diff options
author | rickyz <rickyz@chromium.org> | 2015-03-27 15:31:15 -0700 |
---|---|---|
committer | Commit bot <commit-bot@chromium.org> | 2015-03-27 22:32:14 +0000 |
commit | 4557699fbb30704f76c68b906d2656d2e322572c (patch) | |
tree | eff092838beee026cd01744ab663b647d9a16ebb /content/zygote/zygote_linux.cc | |
parent | d5620b8ff8e4d3e7ba75d1c798072f7eb4f123ce (diff) | |
download | chromium_src-4557699fbb30704f76c68b906d2656d2e322572c.zip chromium_src-4557699fbb30704f76c68b906d2656d2e322572c.tar.gz chromium_src-4557699fbb30704f76c68b906d2656d2e322572c.tar.bz2 |
Start all children in their own PID namespace.
BUG=460972
Review URL: https://codereview.chromium.org/868233011
Cr-Commit-Position: refs/heads/master@{#322660}
Diffstat (limited to 'content/zygote/zygote_linux.cc')
-rw-r--r-- | content/zygote/zygote_linux.cc | 44 |
1 files changed, 40 insertions, 4 deletions
diff --git a/content/zygote/zygote_linux.cc b/content/zygote/zygote_linux.cc index 5944f87..5a84dec 100644 --- a/content/zygote/zygote_linux.cc +++ b/content/zygote/zygote_linux.cc @@ -36,6 +36,8 @@ #include "content/public/common/zygote_fork_delegate_linux.h" #include "ipc/ipc_channel.h" #include "ipc/ipc_switches.h" +#include "sandbox/linux/services/credentials.h" +#include "sandbox/linux/services/namespace_sandbox.h" // See http://code.google.com/p/chromium/wiki/LinuxZygote @@ -47,6 +49,14 @@ namespace { void SIGCHLDHandler(int signal) { } +// On Linux, when a process is the init process of a PID namespace, it cannot be +// terminated by signals like SIGTERM or SIGINT, since they are ignored unless +// we register a handler for them. In the handlers, we exit with this special +// exit code that GetTerminationStatus understands to mean that we were +// terminated by an external signal. +const int kKilledExitCode = 0x80; +const int kUnexpectedExitCode = 0x81; + int LookUpFd(const base::GlobalDescriptors::Mapping& fd_mapping, uint32_t key) { for (size_t index = 0; index < fd_mapping.size(); ++index) { if (fd_mapping[index].key == key) @@ -104,7 +114,7 @@ bool Zygote::ProcessRequests() { struct sigaction action; memset(&action, 0, sizeof(action)); action.sa_handler = &SIGCHLDHandler; - CHECK(sigaction(SIGCHLD, &action, NULL) == 0); + PCHECK(sigaction(SIGCHLD, &action, NULL) == 0); if (UsingSUIDSandbox() || UsingNSSandbox()) { // Let the ZygoteHost know we are ready to go. @@ -305,6 +315,11 @@ bool Zygote::GetTerminationStatus(base::ProcessHandle real_pid, // Time to forget about this process. process_info_map_.erase(real_pid); } + + if (WIFEXITED(*exit_code) && WEXITSTATUS(*exit_code) == kKilledExitCode) { + *status = base::TERMINATION_STATUS_PROCESS_WAS_KILLED; + } + return true; } @@ -375,12 +390,33 @@ int Zygote::ForkWithRealPid(const std::string& process_type, CHECK_NE(pid, 0); } else { CreatePipe(&read_pipe, &write_pipe); - // This is roughly equivalent to a fork(). We are using ForkWithFlags mainly - // to give it some more diverse test coverage. - pid = base::ForkWithFlags(SIGCHLD, nullptr, nullptr); + if (sandbox_flags_ & kSandboxLinuxPIDNS && + sandbox_flags_ & kSandboxLinuxUserNS) { + pid = sandbox::NamespaceSandbox::ForkInNewPidNamespace( + /*drop_capabilities_in_child=*/true); + } else { + pid = fork(); + } } if (pid == 0) { + // If the process is the init process inside a PID namespace, it must have + // explicit signal handlers. + if (getpid() == 1) { + for (const int sig : {SIGINT, SIGTERM}) { + sandbox::NamespaceSandbox::InstallTerminationSignalHandler( + sig, kKilledExitCode); + } + + static const int kUnexpectedSignals[] = { + SIGHUP, SIGQUIT, SIGABRT, SIGPIPE, SIGUSR1, SIGUSR2, + }; + for (const int sig : kUnexpectedSignals) { + sandbox::NamespaceSandbox::InstallTerminationSignalHandler( + sig, kUnexpectedExitCode); + } + } + // In the child process. write_pipe.reset(); |