1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
4
5 #include "sandbox/linux/syscall_broker/broker_process.h"
6
7 #include <fcntl.h>
8 #include <signal.h>
9 #include <sys/stat.h>
10 #include <sys/syscall.h>
11 #include <sys/types.h>
12 #include <sys/wait.h>
13 #include <unistd.h>
14
15 #include <algorithm>
16 #include <string>
17 #include <utility>
18 #include <vector>
19
20 #include "base/callback.h"
21 #include "base/logging.h"
22 #include "base/posix/eintr_wrapper.h"
23 #include "base/process/process_metrics.h"
24 #include "build/build_config.h"
25 #include "sandbox/linux/syscall_broker/broker_channel.h"
26 #include "sandbox/linux/syscall_broker/broker_client.h"
27 #include "sandbox/linux/syscall_broker/broker_host.h"
28
29 namespace sandbox {
30
31 namespace syscall_broker {
32
BrokerProcess(int denied_errno,const std::vector<syscall_broker::BrokerFilePermission> & permissions,bool fast_check_in_client,bool quiet_failures_for_tests)33 BrokerProcess::BrokerProcess(
34 int denied_errno,
35 const std::vector<syscall_broker::BrokerFilePermission>& permissions,
36 bool fast_check_in_client,
37 bool quiet_failures_for_tests)
38 : initialized_(false),
39 fast_check_in_client_(fast_check_in_client),
40 quiet_failures_for_tests_(quiet_failures_for_tests),
41 broker_pid_(-1),
42 policy_(denied_errno, permissions) {
43 }
44
~BrokerProcess()45 BrokerProcess::~BrokerProcess() {
46 if (initialized_) {
47 if (broker_client_.get()) {
48 // Closing the socket should be enough to notify the child to die,
49 // unless it has been duplicated.
50 CloseChannel();
51 }
52 PCHECK(0 == kill(broker_pid_, SIGKILL));
53 siginfo_t process_info;
54 // Reap the child.
55 int ret = HANDLE_EINTR(waitid(P_PID, broker_pid_, &process_info, WEXITED));
56 PCHECK(0 == ret);
57 }
58 }
59
Init(const base::Callback<bool (void)> & broker_process_init_callback)60 bool BrokerProcess::Init(
61 const base::Callback<bool(void)>& broker_process_init_callback) {
62 CHECK(!initialized_);
63 BrokerChannel::EndPoint ipc_reader;
64 BrokerChannel::EndPoint ipc_writer;
65 BrokerChannel::CreatePair(&ipc_reader, &ipc_writer);
66
67 #if !defined(THREAD_SANITIZER)
68 DCHECK_EQ(1, base::GetNumberOfThreads(base::GetCurrentProcessHandle()));
69 #endif
70 int child_pid = fork();
71 if (child_pid == -1) {
72 return false;
73 }
74 if (child_pid) {
75 // We are the parent and we have just forked our broker process.
76 ipc_reader.reset();
77 broker_pid_ = child_pid;
78 broker_client_.reset(new BrokerClient(policy_, std::move(ipc_writer),
79 fast_check_in_client_,
80 quiet_failures_for_tests_));
81 initialized_ = true;
82 return true;
83 } else {
84 // We are the broker process. Make sure to close the writer's end so that
85 // we get notified if the client disappears.
86 ipc_writer.reset();
87 CHECK(broker_process_init_callback.Run());
88 BrokerHost broker_host(policy_, std::move(ipc_reader));
89 for (;;) {
90 switch (broker_host.HandleRequest()) {
91 case BrokerHost::RequestStatus::LOST_CLIENT:
92 _exit(1);
93 case BrokerHost::RequestStatus::SUCCESS:
94 case BrokerHost::RequestStatus::FAILURE:
95 continue;
96 }
97 }
98 _exit(1);
99 }
100 NOTREACHED();
101 return false;
102 }
103
CloseChannel()104 void BrokerProcess::CloseChannel() {
105 broker_client_.reset();
106 }
107
Access(const char * pathname,int mode) const108 int BrokerProcess::Access(const char* pathname, int mode) const {
109 RAW_CHECK(initialized_);
110 return broker_client_->Access(pathname, mode);
111 }
112
Open(const char * pathname,int flags) const113 int BrokerProcess::Open(const char* pathname, int flags) const {
114 RAW_CHECK(initialized_);
115 return broker_client_->Open(pathname, flags);
116 }
117
118 } // namespace syscall_broker
119
120 } // namespace sandbox.
121