nacl_process_host.cc revision 5d1f7b1de12d16ceb2c938c56701a3e8bfa558f7
17d4cd473f85ac64c3747c96c277f9e506a0d2246Torne (Richard Coles)// Copyright (c) 2012 The Chromium Authors. All rights reserved. 27d4cd473f85ac64c3747c96c277f9e506a0d2246Torne (Richard Coles)// Use of this source code is governed by a BSD-style license that can be 37d4cd473f85ac64c3747c96c277f9e506a0d2246Torne (Richard Coles)// found in the LICENSE file. 47d4cd473f85ac64c3747c96c277f9e506a0d2246Torne (Richard Coles) 57d4cd473f85ac64c3747c96c277f9e506a0d2246Torne (Richard Coles)#include "components/nacl/browser/nacl_process_host.h" 67d4cd473f85ac64c3747c96c277f9e506a0d2246Torne (Richard Coles) 77d4cd473f85ac64c3747c96c277f9e506a0d2246Torne (Richard Coles)#include <algorithm> 87d4cd473f85ac64c3747c96c277f9e506a0d2246Torne (Richard Coles)#include <string> 9a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles)#include <vector> 107d4cd473f85ac64c3747c96c277f9e506a0d2246Torne (Richard Coles) 117d4cd473f85ac64c3747c96c277f9e506a0d2246Torne (Richard Coles)#include "base/base_switches.h" 127d4cd473f85ac64c3747c96c277f9e506a0d2246Torne (Richard Coles)#include "base/bind.h" 137d4cd473f85ac64c3747c96c277f9e506a0d2246Torne (Richard Coles)#include "base/command_line.h" 147d4cd473f85ac64c3747c96c277f9e506a0d2246Torne (Richard Coles)#include "base/file_util.h" 157d4cd473f85ac64c3747c96c277f9e506a0d2246Torne (Richard Coles)#include "base/message_loop/message_loop.h" 167d4cd473f85ac64c3747c96c277f9e506a0d2246Torne (Richard Coles)#include "base/metrics/histogram.h" 177d4cd473f85ac64c3747c96c277f9e506a0d2246Torne (Richard Coles)#include "base/path_service.h" 187d4cd473f85ac64c3747c96c277f9e506a0d2246Torne (Richard Coles)#include "base/process/launch.h" 197d4cd473f85ac64c3747c96c277f9e506a0d2246Torne (Richard Coles)#include "base/process/process_iterator.h" 207d4cd473f85ac64c3747c96c277f9e506a0d2246Torne (Richard Coles)#include "base/rand_util.h" 217d4cd473f85ac64c3747c96c277f9e506a0d2246Torne (Richard Coles)#include "base/strings/string_number_conversions.h" 227d4cd473f85ac64c3747c96c277f9e506a0d2246Torne (Richard Coles)#include "base/strings/string_split.h" 237d4cd473f85ac64c3747c96c277f9e506a0d2246Torne (Richard Coles)#include "base/strings/string_util.h" 247d4cd473f85ac64c3747c96c277f9e506a0d2246Torne (Richard Coles)#include "base/strings/stringprintf.h" 257d4cd473f85ac64c3747c96c277f9e506a0d2246Torne (Richard Coles)#include "base/strings/utf_string_conversions.h" 267d4cd473f85ac64c3747c96c277f9e506a0d2246Torne (Richard Coles)#include "base/threading/sequenced_worker_pool.h" 277d4cd473f85ac64c3747c96c277f9e506a0d2246Torne (Richard Coles)#include "base/win/windows_version.h" 287d4cd473f85ac64c3747c96c277f9e506a0d2246Torne (Richard Coles)#include "build/build_config.h" 297d4cd473f85ac64c3747c96c277f9e506a0d2246Torne (Richard Coles)#include "components/nacl/browser/nacl_browser.h" 307d4cd473f85ac64c3747c96c277f9e506a0d2246Torne (Richard Coles)#include "components/nacl/browser/nacl_host_message_filter.h" 317d4cd473f85ac64c3747c96c277f9e506a0d2246Torne (Richard Coles)#include "components/nacl/common/nacl_cmd_line.h" 327d4cd473f85ac64c3747c96c277f9e506a0d2246Torne (Richard Coles)#include "components/nacl/common/nacl_host_messages.h" 33a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles)#include "components/nacl/common/nacl_messages.h" 347d4cd473f85ac64c3747c96c277f9e506a0d2246Torne (Richard Coles)#include "components/nacl/common/nacl_process_type.h" 357d4cd473f85ac64c3747c96c277f9e506a0d2246Torne (Richard Coles)#include "components/nacl/common/nacl_switches.h" 367d4cd473f85ac64c3747c96c277f9e506a0d2246Torne (Richard Coles)#include "content/public/browser/browser_child_process_host.h" 377d4cd473f85ac64c3747c96c277f9e506a0d2246Torne (Richard Coles)#include "content/public/browser/browser_ppapi_host.h" 387d4cd473f85ac64c3747c96c277f9e506a0d2246Torne (Richard Coles)#include "content/public/browser/child_process_data.h" 397d4cd473f85ac64c3747c96c277f9e506a0d2246Torne (Richard Coles)#include "content/public/browser/plugin_service.h" 407d4cd473f85ac64c3747c96c277f9e506a0d2246Torne (Richard Coles)#include "content/public/common/child_process_host.h" 417d4cd473f85ac64c3747c96c277f9e506a0d2246Torne (Richard Coles)#include "content/public/common/content_switches.h" 427d4cd473f85ac64c3747c96c277f9e506a0d2246Torne (Richard Coles)#include "content/public/common/process_type.h" 43#include "ipc/ipc_channel.h" 44#include "ipc/ipc_switches.h" 45#include "native_client/src/shared/imc/nacl_imc_c.h" 46#include "net/base/net_util.h" 47#include "net/socket/tcp_listen_socket.h" 48#include "ppapi/host/host_factory.h" 49#include "ppapi/host/ppapi_host.h" 50#include "ppapi/proxy/ppapi_messages.h" 51#include "ppapi/shared_impl/ppapi_nacl_plugin_args.h" 52#include "ppapi/shared_impl/ppapi_switches.h" 53 54#if defined(OS_POSIX) 55#include <fcntl.h> 56 57#include "ipc/ipc_channel_posix.h" 58#elif defined(OS_WIN) 59#include <windows.h> 60 61#include "base/threading/thread.h" 62#include "base/win/scoped_handle.h" 63#include "components/nacl/browser/nacl_broker_service_win.h" 64#include "components/nacl/common/nacl_debug_exception_handler_win.h" 65#include "content/public/common/sandbox_init.h" 66#include "content/public/common/sandboxed_process_launcher_delegate.h" 67#endif 68 69using content::BrowserThread; 70using content::ChildProcessData; 71using content::ChildProcessHost; 72using ppapi::proxy::SerializedHandle; 73 74#if defined(OS_WIN) 75 76namespace { 77 78// Looks for the largest contiguous unallocated region of address 79// space and returns it via |*out_addr| and |*out_size|. 80void FindAddressSpace(base::ProcessHandle process, 81 char** out_addr, size_t* out_size) { 82 *out_addr = NULL; 83 *out_size = 0; 84 char* addr = 0; 85 while (true) { 86 MEMORY_BASIC_INFORMATION info; 87 size_t result = VirtualQueryEx(process, static_cast<void*>(addr), 88 &info, sizeof(info)); 89 if (result < sizeof(info)) 90 break; 91 if (info.State == MEM_FREE && info.RegionSize > *out_size) { 92 *out_addr = addr; 93 *out_size = info.RegionSize; 94 } 95 addr += info.RegionSize; 96 } 97} 98 99} // namespace 100 101namespace nacl { 102 103// Allocates |size| bytes of address space in the given process at a 104// randomised address. 105void* AllocateAddressSpaceASLR(base::ProcessHandle process, size_t size) { 106 char* addr; 107 size_t avail_size; 108 FindAddressSpace(process, &addr, &avail_size); 109 if (avail_size < size) 110 return NULL; 111 size_t offset = base::RandGenerator(avail_size - size); 112 const int kPageSize = 0x10000; 113 void* request_addr = 114 reinterpret_cast<void*>(reinterpret_cast<uint64>(addr + offset) 115 & ~(kPageSize - 1)); 116 return VirtualAllocEx(process, request_addr, size, 117 MEM_RESERVE, PAGE_NOACCESS); 118} 119 120} // namespace nacl 121 122#endif // defined(OS_WIN) 123 124namespace { 125 126#if defined(OS_WIN) 127bool RunningOnWOW64() { 128 return (base::win::OSInfo::GetInstance()->wow64_status() == 129 base::win::OSInfo::WOW64_ENABLED); 130} 131 132// NOTE: changes to this class need to be reviewed by the security team. 133class NaClSandboxedProcessLauncherDelegate 134 : public content::SandboxedProcessLauncherDelegate { 135 public: 136 NaClSandboxedProcessLauncherDelegate() {} 137 virtual ~NaClSandboxedProcessLauncherDelegate() {} 138 139 virtual void PostSpawnTarget(base::ProcessHandle process) { 140 // For Native Client sel_ldr processes on 32-bit Windows, reserve 1 GB of 141 // address space to prevent later failure due to address space fragmentation 142 // from .dll loading. The NaCl process will attempt to locate this space by 143 // scanning the address space using VirtualQuery. 144 // TODO(bbudge) Handle the --no-sandbox case. 145 // http://code.google.com/p/nativeclient/issues/detail?id=2131 146 const SIZE_T kNaClSandboxSize = 1 << 30; 147 if (!nacl::AllocateAddressSpaceASLR(process, kNaClSandboxSize)) { 148 DLOG(WARNING) << "Failed to reserve address space for Native Client"; 149 } 150 } 151}; 152 153#endif // OS_WIN 154 155void SetCloseOnExec(NaClHandle fd) { 156#if defined(OS_POSIX) 157 int flags = fcntl(fd, F_GETFD); 158 CHECK_NE(flags, -1); 159 int rc = fcntl(fd, F_SETFD, flags | FD_CLOEXEC); 160 CHECK_EQ(rc, 0); 161#endif 162} 163 164bool ShareHandleToSelLdr( 165 base::ProcessHandle processh, 166 NaClHandle sourceh, 167 bool close_source, 168 std::vector<nacl::FileDescriptor> *handles_for_sel_ldr) { 169#if defined(OS_WIN) 170 HANDLE channel; 171 int flags = DUPLICATE_SAME_ACCESS; 172 if (close_source) 173 flags |= DUPLICATE_CLOSE_SOURCE; 174 if (!DuplicateHandle(GetCurrentProcess(), 175 reinterpret_cast<HANDLE>(sourceh), 176 processh, 177 &channel, 178 0, // Unused given DUPLICATE_SAME_ACCESS. 179 FALSE, 180 flags)) { 181 LOG(ERROR) << "DuplicateHandle() failed"; 182 return false; 183 } 184 handles_for_sel_ldr->push_back( 185 reinterpret_cast<nacl::FileDescriptor>(channel)); 186#else 187 nacl::FileDescriptor channel; 188 channel.fd = sourceh; 189 channel.auto_close = close_source; 190 handles_for_sel_ldr->push_back(channel); 191#endif 192 return true; 193} 194 195ppapi::PpapiPermissions GetNaClPermissions(uint32 permission_bits) { 196 // Only allow NaCl plugins to request certain permissions. We don't want 197 // a compromised renderer to be able to start a nacl plugin with e.g. Flash 198 // permissions which may expand the surface area of the sandbox. 199 uint32 masked_bits = permission_bits & ppapi::PERMISSION_DEV; 200 if (content::PluginService::GetInstance()->PpapiDevChannelSupported()) 201 masked_bits |= ppapi::PERMISSION_DEV_CHANNEL; 202 return ppapi::PpapiPermissions::GetForCommandLine(masked_bits); 203} 204 205} // namespace 206 207namespace nacl { 208 209struct NaClProcessHost::NaClInternal { 210 NaClHandle socket_for_renderer; 211 NaClHandle socket_for_sel_ldr; 212 213 NaClInternal() 214 : socket_for_renderer(NACL_INVALID_HANDLE), 215 socket_for_sel_ldr(NACL_INVALID_HANDLE) { } 216}; 217 218// ----------------------------------------------------------------------------- 219 220NaClProcessHost::NaClProcessHost(const GURL& manifest_url, 221 int render_view_id, 222 uint32 permission_bits, 223 bool uses_irt, 224 bool enable_dyncode_syscalls, 225 bool enable_exception_handling, 226 bool enable_crash_throttling, 227 bool off_the_record, 228 const base::FilePath& profile_directory) 229 : manifest_url_(manifest_url), 230 permissions_(GetNaClPermissions(permission_bits)), 231#if defined(OS_WIN) 232 process_launched_by_broker_(false), 233#endif 234 reply_msg_(NULL), 235#if defined(OS_WIN) 236 debug_exception_handler_requested_(false), 237#endif 238 internal_(new NaClInternal()), 239 weak_factory_(this), 240 uses_irt_(uses_irt), 241 enable_debug_stub_(false), 242 enable_dyncode_syscalls_(enable_dyncode_syscalls), 243 enable_exception_handling_(enable_exception_handling), 244 enable_crash_throttling_(enable_crash_throttling), 245 off_the_record_(off_the_record), 246 profile_directory_(profile_directory), 247 render_view_id_(render_view_id) { 248 process_.reset(content::BrowserChildProcessHost::Create( 249 PROCESS_TYPE_NACL_LOADER, this)); 250 251 // Set the display name so the user knows what plugin the process is running. 252 // We aren't on the UI thread so getting the pref locale for language 253 // formatting isn't possible, so IDN will be lost, but this is probably OK 254 // for this use case. 255 process_->SetName(net::FormatUrl(manifest_url_, std::string())); 256 257 enable_debug_stub_ = CommandLine::ForCurrentProcess()->HasSwitch( 258 switches::kEnableNaClDebug); 259} 260 261NaClProcessHost::~NaClProcessHost() { 262 // Report exit status only if the process was successfully started. 263 if (process_->GetData().handle != base::kNullProcessHandle) { 264 int exit_code = 0; 265 process_->GetTerminationStatus(false /* known_dead */, &exit_code); 266 std::string message = 267 base::StringPrintf("NaCl process exited with status %i (0x%x)", 268 exit_code, exit_code); 269 if (exit_code == 0) { 270 VLOG(1) << message; 271 } else { 272 LOG(ERROR) << message; 273 } 274 } 275 276 if (internal_->socket_for_renderer != NACL_INVALID_HANDLE) { 277 if (NaClClose(internal_->socket_for_renderer) != 0) { 278 NOTREACHED() << "NaClClose() failed"; 279 } 280 } 281 282 if (internal_->socket_for_sel_ldr != NACL_INVALID_HANDLE) { 283 if (NaClClose(internal_->socket_for_sel_ldr) != 0) { 284 NOTREACHED() << "NaClClose() failed"; 285 } 286 } 287 288 if (reply_msg_) { 289 // The process failed to launch for some reason. 290 // Don't keep the renderer hanging. 291 reply_msg_->set_reply_error(); 292 nacl_host_message_filter_->Send(reply_msg_); 293 } 294#if defined(OS_WIN) 295 if (process_launched_by_broker_) { 296 NaClBrokerService::GetInstance()->OnLoaderDied(); 297 } 298#endif 299} 300 301void NaClProcessHost::OnProcessCrashed(int exit_status) { 302 if (enable_crash_throttling_ && 303 !CommandLine::ForCurrentProcess()->HasSwitch( 304 switches::kDisablePnaclCrashThrottling)) { 305 NaClBrowser::GetInstance()->OnProcessCrashed(); 306 } 307} 308 309// This is called at browser startup. 310// static 311void NaClProcessHost::EarlyStartup() { 312 NaClBrowser::GetInstance()->EarlyStartup(); 313#if defined(OS_LINUX) && !defined(OS_CHROMEOS) 314 // Open the IRT file early to make sure that it isn't replaced out from 315 // under us by autoupdate. 316 NaClBrowser::GetInstance()->EnsureIrtAvailable(); 317#endif 318 CommandLine* cmd = CommandLine::ForCurrentProcess(); 319 UMA_HISTOGRAM_BOOLEAN( 320 "NaCl.nacl-gdb", 321 !cmd->GetSwitchValuePath(switches::kNaClGdb).empty()); 322 UMA_HISTOGRAM_BOOLEAN( 323 "NaCl.nacl-gdb-script", 324 !cmd->GetSwitchValuePath(switches::kNaClGdbScript).empty()); 325 UMA_HISTOGRAM_BOOLEAN( 326 "NaCl.enable-nacl-debug", 327 cmd->HasSwitch(switches::kEnableNaClDebug)); 328 NaClBrowser::GetDelegate()->SetDebugPatterns( 329 cmd->GetSwitchValueASCII(switches::kNaClDebugMask)); 330} 331 332void NaClProcessHost::Launch( 333 NaClHostMessageFilter* nacl_host_message_filter, 334 IPC::Message* reply_msg, 335 const base::FilePath& manifest_path) { 336 nacl_host_message_filter_ = nacl_host_message_filter; 337 reply_msg_ = reply_msg; 338 manifest_path_ = manifest_path; 339 340 // Do not launch the requested NaCl module if NaCl is marked "unstable" due 341 // to too many crashes within a given time period. 342 if (enable_crash_throttling_ && 343 !CommandLine::ForCurrentProcess()->HasSwitch( 344 switches::kDisablePnaclCrashThrottling) && 345 NaClBrowser::GetInstance()->IsThrottled()) { 346 SendErrorToRenderer("Process creation was throttled due to excessive" 347 " crashes"); 348 delete this; 349 return; 350 } 351 352 const CommandLine* cmd = CommandLine::ForCurrentProcess(); 353#if defined(OS_WIN) 354 if (cmd->HasSwitch(switches::kEnableNaClDebug) && 355 !cmd->HasSwitch(switches::kNoSandbox)) { 356 // We don't switch off sandbox automatically for security reasons. 357 SendErrorToRenderer("NaCl's GDB debug stub requires --no-sandbox flag" 358 " on Windows. See crbug.com/265624."); 359 delete this; 360 return; 361 } 362#endif 363 if (cmd->HasSwitch(switches::kNaClGdb) && 364 !cmd->HasSwitch(switches::kEnableNaClDebug)) { 365 LOG(WARNING) << "--nacl-gdb flag requires --enable-nacl-debug flag"; 366 } 367 368 // Start getting the IRT open asynchronously while we launch the NaCl process. 369 // We'll make sure this actually finished in StartWithLaunchedProcess, below. 370 NaClBrowser* nacl_browser = NaClBrowser::GetInstance(); 371 nacl_browser->EnsureAllResourcesAvailable(); 372 if (!nacl_browser->IsOk()) { 373 SendErrorToRenderer("could not find all the resources needed" 374 " to launch the process"); 375 delete this; 376 return; 377 } 378 379 // Rather than creating a socket pair in the renderer, and passing 380 // one side through the browser to sel_ldr, socket pairs are created 381 // in the browser and then passed to the renderer and sel_ldr. 382 // 383 // This is mainly for the benefit of Windows, where sockets cannot 384 // be passed in messages, but are copied via DuplicateHandle(). 385 // This means the sandboxed renderer cannot send handles to the 386 // browser process. 387 388 NaClHandle pair[2]; 389 // Create a connected socket 390 if (NaClSocketPair(pair) == -1) { 391 SendErrorToRenderer("NaClSocketPair() failed"); 392 delete this; 393 return; 394 } 395 internal_->socket_for_renderer = pair[0]; 396 internal_->socket_for_sel_ldr = pair[1]; 397 SetCloseOnExec(pair[0]); 398 SetCloseOnExec(pair[1]); 399 400 // Launch the process 401 if (!LaunchSelLdr()) { 402 delete this; 403 } 404} 405 406void NaClProcessHost::OnChannelConnected(int32 peer_pid) { 407 if (!CommandLine::ForCurrentProcess()->GetSwitchValuePath( 408 switches::kNaClGdb).empty()) { 409 LaunchNaClGdb(); 410 } 411} 412 413#if defined(OS_WIN) 414void NaClProcessHost::OnProcessLaunchedByBroker(base::ProcessHandle handle) { 415 process_launched_by_broker_ = true; 416 process_->SetHandle(handle); 417 if (!StartWithLaunchedProcess()) 418 delete this; 419} 420 421void NaClProcessHost::OnDebugExceptionHandlerLaunchedByBroker(bool success) { 422 IPC::Message* reply = attach_debug_exception_handler_reply_msg_.release(); 423 NaClProcessMsg_AttachDebugExceptionHandler::WriteReplyParams(reply, success); 424 Send(reply); 425} 426#endif 427 428// Needed to handle sync messages in OnMessageRecieved. 429bool NaClProcessHost::Send(IPC::Message* msg) { 430 return process_->Send(msg); 431} 432 433bool NaClProcessHost::LaunchNaClGdb() { 434#if defined(OS_WIN) 435 base::FilePath nacl_gdb = 436 CommandLine::ForCurrentProcess()->GetSwitchValuePath(switches::kNaClGdb); 437 CommandLine cmd_line(nacl_gdb); 438#else 439 CommandLine::StringType nacl_gdb = 440 CommandLine::ForCurrentProcess()->GetSwitchValueNative( 441 switches::kNaClGdb); 442 CommandLine::StringVector argv; 443 // We don't support spaces inside arguments in --nacl-gdb switch. 444 base::SplitString(nacl_gdb, static_cast<CommandLine::CharType>(' '), &argv); 445 CommandLine cmd_line(argv); 446#endif 447 cmd_line.AppendArg("--eval-command"); 448 base::FilePath::StringType irt_path( 449 NaClBrowser::GetInstance()->GetIrtFilePath().value()); 450 // Avoid back slashes because nacl-gdb uses posix escaping rules on Windows. 451 // See issue https://code.google.com/p/nativeclient/issues/detail?id=3482. 452 std::replace(irt_path.begin(), irt_path.end(), '\\', '/'); 453 cmd_line.AppendArgNative(FILE_PATH_LITERAL("nacl-irt \"") + irt_path + 454 FILE_PATH_LITERAL("\"")); 455 if (!manifest_path_.empty()) { 456 cmd_line.AppendArg("--eval-command"); 457 base::FilePath::StringType manifest_path_value(manifest_path_.value()); 458 std::replace(manifest_path_value.begin(), manifest_path_value.end(), 459 '\\', '/'); 460 cmd_line.AppendArgNative(FILE_PATH_LITERAL("nacl-manifest \"") + 461 manifest_path_value + FILE_PATH_LITERAL("\"")); 462 } 463 cmd_line.AppendArg("--eval-command"); 464 cmd_line.AppendArg("target remote :4014"); 465 base::FilePath script = CommandLine::ForCurrentProcess()->GetSwitchValuePath( 466 switches::kNaClGdbScript); 467 if (!script.empty()) { 468 cmd_line.AppendArg("--command"); 469 cmd_line.AppendArgNative(script.value()); 470 } 471 return base::LaunchProcess(cmd_line, base::LaunchOptions(), NULL); 472} 473 474bool NaClProcessHost::LaunchSelLdr() { 475 std::string channel_id = process_->GetHost()->CreateChannel(); 476 if (channel_id.empty()) { 477 SendErrorToRenderer("CreateChannel() failed"); 478 return false; 479 } 480 481 CommandLine::StringType nacl_loader_prefix; 482#if defined(OS_POSIX) 483 nacl_loader_prefix = CommandLine::ForCurrentProcess()->GetSwitchValueNative( 484 switches::kNaClLoaderCmdPrefix); 485#endif // defined(OS_POSIX) 486 487 // Build command line for nacl. 488 489#if defined(OS_MACOSX) 490 // The Native Client process needs to be able to allocate a 1GB contiguous 491 // region to use as the client environment's virtual address space. ASLR 492 // (PIE) interferes with this by making it possible that no gap large enough 493 // to accomodate this request will exist in the child process' address 494 // space. Disable PIE for NaCl processes. See http://crbug.com/90221 and 495 // http://code.google.com/p/nativeclient/issues/detail?id=2043. 496 int flags = ChildProcessHost::CHILD_NO_PIE; 497#elif defined(OS_LINUX) 498 int flags = nacl_loader_prefix.empty() ? ChildProcessHost::CHILD_ALLOW_SELF : 499 ChildProcessHost::CHILD_NORMAL; 500#else 501 int flags = ChildProcessHost::CHILD_NORMAL; 502#endif 503 504 base::FilePath exe_path = ChildProcessHost::GetChildPath(flags); 505 if (exe_path.empty()) 506 return false; 507 508#if defined(OS_WIN) 509 // On Windows 64-bit NaCl loader is called nacl64.exe instead of chrome.exe 510 if (RunningOnWOW64()) { 511 if (!NaClBrowser::GetInstance()->GetNaCl64ExePath(&exe_path)) { 512 SendErrorToRenderer("could not get path to nacl64.exe"); 513 return false; 514 } 515 } 516#endif 517 518 scoped_ptr<CommandLine> cmd_line(new CommandLine(exe_path)); 519 CopyNaClCommandLineArguments(cmd_line.get()); 520 521 cmd_line->AppendSwitchASCII(switches::kProcessType, 522 switches::kNaClLoaderProcess); 523 cmd_line->AppendSwitchASCII(switches::kProcessChannelID, channel_id); 524 if (NaClBrowser::GetDelegate()->DialogsAreSuppressed()) 525 cmd_line->AppendSwitch(switches::kNoErrorDialogs); 526 527 if (!nacl_loader_prefix.empty()) 528 cmd_line->PrependWrapper(nacl_loader_prefix); 529 530 // On Windows we might need to start the broker process to launch a new loader 531#if defined(OS_WIN) 532 if (RunningOnWOW64()) { 533 if (!NaClBrokerService::GetInstance()->LaunchLoader( 534 weak_factory_.GetWeakPtr(), channel_id)) { 535 SendErrorToRenderer("broker service did not launch process"); 536 return false; 537 } 538 } else { 539 process_->Launch(new NaClSandboxedProcessLauncherDelegate, 540 false, 541 cmd_line.release()); 542 } 543#elif defined(OS_POSIX) 544 process_->Launch(nacl_loader_prefix.empty(), // use_zygote 545 base::EnvironmentMap(), 546 cmd_line.release()); 547#endif 548 549 return true; 550} 551 552bool NaClProcessHost::OnMessageReceived(const IPC::Message& msg) { 553 bool handled = true; 554 IPC_BEGIN_MESSAGE_MAP(NaClProcessHost, msg) 555 IPC_MESSAGE_HANDLER(NaClProcessMsg_QueryKnownToValidate, 556 OnQueryKnownToValidate) 557 IPC_MESSAGE_HANDLER(NaClProcessMsg_SetKnownToValidate, 558 OnSetKnownToValidate) 559 IPC_MESSAGE_HANDLER_DELAY_REPLY(NaClProcessMsg_ResolveFileToken, 560 OnResolveFileToken) 561#if defined(OS_WIN) 562 IPC_MESSAGE_HANDLER_DELAY_REPLY(NaClProcessMsg_AttachDebugExceptionHandler, 563 OnAttachDebugExceptionHandler) 564#endif 565 IPC_MESSAGE_HANDLER(NaClProcessHostMsg_PpapiChannelsCreated, 566 OnPpapiChannelsCreated) 567 IPC_MESSAGE_UNHANDLED(handled = false) 568 IPC_END_MESSAGE_MAP() 569 return handled; 570} 571 572void NaClProcessHost::OnProcessLaunched() { 573 if (!StartWithLaunchedProcess()) 574 delete this; 575} 576 577// Called when the NaClBrowser singleton has been fully initialized. 578void NaClProcessHost::OnResourcesReady() { 579 NaClBrowser* nacl_browser = NaClBrowser::GetInstance(); 580 if (!nacl_browser->IsReady()) { 581 SendErrorToRenderer("could not acquire shared resources needed by NaCl"); 582 delete this; 583 } else if (!SendStart()) { 584 delete this; 585 } 586} 587 588bool NaClProcessHost::ReplyToRenderer( 589 const IPC::ChannelHandle& channel_handle) { 590#if defined(OS_WIN) 591 // If we are on 64-bit Windows, the NaCl process's sandbox is 592 // managed by a different process from the renderer's sandbox. We 593 // need to inform the renderer's sandbox about the NaCl process so 594 // that the renderer can send handles to the NaCl process using 595 // BrokerDuplicateHandle(). 596 if (RunningOnWOW64()) { 597 if (!content::BrokerAddTargetPeer(process_->GetData().handle)) { 598 SendErrorToRenderer("BrokerAddTargetPeer() failed"); 599 return false; 600 } 601 } 602#endif 603 604 FileDescriptor handle_for_renderer; 605#if defined(OS_WIN) 606 // Copy the handle into the renderer process. 607 HANDLE handle_in_renderer; 608 if (!DuplicateHandle(base::GetCurrentProcessHandle(), 609 reinterpret_cast<HANDLE>( 610 internal_->socket_for_renderer), 611 nacl_host_message_filter_->PeerHandle(), 612 &handle_in_renderer, 613 0, // Unused given DUPLICATE_SAME_ACCESS. 614 FALSE, 615 DUPLICATE_CLOSE_SOURCE | DUPLICATE_SAME_ACCESS)) { 616 SendErrorToRenderer("DuplicateHandle() failed"); 617 return false; 618 } 619 handle_for_renderer = reinterpret_cast<FileDescriptor>( 620 handle_in_renderer); 621#else 622 // No need to dup the imc_handle - we don't pass it anywhere else so 623 // it cannot be closed. 624 FileDescriptor imc_handle; 625 imc_handle.fd = internal_->socket_for_renderer; 626 imc_handle.auto_close = true; 627 handle_for_renderer = imc_handle; 628#endif 629 630 const ChildProcessData& data = process_->GetData(); 631 SendMessageToRenderer( 632 NaClLaunchResult(handle_for_renderer, 633 channel_handle, 634 base::GetProcId(data.handle), 635 data.id), 636 std::string() /* error_message */); 637 internal_->socket_for_renderer = NACL_INVALID_HANDLE; 638 return true; 639} 640 641void NaClProcessHost::SendErrorToRenderer(const std::string& error_message) { 642 LOG(ERROR) << "NaCl process launch failed: " << error_message; 643 SendMessageToRenderer(NaClLaunchResult(), error_message); 644} 645 646void NaClProcessHost::SendMessageToRenderer( 647 const NaClLaunchResult& result, 648 const std::string& error_message) { 649 DCHECK(nacl_host_message_filter_); 650 DCHECK(reply_msg_); 651 if (nacl_host_message_filter_ != NULL && reply_msg_ != NULL) { 652 NaClHostMsg_LaunchNaCl::WriteReplyParams( 653 reply_msg_, result, error_message); 654 nacl_host_message_filter_->Send(reply_msg_); 655 nacl_host_message_filter_ = NULL; 656 reply_msg_ = NULL; 657 } 658} 659 660// TCP port we chose for NaCl debug stub. It can be any other number. 661static const int kInitialDebugStubPort = 4014; 662 663#if defined(OS_POSIX) 664net::SocketDescriptor NaClProcessHost::GetDebugStubSocketHandle() { 665 NaClBrowser* nacl_browser = NaClBrowser::GetInstance(); 666 net::SocketDescriptor s = net::kInvalidSocket; 667 // We always try to allocate the default port first. If this fails, we then 668 // allocate any available port. 669 // On success, if the test system has register a handler 670 // (GdbDebugStubPortListener), we fire a notification. 671 int port = kInitialDebugStubPort; 672 s = net::TCPListenSocket::CreateAndBind("127.0.0.1", port); 673 if (s == net::kInvalidSocket) { 674 s = net::TCPListenSocket::CreateAndBindAnyPort("127.0.0.1", &port); 675 } 676 if (s != net::kInvalidSocket) { 677 if (nacl_browser->HasGdbDebugStubPortListener()) { 678 nacl_browser->FireGdbDebugStubPortOpened(port); 679 } 680 } 681 // Set debug stub port on the process object. 682 process_->SetNaClDebugStubPort(port); 683 if (s == net::kInvalidSocket) { 684 LOG(ERROR) << "failed to open socket for debug stub"; 685 return net::kInvalidSocket; 686 } else { 687 LOG(WARNING) << "debug stub on port " << port; 688 } 689 if (listen(s, 1)) { 690 LOG(ERROR) << "listen() failed on debug stub socket"; 691 if (IGNORE_EINTR(close(s)) < 0) 692 PLOG(ERROR) << "failed to close debug stub socket"; 693 return net::kInvalidSocket; 694 } 695 return s; 696} 697#endif 698 699bool NaClProcessHost::StartNaClExecution() { 700 NaClBrowser* nacl_browser = NaClBrowser::GetInstance(); 701 702 NaClStartParams params; 703 params.validation_cache_enabled = nacl_browser->ValidationCacheIsEnabled(); 704 params.validation_cache_key = nacl_browser->GetValidationCacheKey(); 705 params.version = NaClBrowser::GetDelegate()->GetVersionString(); 706 params.enable_exception_handling = enable_exception_handling_; 707 params.enable_debug_stub = enable_debug_stub_ && 708 NaClBrowser::GetDelegate()->URLMatchesDebugPatterns(manifest_url_); 709 // Enable PPAPI proxy channel creation only for renderer processes. 710 params.enable_ipc_proxy = enable_ppapi_proxy(); 711 params.uses_irt = uses_irt_; 712 params.enable_dyncode_syscalls = enable_dyncode_syscalls_; 713 params.enable_nonsfi_mode = CommandLine::ForCurrentProcess()->HasSwitch( 714 switches::kEnableNaClNonSfiMode); 715 716 const ChildProcessData& data = process_->GetData(); 717 if (!ShareHandleToSelLdr(data.handle, 718 internal_->socket_for_sel_ldr, true, 719 ¶ms.handles)) { 720 return false; 721 } 722 723 if (params.uses_irt) { 724 base::PlatformFile irt_file = nacl_browser->IrtFile(); 725 CHECK_NE(irt_file, base::kInvalidPlatformFileValue); 726 // Send over the IRT file handle. We don't close our own copy! 727 if (!ShareHandleToSelLdr(data.handle, irt_file, false, ¶ms.handles)) 728 return false; 729 } 730 731#if defined(OS_MACOSX) 732 // For dynamic loading support, NaCl requires a file descriptor that 733 // was created in /tmp, since those created with shm_open() are not 734 // mappable with PROT_EXEC. Rather than requiring an extra IPC 735 // round trip out of the sandbox, we create an FD here. 736 base::SharedMemory memory_buffer; 737 base::SharedMemoryCreateOptions options; 738 options.size = 1; 739 options.executable = true; 740 if (!memory_buffer.Create(options)) { 741 DLOG(ERROR) << "Failed to allocate memory buffer"; 742 return false; 743 } 744 FileDescriptor memory_fd; 745 memory_fd.fd = dup(memory_buffer.handle().fd); 746 if (memory_fd.fd < 0) { 747 DLOG(ERROR) << "Failed to dup() a file descriptor"; 748 return false; 749 } 750 memory_fd.auto_close = true; 751 params.handles.push_back(memory_fd); 752#endif 753 754#if defined(OS_POSIX) 755 if (params.enable_debug_stub) { 756 net::SocketDescriptor server_bound_socket = GetDebugStubSocketHandle(); 757 if (server_bound_socket != net::kInvalidSocket) { 758 params.debug_stub_server_bound_socket = 759 FileDescriptor(server_bound_socket, true); 760 } 761 } 762#endif 763 764 process_->Send(new NaClProcessMsg_Start(params)); 765 766 internal_->socket_for_sel_ldr = NACL_INVALID_HANDLE; 767 return true; 768} 769 770bool NaClProcessHost::SendStart() { 771 if (!enable_ppapi_proxy()) { 772 if (!ReplyToRenderer(IPC::ChannelHandle())) 773 return false; 774 } 775 return StartNaClExecution(); 776} 777 778// This method is called when NaClProcessHostMsg_PpapiChannelCreated is 779// received. 780void NaClProcessHost::OnPpapiChannelsCreated( 781 const IPC::ChannelHandle& browser_channel_handle, 782 const IPC::ChannelHandle& renderer_channel_handle) { 783 // Only renderer processes should create a channel. 784 DCHECK(enable_ppapi_proxy()); 785 if (!ipc_proxy_channel_.get()) { 786 DCHECK_EQ(PROCESS_TYPE_NACL_LOADER, process_->GetData().process_type); 787 788 ipc_proxy_channel_.reset( 789 new IPC::ChannelProxy(browser_channel_handle, 790 IPC::Channel::MODE_CLIENT, 791 NULL, 792 base::MessageLoopProxy::current().get())); 793 // Create the browser ppapi host and enable PPAPI message dispatching to the 794 // browser process. 795 ppapi_host_.reset(content::BrowserPpapiHost::CreateExternalPluginProcess( 796 ipc_proxy_channel_.get(), // sender 797 permissions_, 798 process_->GetData().handle, 799 ipc_proxy_channel_.get(), 800 nacl_host_message_filter_->render_process_id(), 801 render_view_id_, 802 profile_directory_)); 803 ppapi_host_->SetOnKeepaliveCallback( 804 NaClBrowser::GetDelegate()->GetOnKeepaliveCallback()); 805 806 ppapi::PpapiNaClPluginArgs args; 807 args.off_the_record = nacl_host_message_filter_->off_the_record(); 808 args.permissions = permissions_; 809 CommandLine* cmdline = CommandLine::ForCurrentProcess(); 810 DCHECK(cmdline); 811 std::string flag_whitelist[] = { 812 switches::kPpapiKeepAliveThrottle, 813 switches::kV, 814 switches::kVModule, 815 }; 816 for (size_t i = 0; i < arraysize(flag_whitelist); ++i) { 817 std::string value = cmdline->GetSwitchValueASCII(flag_whitelist[i]); 818 if (!value.empty()) { 819 args.switch_names.push_back(flag_whitelist[i]); 820 args.switch_values.push_back(value); 821 } 822 } 823 824 ppapi_host_->GetPpapiHost()->AddHostFactoryFilter( 825 scoped_ptr<ppapi::host::HostFactory>( 826 NaClBrowser::GetDelegate()->CreatePpapiHostFactory( 827 ppapi_host_.get()))); 828 829 // Send a message to initialize the IPC dispatchers in the NaCl plugin. 830 ipc_proxy_channel_->Send(new PpapiMsg_InitializeNaClDispatcher(args)); 831 832 // Let the renderer know that the IPC channels are established. 833 ReplyToRenderer(renderer_channel_handle); 834 } else { 835 // Attempt to open more than 1 browser channel is not supported. 836 // Shut down the NaCl process. 837 process_->GetHost()->ForceShutdown(); 838 } 839} 840 841bool NaClProcessHost::StartWithLaunchedProcess() { 842 NaClBrowser* nacl_browser = NaClBrowser::GetInstance(); 843 844 if (nacl_browser->IsReady()) { 845 return SendStart(); 846 } else if (nacl_browser->IsOk()) { 847 nacl_browser->WaitForResources( 848 base::Bind(&NaClProcessHost::OnResourcesReady, 849 weak_factory_.GetWeakPtr())); 850 return true; 851 } else { 852 SendErrorToRenderer("previously failed to acquire shared resources"); 853 return false; 854 } 855} 856 857void NaClProcessHost::OnQueryKnownToValidate(const std::string& signature, 858 bool* result) { 859 NaClBrowser* nacl_browser = NaClBrowser::GetInstance(); 860 *result = nacl_browser->QueryKnownToValidate(signature, off_the_record_); 861} 862 863void NaClProcessHost::OnSetKnownToValidate(const std::string& signature) { 864 NaClBrowser::GetInstance()->SetKnownToValidate( 865 signature, off_the_record_); 866} 867 868void NaClProcessHost::FileResolved( 869 const base::FilePath& file_path, 870 IPC::Message* reply_msg, 871 const base::PlatformFile& file) { 872 if (file != base::kInvalidPlatformFileValue) { 873 IPC::PlatformFileForTransit handle = IPC::GetFileHandleForProcess( 874 file, 875 process_->GetData().handle, 876 true /* close_source */); 877 NaClProcessMsg_ResolveFileToken::WriteReplyParams( 878 reply_msg, 879 handle, 880 file_path); 881 } else { 882 NaClProcessMsg_ResolveFileToken::WriteReplyParams( 883 reply_msg, 884 IPC::InvalidPlatformFileForTransit(), 885 base::FilePath()); 886 } 887 Send(reply_msg); 888} 889 890void NaClProcessHost::OnResolveFileToken(uint64 file_token_lo, 891 uint64 file_token_hi, 892 IPC::Message* reply_msg) { 893 // Was the file registered? 894 // 895 // Note that the file path cache is of bounded size, and old entries can get 896 // evicted. If a large number of NaCl modules are being launched at once, 897 // resolving the file_token may fail because the path cache was thrashed 898 // while the file_token was in flight. In this case the query fails, and we 899 // need to fall back to the slower path. 900 // 901 // However: each NaCl process will consume 2-3 entries as it starts up, this 902 // means that eviction will not happen unless you start up 33+ NaCl processes 903 // at the same time, and this still requires worst-case timing. As a 904 // practical matter, no entries should be evicted prematurely. 905 // The cache itself should take ~ (150 characters * 2 bytes/char + ~60 bytes 906 // data structure overhead) * 100 = 35k when full, so making it bigger should 907 // not be a problem, if needed. 908 // 909 // Each NaCl process will consume 2-3 entries because the manifest and main 910 // nexe are currently not resolved. Shared libraries will be resolved. They 911 // will be loaded sequentially, so they will only consume a single entry 912 // while the load is in flight. 913 // 914 // TODO(ncbray): track behavior with UMA. If entries are getting evicted or 915 // bogus keys are getting queried, this would be good to know. 916 base::FilePath file_path; 917 if (!NaClBrowser::GetInstance()->GetFilePath( 918 file_token_lo, file_token_hi, &file_path)) { 919 NaClProcessMsg_ResolveFileToken::WriteReplyParams( 920 reply_msg, 921 IPC::InvalidPlatformFileForTransit(), 922 base::FilePath()); 923 Send(reply_msg); 924 return; 925 } 926 927 // Open the file. 928 if (!base::PostTaskAndReplyWithResult( 929 content::BrowserThread::GetBlockingPool(), 930 FROM_HERE, 931 base::Bind(OpenNaClExecutableImpl, file_path), 932 base::Bind(&NaClProcessHost::FileResolved, 933 weak_factory_.GetWeakPtr(), 934 file_path, 935 reply_msg))) { 936 NaClProcessMsg_ResolveFileToken::WriteReplyParams( 937 reply_msg, 938 IPC::InvalidPlatformFileForTransit(), 939 base::FilePath()); 940 Send(reply_msg); 941 } 942} 943 944#if defined(OS_WIN) 945void NaClProcessHost::OnAttachDebugExceptionHandler(const std::string& info, 946 IPC::Message* reply_msg) { 947 if (!AttachDebugExceptionHandler(info, reply_msg)) { 948 // Send failure message. 949 NaClProcessMsg_AttachDebugExceptionHandler::WriteReplyParams(reply_msg, 950 false); 951 Send(reply_msg); 952 } 953} 954 955bool NaClProcessHost::AttachDebugExceptionHandler(const std::string& info, 956 IPC::Message* reply_msg) { 957 if (!enable_exception_handling_ && !enable_debug_stub_) { 958 DLOG(ERROR) << 959 "Debug exception handler requested by NaCl process when not enabled"; 960 return false; 961 } 962 if (debug_exception_handler_requested_) { 963 // The NaCl process should not request this multiple times. 964 DLOG(ERROR) << "Multiple AttachDebugExceptionHandler requests received"; 965 return false; 966 } 967 debug_exception_handler_requested_ = true; 968 969 base::ProcessId nacl_pid = base::GetProcId(process_->GetData().handle); 970 base::ProcessHandle temp_handle; 971 // We cannot use process_->GetData().handle because it does not have 972 // the necessary access rights. We open the new handle here rather 973 // than in the NaCl broker process in case the NaCl loader process 974 // dies before the NaCl broker process receives the message we send. 975 // The debug exception handler uses DebugActiveProcess() to attach, 976 // but this takes a PID. We need to prevent the NaCl loader's PID 977 // from being reused before DebugActiveProcess() is called, and 978 // holding a process handle open achieves this. 979 if (!base::OpenProcessHandleWithAccess( 980 nacl_pid, 981 base::kProcessAccessQueryInformation | 982 base::kProcessAccessSuspendResume | 983 base::kProcessAccessTerminate | 984 base::kProcessAccessVMOperation | 985 base::kProcessAccessVMRead | 986 base::kProcessAccessVMWrite | 987 base::kProcessAccessDuplicateHandle | 988 base::kProcessAccessWaitForTermination, 989 &temp_handle)) { 990 LOG(ERROR) << "Failed to get process handle"; 991 return false; 992 } 993 base::win::ScopedHandle process_handle(temp_handle); 994 995 attach_debug_exception_handler_reply_msg_.reset(reply_msg); 996 // If the NaCl loader is 64-bit, the process running its debug 997 // exception handler must be 64-bit too, so we use the 64-bit NaCl 998 // broker process for this. Otherwise, on a 32-bit system, we use 999 // the 32-bit browser process to run the debug exception handler. 1000 if (RunningOnWOW64()) { 1001 return NaClBrokerService::GetInstance()->LaunchDebugExceptionHandler( 1002 weak_factory_.GetWeakPtr(), nacl_pid, process_handle, info); 1003 } else { 1004 NaClStartDebugExceptionHandlerThread( 1005 process_handle.Take(), info, 1006 base::MessageLoopProxy::current(), 1007 base::Bind(&NaClProcessHost::OnDebugExceptionHandlerLaunchedByBroker, 1008 weak_factory_.GetWeakPtr())); 1009 return true; 1010 } 1011} 1012#endif 1013 1014} // namespace nacl 1015