1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
|
// Copyright 2015 The Chromium Authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
#include "sandbox/linux/services/namespace_utils.h"
#include <fcntl.h>
#include <sched.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <unistd.h>
#include <string>
#include "base/files/file_path.h"
#include "base/files/file_util.h"
#include "base/files/scoped_file.h"
#include "base/logging.h"
#include "base/posix/eintr_wrapper.h"
#include "base/process/launch.h"
#include "base/strings/safe_sprintf.h"
#include "base/third_party/valgrind/valgrind.h"
namespace sandbox {
namespace {
bool IsRunningOnValgrind() {
return RUNNING_ON_VALGRIND;
}
const char kProcSelfSetgroups[] = "/proc/self/setgroups";
} // namespace
// static
bool NamespaceUtils::WriteToIdMapFile(const char* map_file, generic_id_t id) {
// This function needs to be async-signal-safe, as it may be called in between
// fork and exec.
int fd = HANDLE_EINTR(open(map_file, O_WRONLY));
if (fd == -1) {
return false;
}
const generic_id_t inside_id = id;
const generic_id_t outside_id = id;
char mapping[64];
const ssize_t len =
base::strings::SafeSPrintf(mapping, "%d %d 1\n", inside_id, outside_id);
const ssize_t rc = HANDLE_EINTR(write(fd, mapping, len));
RAW_CHECK(IGNORE_EINTR(close(fd)) == 0);
return rc == len;
}
// static
bool NamespaceUtils::KernelSupportsUnprivilegedNamespace(int type) {
// Valgrind will let clone(2) pass-through, but doesn't support unshare(),
// so always consider namespaces unsupported there.
if (IsRunningOnValgrind()) {
return false;
}
// As of Linux 3.8, /proc/self/ns/* files exist for all namespace types. Since
// user namespaces were added in 3.8, it is OK to rely on the existence of
// /proc/self/ns/*.
if (!base::PathExists(base::FilePath("/proc/self/ns/user"))) {
return false;
}
const char* path;
switch (type) {
case CLONE_NEWUSER:
return true;
case CLONE_NEWIPC:
path = "/proc/self/ns/ipc";
break;
case CLONE_NEWNET:
path = "/proc/self/ns/net";
break;
case CLONE_NEWNS:
path = "/proc/self/ns/mnt";
break;
case CLONE_NEWPID:
path = "/proc/self/ns/pid";
break;
case CLONE_NEWUTS:
path = "/proc/self/ns/uts";
break;
default:
NOTREACHED();
return false;
}
return base::PathExists(base::FilePath(path));
}
// static
bool NamespaceUtils::KernelSupportsDenySetgroups() {
return base::PathExists(base::FilePath(kProcSelfSetgroups));
}
// static
bool NamespaceUtils::DenySetgroups() {
// This function needs to be async-signal-safe.
int fd = HANDLE_EINTR(open(kProcSelfSetgroups, O_WRONLY));
if (fd == -1) {
return false;
}
static const char kDeny[] = "deny";
const ssize_t len = sizeof(kDeny) - 1;
const ssize_t rc = HANDLE_EINTR(write(fd, kDeny, len));
RAW_CHECK(IGNORE_EINTR(close(fd)) == 0);
return rc == len;
}
} // namespace sandbox
|
