10f1bc08d4cfcc34181b0b5cbf065c40f687bf740Torne (Richard Coles)// Copyright (c) 2013 The Chromium Authors. All rights reserved. 20f1bc08d4cfcc34181b0b5cbf065c40f687bf740Torne (Richard Coles)// Use of this source code is governed by a BSD-style license that can be 30f1bc08d4cfcc34181b0b5cbf065c40f687bf740Torne (Richard Coles)// found in the LICENSE file. 40f1bc08d4cfcc34181b0b5cbf065c40f687bf740Torne (Richard Coles) 50f1bc08d4cfcc34181b0b5cbf065c40f687bf740Torne (Richard Coles)#include "sandbox/linux/services/credentials.h" 60f1bc08d4cfcc34181b0b5cbf065c40f687bf740Torne (Richard Coles) 7f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)#include <dirent.h> 8f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)#include <errno.h> 9f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)#include <fcntl.h> 10a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles)#include <signal.h> 110f1bc08d4cfcc34181b0b5cbf065c40f687bf740Torne (Richard Coles)#include <stdio.h> 120f1bc08d4cfcc34181b0b5cbf065c40f687bf740Torne (Richard Coles)#include <sys/capability.h> 13f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)#include <sys/stat.h> 14a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles)#include <sys/syscall.h> 15f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)#include <sys/types.h> 16a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles)#include <sys/wait.h> 17f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)#include <unistd.h> 180f1bc08d4cfcc34181b0b5cbf065c40f687bf740Torne (Richard Coles) 190f1bc08d4cfcc34181b0b5cbf065c40f687bf740Torne (Richard Coles)#include "base/basictypes.h" 20f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)#include "base/bind.h" 210f1bc08d4cfcc34181b0b5cbf065c40f687bf740Torne (Richard Coles)#include "base/logging.h" 22a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles)#include "base/posix/eintr_wrapper.h" 23f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)#include "base/strings/string_number_conversions.h" 24f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)#include "base/template_util.h" 25a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles)#include "base/third_party/valgrind/valgrind.h" 26f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)#include "base/threading/thread.h" 270f1bc08d4cfcc34181b0b5cbf065c40f687bf740Torne (Richard Coles) 280f1bc08d4cfcc34181b0b5cbf065c40f687bf740Torne (Richard Coles)namespace { 290f1bc08d4cfcc34181b0b5cbf065c40f687bf740Torne (Richard Coles) 30a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles)bool IsRunningOnValgrind() { return RUNNING_ON_VALGRIND; } 31a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) 320f1bc08d4cfcc34181b0b5cbf065c40f687bf740Torne (Richard Coles)struct CapFreeDeleter { 330f1bc08d4cfcc34181b0b5cbf065c40f687bf740Torne (Richard Coles) inline void operator()(cap_t cap) const { 340f1bc08d4cfcc34181b0b5cbf065c40f687bf740Torne (Richard Coles) int ret = cap_free(cap); 350f1bc08d4cfcc34181b0b5cbf065c40f687bf740Torne (Richard Coles) CHECK_EQ(0, ret); 360f1bc08d4cfcc34181b0b5cbf065c40f687bf740Torne (Richard Coles) } 370f1bc08d4cfcc34181b0b5cbf065c40f687bf740Torne (Richard Coles)}; 380f1bc08d4cfcc34181b0b5cbf065c40f687bf740Torne (Richard Coles) 390f1bc08d4cfcc34181b0b5cbf065c40f687bf740Torne (Richard Coles)// Wrapper to manage libcap2's cap_t type. 400f1bc08d4cfcc34181b0b5cbf065c40f687bf740Torne (Richard Coles)typedef scoped_ptr<typeof(*((cap_t)0)), CapFreeDeleter> ScopedCap; 410f1bc08d4cfcc34181b0b5cbf065c40f687bf740Torne (Richard Coles) 420f1bc08d4cfcc34181b0b5cbf065c40f687bf740Torne (Richard Coles)struct CapTextFreeDeleter { 430f1bc08d4cfcc34181b0b5cbf065c40f687bf740Torne (Richard Coles) inline void operator()(char* cap_text) const { 440f1bc08d4cfcc34181b0b5cbf065c40f687bf740Torne (Richard Coles) int ret = cap_free(cap_text); 450f1bc08d4cfcc34181b0b5cbf065c40f687bf740Torne (Richard Coles) CHECK_EQ(0, ret); 460f1bc08d4cfcc34181b0b5cbf065c40f687bf740Torne (Richard Coles) } 470f1bc08d4cfcc34181b0b5cbf065c40f687bf740Torne (Richard Coles)}; 480f1bc08d4cfcc34181b0b5cbf065c40f687bf740Torne (Richard Coles) 490f1bc08d4cfcc34181b0b5cbf065c40f687bf740Torne (Richard Coles)// Wrapper to manage the result from libcap2's cap_from_text(). 500f1bc08d4cfcc34181b0b5cbf065c40f687bf740Torne (Richard Coles)typedef scoped_ptr<char, CapTextFreeDeleter> ScopedCapText; 510f1bc08d4cfcc34181b0b5cbf065c40f687bf740Torne (Richard Coles) 52f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)struct FILECloser { 53f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) inline void operator()(FILE* f) const { 54f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) DCHECK(f); 55f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) PCHECK(0 == fclose(f)); 56f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) } 57f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)}; 58f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) 59a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles)// Don't use ScopedFILE in base since it doesn't check fclose(). 60f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)// TODO(jln): fix base/. 61f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)typedef scoped_ptr<FILE, FILECloser> ScopedFILE; 62f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) 63f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)struct DIRCloser { 64f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) void operator()(DIR* d) const { 65f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) DCHECK(d); 66f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) PCHECK(0 == closedir(d)); 67f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) } 68f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)}; 69f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) 70f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)typedef scoped_ptr<DIR, DIRCloser> ScopedDIR; 71f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) 72f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)COMPILE_ASSERT((base::is_same<uid_t, gid_t>::value), UidAndGidAreSameType); 73f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)// generic_id_t can be used for either uid_t or gid_t. 74f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)typedef uid_t generic_id_t; 75f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) 76f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)// Write a uid or gid mapping from |id| to |id| in |map_file|. 77f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)bool WriteToIdMapFile(const char* map_file, generic_id_t id) { 78f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) ScopedFILE f(fopen(map_file, "w")); 79f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) PCHECK(f); 80f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) const uid_t inside_id = id; 81f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) const uid_t outside_id = id; 82f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) int num = fprintf(f.get(), "%d %d 1\n", inside_id, outside_id); 83f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) if (num < 0) return false; 84f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) // Manually call fflush() to catch permission failures. 85f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) int ret = fflush(f.get()); 86f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) if (ret) { 87f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) VLOG(1) << "Could not write to id map file"; 88f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) return false; 89f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) } 90f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) return true; 91f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)} 92f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) 93f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)// Checks that the set of RES-uids and the set of RES-gids have 94f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)// one element each and return that element in |resuid| and |resgid| 95f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)// respectively. It's ok to pass NULL as one or both of the ids. 96f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)bool GetRESIds(uid_t* resuid, gid_t* resgid) { 97f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) uid_t ruid, euid, suid; 98f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) gid_t rgid, egid, sgid; 99f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) PCHECK(getresuid(&ruid, &euid, &suid) == 0); 100f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) PCHECK(getresgid(&rgid, &egid, &sgid) == 0); 101f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) const bool uids_are_equal = (ruid == euid) && (ruid == suid); 102f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) const bool gids_are_equal = (rgid == egid) && (rgid == sgid); 103f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) if (!uids_are_equal || !gids_are_equal) return false; 104f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) if (resuid) *resuid = euid; 105f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) if (resgid) *resgid = egid; 106f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) return true; 107f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)} 108f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) 109f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)// chroot() and chdir() to /proc/<tid>/fdinfo. 110f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)void ChrootToThreadFdInfo(base::PlatformThreadId tid, bool* result) { 111f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) DCHECK(result); 112f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) *result = false; 113f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) 114f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) COMPILE_ASSERT((base::is_same<base::PlatformThreadId, int>::value), 115f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) TidIsAnInt); 116f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) const std::string current_thread_fdinfo = "/proc/" + 117f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) base::IntToString(tid) + "/fdinfo/"; 118f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) 119f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) // Make extra sure that /proc/<tid>/fdinfo is unique to the thread. 120f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) CHECK(0 == unshare(CLONE_FILES)); 121f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) int chroot_ret = chroot(current_thread_fdinfo.c_str()); 122f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) if (chroot_ret) { 123f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) PLOG(ERROR) << "Could not chroot"; 124f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) return; 125f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) } 126f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) 127f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) // CWD is essentially an implicit file descriptor, so be careful to not leave 128f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) // it behind. 129f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) PCHECK(0 == chdir("/")); 130f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) 131f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) *result = true; 132f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) return; 133f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)} 134f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) 135f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)// chroot() to an empty dir that is "safe". To be safe, it must not contain 136f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)// any subdirectory (chroot-ing there would allow a chroot escape) and it must 137f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)// be impossible to create an empty directory there. 138f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)// We achieve this by doing the following: 139f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)// 1. We create a new thread, which will create a new /proc/<tid>/ directory 140f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)// 2. We chroot to /proc/<tid>/fdinfo/ 141f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)// This is already "safe", since fdinfo/ does not contain another directory and 142f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)// one cannot create another directory there. 143f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)// 3. The thread dies 144f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)// After (3) happens, the directory is not available anymore in /proc. 145f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)bool ChrootToSafeEmptyDir() { 146f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) base::Thread chrooter("sandbox_chrooter"); 147f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) if (!chrooter.Start()) return false; 148f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) bool is_chrooted = false; 149f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) chrooter.message_loop()->PostTask(FROM_HERE, 150f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) base::Bind(&ChrootToThreadFdInfo, chrooter.thread_id(), &is_chrooted)); 151f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) // Make sure our task has run before committing the return value. 152f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) chrooter.Stop(); 153f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) return is_chrooted; 154f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)} 155f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) 156a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles)// CHECK() that an attempt to move to a new user namespace raised an expected 157a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles)// errno. 158a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles)void CheckCloneNewUserErrno(int error) { 159a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) // EPERM can happen if already in a chroot. EUSERS if too many nested 160a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) // namespaces are used. EINVAL for kernels that don't support the feature. 161a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) // Valgrind will ENOSYS unshare(). 162a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) PCHECK(error == EPERM || error == EUSERS || error == EINVAL || 163a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) error == ENOSYS); 164a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles)} 165a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) 1660f1bc08d4cfcc34181b0b5cbf065c40f687bf740Torne (Richard Coles)} // namespace. 1670f1bc08d4cfcc34181b0b5cbf065c40f687bf740Torne (Richard Coles) 1680f1bc08d4cfcc34181b0b5cbf065c40f687bf740Torne (Richard Coles)namespace sandbox { 1690f1bc08d4cfcc34181b0b5cbf065c40f687bf740Torne (Richard Coles) 1700f1bc08d4cfcc34181b0b5cbf065c40f687bf740Torne (Richard Coles)Credentials::Credentials() { 1710f1bc08d4cfcc34181b0b5cbf065c40f687bf740Torne (Richard Coles)} 1720f1bc08d4cfcc34181b0b5cbf065c40f687bf740Torne (Richard Coles) 1730f1bc08d4cfcc34181b0b5cbf065c40f687bf740Torne (Richard Coles)Credentials::~Credentials() { 1740f1bc08d4cfcc34181b0b5cbf065c40f687bf740Torne (Richard Coles)} 1750f1bc08d4cfcc34181b0b5cbf065c40f687bf740Torne (Richard Coles) 176cedac228d2dd51db4b79ea1e72c7f249408ee061Torne (Richard Coles)int Credentials::CountOpenFds(int proc_fd) { 177cedac228d2dd51db4b79ea1e72c7f249408ee061Torne (Richard Coles) DCHECK_LE(0, proc_fd); 178cedac228d2dd51db4b79ea1e72c7f249408ee061Torne (Richard Coles) int proc_self_fd = openat(proc_fd, "self/fd", O_DIRECTORY | O_RDONLY); 179cedac228d2dd51db4b79ea1e72c7f249408ee061Torne (Richard Coles) PCHECK(0 <= proc_self_fd); 180cedac228d2dd51db4b79ea1e72c7f249408ee061Torne (Richard Coles) 181cedac228d2dd51db4b79ea1e72c7f249408ee061Torne (Richard Coles) // Ownership of proc_self_fd is transferred here, it must not be closed 182cedac228d2dd51db4b79ea1e72c7f249408ee061Torne (Richard Coles) // or modified afterwards except via dir. 183cedac228d2dd51db4b79ea1e72c7f249408ee061Torne (Richard Coles) ScopedDIR dir(fdopendir(proc_self_fd)); 184cedac228d2dd51db4b79ea1e72c7f249408ee061Torne (Richard Coles) CHECK(dir); 185cedac228d2dd51db4b79ea1e72c7f249408ee061Torne (Richard Coles) 186cedac228d2dd51db4b79ea1e72c7f249408ee061Torne (Richard Coles) int count = 0; 187cedac228d2dd51db4b79ea1e72c7f249408ee061Torne (Richard Coles) struct dirent e; 188cedac228d2dd51db4b79ea1e72c7f249408ee061Torne (Richard Coles) struct dirent* de; 189cedac228d2dd51db4b79ea1e72c7f249408ee061Torne (Richard Coles) while (!readdir_r(dir.get(), &e, &de) && de) { 190cedac228d2dd51db4b79ea1e72c7f249408ee061Torne (Richard Coles) if (strcmp(e.d_name, ".") == 0 || strcmp(e.d_name, "..") == 0) { 191cedac228d2dd51db4b79ea1e72c7f249408ee061Torne (Richard Coles) continue; 192cedac228d2dd51db4b79ea1e72c7f249408ee061Torne (Richard Coles) } 193cedac228d2dd51db4b79ea1e72c7f249408ee061Torne (Richard Coles) 194cedac228d2dd51db4b79ea1e72c7f249408ee061Torne (Richard Coles) int fd_num; 195cedac228d2dd51db4b79ea1e72c7f249408ee061Torne (Richard Coles) CHECK(base::StringToInt(e.d_name, &fd_num)); 196cedac228d2dd51db4b79ea1e72c7f249408ee061Torne (Richard Coles) if (fd_num == proc_fd || fd_num == proc_self_fd) { 197cedac228d2dd51db4b79ea1e72c7f249408ee061Torne (Richard Coles) continue; 198cedac228d2dd51db4b79ea1e72c7f249408ee061Torne (Richard Coles) } 199cedac228d2dd51db4b79ea1e72c7f249408ee061Torne (Richard Coles) 200cedac228d2dd51db4b79ea1e72c7f249408ee061Torne (Richard Coles) ++count; 201cedac228d2dd51db4b79ea1e72c7f249408ee061Torne (Richard Coles) } 202cedac228d2dd51db4b79ea1e72c7f249408ee061Torne (Richard Coles) return count; 203cedac228d2dd51db4b79ea1e72c7f249408ee061Torne (Richard Coles)} 204cedac228d2dd51db4b79ea1e72c7f249408ee061Torne (Richard Coles) 205f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)bool Credentials::HasOpenDirectory(int proc_fd) { 206f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) int proc_self_fd = -1; 207f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) if (proc_fd >= 0) { 208f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) proc_self_fd = openat(proc_fd, "self/fd", O_DIRECTORY | O_RDONLY); 209f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) } else { 210f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) proc_self_fd = openat(AT_FDCWD, "/proc/self/fd", O_DIRECTORY | O_RDONLY); 211f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) if (proc_self_fd < 0) { 212a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) // If this process has been chrooted (eg into /proc/self/fdinfo) then 213a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) // the new root dir will not have directory listing permissions for us 214a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) // (hence EACCES). And if we do have this permission, then /proc won't 215a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) // exist anyway (hence ENOENT). 216a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) DPCHECK(errno == EACCES || errno == ENOENT) 217a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) << "Unexpected failure when trying to open /proc/self/fd: (" 218a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) << errno << ") " << strerror(errno); 219a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) 220f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) // If not available, guess false. 221f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) return false; 222f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) } 223f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) } 2245c02ac1a9c1b504631c0a3d2b6e737b5d738bae1Bo Liu PCHECK(0 <= proc_self_fd); 225f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) 226f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) // Ownership of proc_self_fd is transferred here, it must not be closed 227f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) // or modified afterwards except via dir. 228f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) ScopedDIR dir(fdopendir(proc_self_fd)); 229f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) CHECK(dir); 230f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) 231f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) struct dirent e; 232f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) struct dirent* de; 233f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) while (!readdir_r(dir.get(), &e, &de) && de) { 234f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) if (strcmp(e.d_name, ".") == 0 || strcmp(e.d_name, "..") == 0) { 235f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) continue; 236f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) } 237f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) 238f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) int fd_num; 239f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) CHECK(base::StringToInt(e.d_name, &fd_num)); 240f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) if (fd_num == proc_fd || fd_num == proc_self_fd) { 241f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) continue; 242f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) } 243f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) 244f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) struct stat s; 245f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) // It's OK to use proc_self_fd here, fstatat won't modify it. 246f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) CHECK(fstatat(proc_self_fd, e.d_name, &s, 0) == 0); 247f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) if (S_ISDIR(s.st_mode)) { 248f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) return true; 249f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) } 250f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) } 251f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) 252f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) // No open unmanaged directories found. 253f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) return false; 254f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)} 255f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) 256f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)bool Credentials::DropAllCapabilities() { 2570f1bc08d4cfcc34181b0b5cbf065c40f687bf740Torne (Richard Coles) ScopedCap cap(cap_init()); 2580f1bc08d4cfcc34181b0b5cbf065c40f687bf740Torne (Richard Coles) CHECK(cap); 2590f1bc08d4cfcc34181b0b5cbf065c40f687bf740Torne (Richard Coles) PCHECK(0 == cap_set_proc(cap.get())); 260f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) // We never let this function fail. 261f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) return true; 2620f1bc08d4cfcc34181b0b5cbf065c40f687bf740Torne (Richard Coles)} 2630f1bc08d4cfcc34181b0b5cbf065c40f687bf740Torne (Richard Coles) 264f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)bool Credentials::HasAnyCapability() const { 2650f1bc08d4cfcc34181b0b5cbf065c40f687bf740Torne (Richard Coles) ScopedCap current_cap(cap_get_proc()); 2660f1bc08d4cfcc34181b0b5cbf065c40f687bf740Torne (Richard Coles) CHECK(current_cap); 2670f1bc08d4cfcc34181b0b5cbf065c40f687bf740Torne (Richard Coles) ScopedCap empty_cap(cap_init()); 2680f1bc08d4cfcc34181b0b5cbf065c40f687bf740Torne (Richard Coles) CHECK(empty_cap); 2690f1bc08d4cfcc34181b0b5cbf065c40f687bf740Torne (Richard Coles) return cap_compare(current_cap.get(), empty_cap.get()) != 0; 2700f1bc08d4cfcc34181b0b5cbf065c40f687bf740Torne (Richard Coles)} 2710f1bc08d4cfcc34181b0b5cbf065c40f687bf740Torne (Richard Coles) 272f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)scoped_ptr<std::string> Credentials::GetCurrentCapString() const { 2730f1bc08d4cfcc34181b0b5cbf065c40f687bf740Torne (Richard Coles) ScopedCap current_cap(cap_get_proc()); 2740f1bc08d4cfcc34181b0b5cbf065c40f687bf740Torne (Richard Coles) CHECK(current_cap); 2750f1bc08d4cfcc34181b0b5cbf065c40f687bf740Torne (Richard Coles) ScopedCapText cap_text(cap_to_text(current_cap.get(), NULL)); 2760f1bc08d4cfcc34181b0b5cbf065c40f687bf740Torne (Richard Coles) CHECK(cap_text); 2770f1bc08d4cfcc34181b0b5cbf065c40f687bf740Torne (Richard Coles) return scoped_ptr<std::string> (new std::string(cap_text.get())); 2780f1bc08d4cfcc34181b0b5cbf065c40f687bf740Torne (Richard Coles)} 2790f1bc08d4cfcc34181b0b5cbf065c40f687bf740Torne (Richard Coles) 280a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles)// static 281a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles)bool Credentials::SupportsNewUserNS() { 282a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) // Valgrind will let clone(2) pass-through, but doesn't support unshare(), 283a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) // so always consider UserNS unsupported there. 284a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) if (IsRunningOnValgrind()) { 285a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) return false; 286a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) } 287a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) 288a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) // This is roughly a fork(). 289a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) const pid_t pid = syscall(__NR_clone, CLONE_NEWUSER | SIGCHLD, 0, 0, 0); 290a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) 291a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) if (pid == -1) { 292a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) CheckCloneNewUserErrno(errno); 293a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) return false; 294a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) } 295a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) 296a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) // The parent process could have had threads. In the child, these threads 297a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) // have disappeared. Make sure to not do anything in the child, as this is a 298a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) // fragile execution environment. 299a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) if (pid == 0) { 300a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) _exit(0); 301a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) } 302a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) 303a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) // Always reap the child. 304a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) siginfo_t infop; 305a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) PCHECK(0 == HANDLE_EINTR(waitid(P_PID, pid, &infop, WEXITED))); 306a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) 307a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) // clone(2) succeeded, we can use CLONE_NEWUSER. 308a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) return true; 309a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles)} 310a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) 311f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)bool Credentials::MoveToNewUserNS() { 312f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) uid_t uid; 313f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) gid_t gid; 314f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) if (!GetRESIds(&uid, &gid)) { 315f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) // If all the uids (or gids) are not equal to each other, the security 316f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) // model will most likely confuse the caller, abort. 317f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) DVLOG(1) << "uids or gids differ!"; 318f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) return false; 319f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) } 320f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) int ret = unshare(CLONE_NEWUSER); 321f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) if (ret) { 322a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) const int unshare_errno = errno; 323f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) VLOG(1) << "Looks like unprivileged CLONE_NEWUSER may not be available " 324f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) << "on this kernel."; 325a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) CheckCloneNewUserErrno(unshare_errno); 326f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) return false; 327f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) } 328a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) 329f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) // The current {r,e,s}{u,g}id is now an overflow id (c.f. 330f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) // /proc/sys/kernel/overflowuid). Setup the uid and gid maps. 331f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) DCHECK(GetRESIds(NULL, NULL)); 332f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) const char kGidMapFile[] = "/proc/self/gid_map"; 333f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) const char kUidMapFile[] = "/proc/self/uid_map"; 334f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) CHECK(WriteToIdMapFile(kGidMapFile, gid)); 335f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) CHECK(WriteToIdMapFile(kUidMapFile, uid)); 336f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) DCHECK(GetRESIds(NULL, NULL)); 337f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) return true; 338f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)} 339f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) 340f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)bool Credentials::DropFileSystemAccess() { 341f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) // Chrooting to a safe empty dir will only be safe if no directory file 342f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) // descriptor is available to the process. 343f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) DCHECK(!HasOpenDirectory(-1)); 344f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) return ChrootToSafeEmptyDir(); 345f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)} 346f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) 3470f1bc08d4cfcc34181b0b5cbf065c40f687bf740Torne (Richard Coles)} // namespace sandbox. 348