtZero);
229 bootstrap_prepend.push_back(kNaClHelperRDebug);
230 argv_to_launch.insert(argv_to_launch.begin() + 1,
231 bootstrap_prepend.begin(),
232 bootstrap_prepend.end());
233 }
234
235 base::LaunchOptions options;
236
237 base::ScopedFD dummy_fd;
238 if (enable_layer1_sandbox) {
239 // NaCl needs to keep tight control of the cmd_line, so prepend the
240 // setuid sandbox wrapper manually.
241 base::FilePath sandbox_path =
242 setuid_sandbox_client->GetSandboxBinaryPath();
243 argv_to_launch.insert(argv_to_launch.begin(), sandbox_path.value());
244 setuid_sandbox_client->SetupLaunchOptions(
245 &options, &fds_to_map, &dummy_fd);
246 setuid_sandbox_client->SetupLaunchEnvironment();
247 }
248
249 options.fds_to_remap = &fds_to_map;
250
251 // The NaCl processes spawned may need to exceed the ambient soft limit
252 // on RLIMIT_AS to allocate the untrusted address space and its guard
253 // regions. The nacl_helper itself cannot just raise its own limit,
254 // because the existing limit may prevent the initial exec of
255 // nacl_helper_bootstrap from succeeding, with its large address space
256 // reservation.
257 std::vector<int> max_these_limits;
258 max_these_limits.push_back(RLIMIT_AS);
259 options.maximize_rlimits = &max_these_limits;
260
261 // To avoid information leaks in Non-SFI mode, clear the environment for
262 // the NaCl Helper process.
263 options.clear_environ = true;
264 AddPassthroughEnvToOptions(&options);
265
266 if (!base::LaunchProcess(argv_to_launch, options, NULL))
267 status_ = kNaClHelperLaunchFailed;
268 // parent and error cases are handled below
269
270 if (enable_layer1_sandbox) {
271 // Sanity check that dummy_fd was kept alive for LaunchProcess.
272 DCHECK(dummy_fd.is_valid());
273 }
274 }
275 if (IGNORE_EINTR(close(fds[1])) != 0)
276 LOG(ERROR) << "close(fds[1]) failed";
277 if (status_ == kNaClHelperUnused) {
278 const ssize_t kExpectedLength = strlen(kNaClHelperStartupAck);
279 char buf[kExpectedLength];
280
281 // Wait for ack from nacl_helper, indicating it is ready to help
282 const ssize_t nread = HANDLE_EINTR(read(fds[0], buf, sizeof(buf)));
283 if (nread == kExpectedLength &&
284 memcmp(buf, kNaClHelperStartupAck, nread) == 0) {
285 // all is well
286 status_ = kNaClHelperSuccess;
287 fd_ = fds[0];
288 return;
289 }
290
291 status_ = kNaClHelperAckFailed;
292 LOG(ERROR) << "Bad NaCl helper startup ack (" << nread << " bytes)";
293 }
294 // TODO(bradchen): Make this LOG(ERROR) when the NaCl helper
295 // becomes the default.
296 fd_ = -1;
297 if (IGNORE_EINTR(close(fds[0])) != 0)
298 LOG(ERROR) << "close(fds[0]) failed";
299 }
300
InitialUMA(std::string * uma_name,int * uma_sample,int * uma_boundary_value)301 void NaClForkDelegate::InitialUMA(std::string* uma_name,
302 int* uma_sample,
303 int* uma_boundary_value) {
304 *uma_name = nonsfi_mode_ ? "NaCl.Client.HelperNonSFI.InitState"
305 : "NaCl.Client.Helper.InitState";
306 *uma_sample = status_;
307 *uma_boundary_value = kNaClHelperStatusBoundary;
308 }
309
~NaClForkDelegate()310 NaClForkDelegate::~NaClForkDelegate() {
311 // side effect of close: delegate process will terminate
312 if (status_ == kNaClHelperSuccess) {
313 if (IGNORE_EINTR(close(fd_)) != 0)
314 LOG(ERROR) << "close(fd_) failed";
315 }
316 }
317
CanHelp(const std::string & process_type,std::string * uma_name,int * uma_sample,int * uma_boundary_value)318 bool NaClForkDelegate::CanHelp(const std::string& process_type,
319 std::string* uma_name,
320 int* uma_sample,
321 int* uma_boundary_value) {
322 // We can only help with a specific process type depending on nonsfi_mode_.
323 const char* helpable_process_type = nonsfi_mode_
324 ? switches::kNaClLoaderNonSfiProcess
325 : switches::kNaClLoaderProcess;
326 if (process_type != helpable_process_type)
327 return false;
328 *uma_name = nonsfi_mode_ ? "NaCl.Client.HelperNonSFI.StateOnFork"
329 : "NaCl.Client.Helper.StateOnFork";
330 *uma_sample = status_;
331 *uma_boundary_value = kNaClHelperStatusBoundary;
332 return true;
333 }
334
Fork(const std::string & process_type,const std::vector<int> & fds,const std::string & channel_id)335 pid_t NaClForkDelegate::Fork(const std::string& process_type,
336 const std::vector<int>& fds,
337 const std::string& channel_id) {
338 VLOG(1) << "NaClForkDelegate::Fork";
339
340 DCHECK(fds.size() == kNumPassedFDs);
341
342 if (status_ != kNaClHelperSuccess) {
343 LOG(ERROR) << "Cannot launch NaCl process: nacl_helper failed to start";
344 return -1;
345 }
346
347 // First, send a remote fork request.
348 Pickle write_pickle;
349 write_pickle.WriteInt(nacl::kNaClForkRequest);
350 // TODO(hamaji): When we split the helper binary for non-SFI mode
351 // from nacl_helper, stop sending this information.
352 write_pickle.WriteBool(nonsfi_mode_);
353 write_pickle.WriteString(channel_id);
354
355 char reply_buf[kNaClMaxIPCMessageLength];
356 ssize_t reply_size = 0;
357 bool got_reply =
358 SendIPCRequestAndReadReply(fd_, fds, write_pickle,
359 reply_buf, sizeof(reply_buf), &reply_size);
360 if (!got_reply) {
361 LOG(ERROR) << "Could not perform remote fork.";
362 return -1;
363 }
364
365 // Now see if the other end managed to fork.
366 Pickle reply_pickle(reply_buf, reply_size);
367 PickleIterator iter(reply_pickle);
368 pid_t nacl_child;
369 if (!iter.ReadInt(&nacl_child)) {
370 LOG(ERROR) << "NaClForkDelegate::Fork: pickle failed";
371 return -1;
372 }
373 VLOG(1) << "nacl_child is " << nacl_child;
374 return nacl_child;
375 }
376
GetTerminationStatus(pid_t pid,bool known_dead,base::TerminationStatus * status,int * exit_code)377 bool NaClForkDelegate::GetTerminationStatus(pid_t pid, bool known_dead,
378 base::TerminationStatus* status,
379 int* exit_code) {
380 VLOG(1) << "NaClForkDelegate::GetTerminationStatus";
381 DCHECK(status);
382 DCHECK(exit_code);
383
384 Pickle write_pickle;
385 write_pickle.WriteInt(nacl::kNaClGetTerminationStatusRequest);
386 write_pickle.WriteInt(pid);
387 write_pickle.WriteBool(known_dead);
388
389 const std::vector<int> empty_fds;
390 char reply_buf[kNaClMaxIPCMessageLength];
391 ssize_t reply_size = 0;
392 bool got_reply =
393 SendIPCRequestAndReadReply(fd_, empty_fds, write_pickle,
394 reply_buf, sizeof(reply_buf), &reply_size);
395 if (!got_reply) {
396 LOG(ERROR) << "Could not perform remote GetTerminationStatus.";
397 return false;
398 }
399
400 Pickle reply_pickle(reply_buf, reply_size);
401 PickleIterator iter(reply_pickle);
402 int termination_status;
403 if (!iter.ReadInt(&termination_status) ||
404 termination_status < 0 ||
405 termination_status >= base::TERMINATION_STATUS_MAX_ENUM) {
406 LOG(ERROR) << "GetTerminationStatus: pickle failed";
407 return false;
408 }
409
410 int remote_exit_code;
411 if (!iter.ReadInt(&remote_exit_code)) {
412 LOG(ERROR) << "GetTerminationStatus: pickle failed";
413 return false;
414 }
415
416 *status = static_cast<base::TerminationStatus>(termination_status);
417 *exit_code = remote_exit_code;
418 return true;
419 }
420
421 // static
AddPassthroughEnvToOptions(base::LaunchOptions * options)422 void NaClForkDelegate::AddPassthroughEnvToOptions(
423 base::LaunchOptions* options) {
424 scoped_ptr<base::Environment> env(base::Environment::Create());
425 std::string pass_through_string;
426 std::vector<std::string> pass_through_vars;
427 if (env->GetVar(kNaClEnvPassthrough, &pass_through_string)) {
428 base::SplitString(
429 pass_through_string, kNaClEnvPassthroughDelimiter, &pass_through_vars);
430 }
431 pass_through_vars.push_back(kNaClExeStderr);
432 pass_through_vars.push_back(kNaClExeStdout);
433 pass_through_vars.push_back(kNaClVerbosity);
434 pass_through_vars.push_back(sandbox::kSandboxEnvironmentApiRequest);
435 for (size_t i = 0; i < pass_through_vars.size(); ++i) {
436 std::string temp;
437 if (env->GetVar(pass_through_vars[i].c_str(), &temp))
438 options->environ[pass_through_vars[i]] = temp;
439 }
440 }
441
442 } // namespace nacl
443