• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
4 
5 #include "sandbox/linux/suid/client/setuid_sandbox_client.h"
6 
7 #include <fcntl.h>
8 #include <stdlib.h>
9 #include <sys/socket.h>
10 #include <sys/stat.h>
11 #include <sys/types.h>
12 #include <sys/wait.h>
13 #include <unistd.h>
14 
15 #include "base/command_line.h"
16 #include "base/environment.h"
17 #include "base/files/file_path.h"
18 #include "base/files/file_util.h"
19 #include "base/files/scoped_file.h"
20 #include "base/logging.h"
21 #include "base/macros.h"
22 #include "base/memory/scoped_ptr.h"
23 #include "base/path_service.h"
24 #include "base/posix/eintr_wrapper.h"
25 #include "base/process/launch.h"
26 #include "base/process/process_metrics.h"
27 #include "base/strings/string_number_conversions.h"
28 #include "sandbox/linux/services/init_process_reaper.h"
29 #include "sandbox/linux/suid/common/sandbox.h"
30 #include "sandbox/linux/suid/common/suid_unsafe_environment_variables.h"
31 
32 namespace {
33 
IsFileSystemAccessDenied()34 bool IsFileSystemAccessDenied() {
35   base::ScopedFD self_exe(HANDLE_EINTR(open(base::kProcSelfExe, O_RDONLY)));
36   return !self_exe.is_valid();
37 }
38 
39 // Set an environment variable that reflects the API version we expect from the
40 // setuid sandbox. Old versions of the sandbox will ignore this.
SetSandboxAPIEnvironmentVariable(base::Environment * env)41 void SetSandboxAPIEnvironmentVariable(base::Environment* env) {
42   env->SetVar(sandbox::kSandboxEnvironmentApiRequest,
43               base::IntToString(sandbox::kSUIDSandboxApiNumber));
44 }
45 
46 // Unset environment variables that are expected to be set by the setuid
47 // sandbox. This is to allow nesting of one instance of the SUID sandbox
48 // inside another.
UnsetExpectedEnvironmentVariables(base::EnvironmentMap * env_map)49 void UnsetExpectedEnvironmentVariables(base::EnvironmentMap* env_map) {
50   DCHECK(env_map);
51   const base::NativeEnvironmentString environment_vars[] = {
52       sandbox::kSandboxDescriptorEnvironmentVarName,
53       sandbox::kSandboxHelperPidEnvironmentVarName,
54       sandbox::kSandboxEnvironmentApiProvides,
55       sandbox::kSandboxPIDNSEnvironmentVarName,
56       sandbox::kSandboxNETNSEnvironmentVarName,
57   };
58 
59   for (size_t i = 0; i < arraysize(environment_vars); ++i) {
60     // Setting values in EnvironmentMap to an empty-string will make
61     // sure that they get unset from the environment via AlterEnvironment().
62     (*env_map)[environment_vars[i]] = base::NativeEnvironmentString();
63   }
64 }
65 
66 // Wrapper around a shared C function.
67 // Returns the "saved" environment variable name corresponding to |envvar|
68 // in a new string or NULL.
CreateSavedVariableName(const char * env_var)69 std::string* CreateSavedVariableName(const char* env_var) {
70   char* const saved_env_var = SandboxSavedEnvironmentVariable(env_var);
71   if (!saved_env_var)
72     return NULL;
73   std::string* saved_env_var_copy = new std::string(saved_env_var);
74   // SandboxSavedEnvironmentVariable is the C function that we wrap and uses
75   // malloc() to allocate memory.
76   free(saved_env_var);
77   return saved_env_var_copy;
78 }
79 
80 // The ELF loader will clear many environment variables so we save them to
81 // different names here so that the SUID sandbox can resolve them for the
82 // renderer.
SaveSUIDUnsafeEnvironmentVariables(base::Environment * env)83 void SaveSUIDUnsafeEnvironmentVariables(base::Environment* env) {
84   for (unsigned i = 0; kSUIDUnsafeEnvironmentVariables[i]; ++i) {
85     const char* env_var = kSUIDUnsafeEnvironmentVariables[i];
86     // Get the saved environment variable corresponding to envvar.
87     scoped_ptr<std::string> saved_env_var(CreateSavedVariableName(env_var));
88     if (saved_env_var == NULL)
89       continue;
90 
91     std::string value;
92     if (env->GetVar(env_var, &value))
93       env->SetVar(saved_env_var->c_str(), value);
94     else
95       env->UnSetVar(saved_env_var->c_str());
96   }
97 }
98 
GetHelperApi(base::Environment * env)99 int GetHelperApi(base::Environment* env) {
100   std::string api_string;
101   int api_number = 0;  // Assume API version 0 if no environment was found.
102   if (env->GetVar(sandbox::kSandboxEnvironmentApiProvides, &api_string) &&
103       !base::StringToInt(api_string, &api_number)) {
104     // It's an error if we could not convert the API number.
105     api_number = -1;
106   }
107   return api_number;
108 }
109 
110 // Convert |var_name| from the environment |env| to an int.
111 // Return -1 if the variable does not exist or the value cannot be converted.
EnvToInt(base::Environment * env,const char * var_name)112 int EnvToInt(base::Environment* env, const char* var_name) {
113   std::string var_string;
114   int var_value = -1;
115   if (env->GetVar(var_name, &var_string) &&
116       !base::StringToInt(var_string, &var_value)) {
117     var_value = -1;
118   }
119   return var_value;
120 }
121 
GetHelperPID(base::Environment * env)122 pid_t GetHelperPID(base::Environment* env) {
123   return EnvToInt(env, sandbox::kSandboxHelperPidEnvironmentVarName);
124 }
125 
126 // Get the IPC file descriptor used to communicate with the setuid helper.
GetIPCDescriptor(base::Environment * env)127 int GetIPCDescriptor(base::Environment* env) {
128   return EnvToInt(env, sandbox::kSandboxDescriptorEnvironmentVarName);
129 }
130 
GetDevelSandboxPath()131 const char* GetDevelSandboxPath() {
132   return getenv("CHROME_DEVEL_SANDBOX");
133 }
134 
135 }  // namespace
136 
137 namespace sandbox {
138 
Create()139 SetuidSandboxClient* SetuidSandboxClient::Create() {
140   base::Environment* environment(base::Environment::Create());
141   SetuidSandboxClient* sandbox_client(new SetuidSandboxClient);
142 
143   CHECK(environment);
144   sandbox_client->env_ = environment;
145   return sandbox_client;
146 }
147 
SetuidSandboxClient()148 SetuidSandboxClient::SetuidSandboxClient()
149     : env_(NULL),
150       sandboxed_(false) {
151 }
152 
~SetuidSandboxClient()153 SetuidSandboxClient::~SetuidSandboxClient() {
154   delete env_;
155 }
156 
CloseDummyFile()157 void SetuidSandboxClient::CloseDummyFile() {
158   // When we're launched through the setuid sandbox, SetupLaunchOptions
159   // arranges for kZygoteIdFd to be a dummy file descriptor to satisfy an
160   // ancient setuid sandbox ABI requirement. However, the descriptor is no
161   // longer needed, so we can simply close it right away now.
162   CHECK(IsSuidSandboxChild());
163 
164   // Sanity check that kZygoteIdFd refers to a pipe.
165   struct stat st;
166   PCHECK(0 == fstat(kZygoteIdFd, &st));
167   CHECK(S_ISFIFO(st.st_mode));
168 
169   PCHECK(0 == IGNORE_EINTR(close(kZygoteIdFd)));
170 }
171 
ChrootMe()172 bool SetuidSandboxClient::ChrootMe() {
173   int ipc_fd = GetIPCDescriptor(env_);
174 
175   if (ipc_fd < 0) {
176     LOG(ERROR) << "Failed to obtain the sandbox IPC descriptor";
177     return false;
178   }
179 
180   if (HANDLE_EINTR(write(ipc_fd, &kMsgChrootMe, 1)) != 1) {
181     PLOG(ERROR) << "Failed to write to chroot pipe";
182     return false;
183   }
184 
185   // We need to reap the chroot helper process in any event.
186   pid_t helper_pid = GetHelperPID(env_);
187   // If helper_pid is -1 we wait for any child.
188   if (HANDLE_EINTR(waitpid(helper_pid, NULL, 0)) < 0) {
189     PLOG(ERROR) << "Failed to wait for setuid helper to die";
190     return false;
191   }
192 
193   char reply;
194   if (HANDLE_EINTR(read(ipc_fd, &reply, 1)) != 1) {
195     PLOG(ERROR) << "Failed to read from chroot pipe";
196     return false;
197   }
198 
199   if (reply != kMsgChrootSuccessful) {
200     LOG(ERROR) << "Error code reply from chroot helper";
201     return false;
202   }
203 
204   // We now consider ourselves "fully sandboxed" as far as the
205   // setuid sandbox is concerned.
206   CHECK(IsFileSystemAccessDenied());
207   sandboxed_ = true;
208   return true;
209 }
210 
CreateInitProcessReaper(base::Closure * post_fork_parent_callback)211 bool SetuidSandboxClient::CreateInitProcessReaper(
212     base::Closure* post_fork_parent_callback) {
213   return sandbox::CreateInitProcessReaper(post_fork_parent_callback);
214 }
215 
IsSuidSandboxUpToDate() const216 bool SetuidSandboxClient::IsSuidSandboxUpToDate() const {
217   return GetHelperApi(env_) == kSUIDSandboxApiNumber;
218 }
219 
IsSuidSandboxChild() const220 bool SetuidSandboxClient::IsSuidSandboxChild() const {
221   return GetIPCDescriptor(env_) >= 0;
222 }
223 
IsInNewPIDNamespace() const224 bool SetuidSandboxClient::IsInNewPIDNamespace() const {
225   return env_->HasVar(kSandboxPIDNSEnvironmentVarName);
226 }
227 
IsInNewNETNamespace() const228 bool SetuidSandboxClient::IsInNewNETNamespace() const {
229   return env_->HasVar(kSandboxNETNSEnvironmentVarName);
230 }
231 
IsSandboxed() const232 bool SetuidSandboxClient::IsSandboxed() const {
233   return sandboxed_;
234 }
235 
236 // Check if CHROME_DEVEL_SANDBOX is set but empty. This currently disables
237 // the setuid sandbox. TODO(jln): fix this (crbug.com/245376).
IsDisabledViaEnvironment()238 bool SetuidSandboxClient::IsDisabledViaEnvironment() {
239   const char* devel_sandbox_path = GetDevelSandboxPath();
240   if (devel_sandbox_path && '\0' == *devel_sandbox_path) {
241     return true;
242   }
243   return false;
244 }
245 
GetSandboxBinaryPath()246 base::FilePath SetuidSandboxClient::GetSandboxBinaryPath() {
247   base::FilePath sandbox_binary;
248   base::FilePath exe_dir;
249   if (PathService::Get(base::DIR_EXE, &exe_dir)) {
250     base::FilePath sandbox_candidate = exe_dir.AppendASCII("chrome-sandbox");
251     if (base::PathExists(sandbox_candidate))
252       sandbox_binary = sandbox_candidate;
253   }
254 
255   // In user-managed builds, including development builds, an environment
256   // variable is required to enable the sandbox. See
257   // http://code.google.com/p/chromium/wiki/LinuxSUIDSandboxDevelopment
258   struct stat st;
259   if (sandbox_binary.empty() && stat(base::kProcSelfExe, &st) == 0 &&
260       st.st_uid == getuid()) {
261     const char* devel_sandbox_path = GetDevelSandboxPath();
262     if (devel_sandbox_path) {
263       sandbox_binary = base::FilePath(devel_sandbox_path);
264     }
265   }
266 
267   return sandbox_binary;
268 }
269 
PrependWrapper(base::CommandLine * cmd_line)270 void SetuidSandboxClient::PrependWrapper(base::CommandLine* cmd_line) {
271   std::string sandbox_binary(GetSandboxBinaryPath().value());
272   struct stat st;
273   if (sandbox_binary.empty() || stat(sandbox_binary.c_str(), &st) != 0) {
274     LOG(FATAL) << "The SUID sandbox helper binary is missing: "
275                << sandbox_binary << " Aborting now. See "
276                                     "https://code.google.com/p/chromium/wiki/"
277                                     "LinuxSUIDSandboxDevelopment.";
278   }
279 
280   if (access(sandbox_binary.c_str(), X_OK) != 0 || (st.st_uid != 0) ||
281       ((st.st_mode & S_ISUID) == 0) || ((st.st_mode & S_IXOTH)) == 0) {
282     LOG(FATAL) << "The SUID sandbox helper binary was found, but is not "
283                   "configured correctly. Rather than run without sandboxing "
284                   "I'm aborting now. You need to make sure that "
285                << sandbox_binary << " is owned by root and has mode 4755.";
286   }
287 
288   cmd_line->PrependWrapper(sandbox_binary);
289 }
290 
SetupLaunchOptions(base::LaunchOptions * options,base::FileHandleMappingVector * fds_to_remap,base::ScopedFD * dummy_fd)291 void SetuidSandboxClient::SetupLaunchOptions(
292     base::LaunchOptions* options,
293     base::FileHandleMappingVector* fds_to_remap,
294     base::ScopedFD* dummy_fd) {
295   DCHECK(options);
296   DCHECK(fds_to_remap);
297 
298   // Launching a setuid binary requires PR_SET_NO_NEW_PRIVS to not be used.
299   options->allow_new_privs = true;
300   UnsetExpectedEnvironmentVariables(&options->environ);
301 
302   // Set dummy_fd to the reading end of a closed pipe.
303   int pipe_fds[2];
304   PCHECK(0 == pipe(pipe_fds));
305   PCHECK(0 == IGNORE_EINTR(close(pipe_fds[1])));
306   dummy_fd->reset(pipe_fds[0]);
307 
308   // We no longer need a dummy socket for discovering the child's PID,
309   // but the sandbox is still hard-coded to expect a file descriptor at
310   // kZygoteIdFd. Fixing this requires a sandbox API change. :(
311   fds_to_remap->push_back(std::make_pair(dummy_fd->get(), kZygoteIdFd));
312 }
313 
SetupLaunchEnvironment()314 void SetuidSandboxClient::SetupLaunchEnvironment() {
315   SaveSUIDUnsafeEnvironmentVariables(env_);
316   SetSandboxAPIEnvironmentVariable(env_);
317 }
318 
319 }  // namespace sandbox
320