diff options
Diffstat (limited to 'chrome/common')
| -rw-r--r-- | chrome/common/sandbox_init_wrapper_mac.cc | 19 | ||||
| -rw-r--r-- | chrome/common/sandbox_mac.h | 10 | ||||
| -rw-r--r-- | chrome/common/sandbox_mac.mm | 38 |
3 files changed, 62 insertions, 5 deletions
diff --git a/chrome/common/sandbox_init_wrapper_mac.cc b/chrome/common/sandbox_init_wrapper_mac.cc index 898faed..3ed61ed 100644 --- a/chrome/common/sandbox_init_wrapper_mac.cc +++ b/chrome/common/sandbox_init_wrapper_mac.cc @@ -20,8 +20,17 @@ bool SandboxInitWrapper::InitializeSandbox(const CommandLine& command_line, // Browser process isn't sandboxed. return true; } else if (process_type == switches::kRendererProcess) { - // Renderer process sandbox. - sandbox_process_type = sandbox::SANDBOX_TYPE_RENDERER; + // Renderer process sandbox. If --internal_nacl is present then use the + // version of the renderer sandbox which allows Native Client to use Unix + // sockets. + // TODO(msneck): Remove the use of Unix sockets from Native Client and + // then get rid of the SANDBOX_TYPE_NACL_PLUGIN enum. + // See http://code.google.com/p/nativeclient/issues/detail?id=344 + if (command_line.HasSwitch(switches::kInternalNaCl)) { + sandbox_process_type = sandbox::SANDBOX_TYPE_NACL_PLUGIN; + } else { + sandbox_process_type = sandbox::SANDBOX_TYPE_RENDERER; + } } else if (process_type == switches::kExtensionProcess) { // Extension processes are just renderers [they use RenderMain()] with a // different set of command line flags. @@ -39,8 +48,10 @@ bool SandboxInitWrapper::InitializeSandbox(const CommandLine& command_line, } else if (process_type == switches::kWorkerProcess) { // Worker process sandbox. sandbox_process_type = sandbox::SANDBOX_TYPE_WORKER; - } else if ((process_type == switches::kNaClLoaderProcess) || - (process_type == switches::kPluginProcess) || + } else if (process_type == switches::kNaClLoaderProcess) { + // Native Client sel_ldr (user untrusted code) sandbox. + sandbox_process_type = sandbox::SANDBOX_TYPE_NACL_LOADER; + } else if ((process_type == switches::kPluginProcess) || (process_type == switches::kProfileImportProcess) || (process_type == switches::kGpuProcess)) { return true; diff --git a/chrome/common/sandbox_mac.h b/chrome/common/sandbox_mac.h index a8a55b0..c8ef4c3 100644 --- a/chrome/common/sandbox_mac.h +++ b/chrome/common/sandbox_mac.h @@ -12,12 +12,20 @@ namespace sandbox { enum SandboxProcessType { SANDBOX_TYPE_RENDERER, - // Worker process has *everything* not needed for Cocoa locked down. + // The worker processes uses the most restrictive sandbox which has almost + // *everything* locked down. Only a couple of /System/Library/ paths and + // some other very basic operations (e.g., reading metadata to allow + // following symlinks) are permitted. SANDBOX_TYPE_WORKER, // Utility process is as restrictive as the worker process except full access // is allowed to one configurable directory. SANDBOX_TYPE_UTILITY, + + // Native Client sandboxes. The plugin contains trusted code and the + // loader contains the user's untrusted code. + SANDBOX_TYPE_NACL_PLUGIN, + SANDBOX_TYPE_NACL_LOADER, }; // Warm up System APIs that empirically need to be accessed before the Sandbox diff --git a/chrome/common/sandbox_mac.mm b/chrome/common/sandbox_mac.mm index ca8ac6c..1299481 100644 --- a/chrome/common/sandbox_mac.mm +++ b/chrome/common/sandbox_mac.mm @@ -15,6 +15,7 @@ extern "C" { #include "base/command_line.h" #include "base/file_util.h" #include "base/mac_util.h" +#include "base/rand_util_c.h" #include "base/scoped_cftyperef.h" #include "base/scoped_nsautorelease_pool.h" #include "base/string16.h" @@ -234,6 +235,10 @@ void SandboxWarmup() { NULL)); CGImageSourceGetStatus(img); } + + { // Native Client access to /dev/random. + GetUrandomFD(); + } } // Turns on the OS X sandbox for this process. @@ -250,6 +255,7 @@ bool EnableSandbox(SandboxProcessType sandbox_type, // TODO(jeremy): Look at using include syntax to unify common parts of sandbox // definition files. NSString* sandbox_config_filename = nil; + bool allow_nacl_lines = false; switch (sandbox_type) { case SANDBOX_TYPE_RENDERER: sandbox_config_filename = @"renderer"; @@ -260,6 +266,26 @@ bool EnableSandbox(SandboxProcessType sandbox_type, case SANDBOX_TYPE_UTILITY: sandbox_config_filename = @"utility"; break; + case SANDBOX_TYPE_NACL_PLUGIN: + // The Native Client plugin is a standard renderer sandbox with some + // additional lines to support use of Unix sockets. + // TODO(msneck): Remove the use of Unix sockets from Native Client and + // then remove the associated rules from chrome/renderer/renderer.sb. + // See http://code.google.com/p/nativeclient/issues/detail?id=344 + sandbox_config_filename = @"renderer"; + allow_nacl_lines = true; + break; + case SANDBOX_TYPE_NACL_LOADER: + // The Native Client loader is used for safeguarding the user's + // untrusted code within Native Client. + // TODO(msneck): Remove the use of Unix sockets from Native Client and + // then decide on an appropriate sandbox type for the untrusted code. + // This might simply mean removing the Unix socket rules from + // chrome/browser/nacl-loader.sb or it might mean sharing the + // sandbox configuration with SANDBOX_TYPE_WORKER. + // See http://code.google.com/p/nativeclient/issues/detail?id=344 + sandbox_config_filename = @"nacl-loader"; + break; default: NOTREACHED(); return false; @@ -288,6 +314,13 @@ bool EnableSandbox(SandboxProcessType sandbox_type, withString:@""]; } + // Enable Native Client lines if they are allowed. + if (allow_nacl_lines) { + sandbox_data = [sandbox_data + stringByReplacingOccurrencesOfString:@";NACL" + withString:@""]; + } + if (!allowed_dir.empty()) { // The sandbox only understands "real" paths. This resolving step is // needed so the caller doesn't need to worry about things like /var @@ -341,6 +374,11 @@ bool EnableSandbox(SandboxProcessType sandbox_type, sandbox_data = [sandbox_data stringByReplacingOccurrencesOfString:@"USER_HOMEDIR" withString:home_dir_escaped_ns]; + } else if (major_version == 10 && minor_version < 6) { + // Sandbox rules only for versions before 10.6. + sandbox_data = [sandbox_data + stringByReplacingOccurrencesOfString:@";BEFORE_10.6" + withString:@""]; } char* error_buff = NULL; |