From 15367d0a63dd2bfd43d473bb11cd1bf34dea212d Mon Sep 17 00:00:00 2001 From: "msneck@google.com" Date: Tue, 30 Mar 2010 16:21:18 +0000 Subject: 1. Create a new sandbox type which allows access to Unix sockets in the Mac renderer sandbox to support running Native Client. 2. Put the Native Client sel_ldr (which contains the user's untrusted code into a new Mac sandbox type. 3. Open /dev/random in SandboxWarmup(). 4. Remove the "--nosandbox" flag when running Mac tests. BUG=http://code.google.com/p/nativeclient/issues/detail?id=327 TEST=nacl_ui_tests still pass while running in the sandbox. Review URL: http://codereview.chromium.org/1234003 git-svn-id: svn://svn.chromium.org/chrome/trunk/src@43086 0039d316-1c4b-4281-b951-d872f2087c98 --- chrome/browser/most-restrictive.sb | 48 +++++++++++++++++++++++++++++++ chrome/browser/worker.sb | 35 ---------------------- chrome/chrome_browser.gypi | 2 +- chrome/common/sandbox_init_wrapper_mac.cc | 19 +++++++++--- chrome/common/sandbox_mac.h | 13 ++++++++- chrome/common/sandbox_mac.mm | 40 +++++++++++++++++++++++++- chrome/renderer/renderer.sb | 14 ++++++++- chrome/test/nacl/nacl_test.cc | 3 -- 8 files changed, 128 insertions(+), 46 deletions(-) create mode 100644 chrome/browser/most-restrictive.sb delete mode 100644 chrome/browser/worker.sb (limited to 'chrome') diff --git a/chrome/browser/most-restrictive.sb b/chrome/browser/most-restrictive.sb new file mode 100644 index 0000000..f4d68c8 --- /dev/null +++ b/chrome/browser/most-restrictive.sb @@ -0,0 +1,48 @@ +;; +;; Copyright (c) 2009 The Chromium Authors. All rights reserved. +;; Use of this source code is governed by a BSD-style license that can be +;; found in the LICENSE file. +;; +; This is the Sandbox configuration file used for safeguarding the worker +; process which is used to run web workers in a sandboxed environment. It +; is also used to run the user's untrusted code within Native Client. +; +; This is the most restrictive sandbox profile and only enables just enough +; to allow basic use of Cocoa. +(version 1) +(deny default) +; Support for programmatically enabling verbose debugging. +;ENABLE_LOGGING (debug deny) + +; Allow sending signals to self - http://crbug.com/20370 +(allow signal (target self)) + +; Needed for full-page-zoomed controls - http://crbug.com/11325 +(allow sysctl-read) + +; Each line is marked with the System version that needs it. +; This profile is tested with the following system versions: +; 10.5.6, 10.6 + +; Allow following symlinks +(allow file-read-metadata) ; 10.5.6 + +; Loading System Libraries. +(allow file-read-data (regex #"^/System/Library/Frameworks($|/)")) ; 10.5.6 +(allow file-read-data (regex #"^/System/Library/PrivateFrameworks($|/)")) ; 10.5.6 +(allow file-read-data (regex #"^/System/Library/CoreServices($|/)")) ; 10.5.6 + +; Needed for IPC on 10.6 +;10.6_ONLY (allow ipc-posix-shm) + +; Needed for the Native Client plugin and loader. These lines are enabled +; if and only if --internal-nacl (or --enable-nacl) are used (and they +; are off by default.) +; TODO(msneck): Refactor Native Client to use something other than Unix +; sockets. Then change the code in chrome/common/sandbox_mac.mm which +; deals with the ";NACL" prefix. +; See http://code.google.com/p/nativeclient/issues/detail?id=344 +;NACL;BEFORE_10.6 (allow network-inbound (from unix-socket)) +;NACL;BEFORE_10.6 (allow network-outbound (to unix-socket)) +;NACL;10.6_ONLY (allow network-inbound (regex #"^(/private)?/tmp/nacl-")) +;NACL;10.6_ONLY (allow network-outbound (regex #"^(/private)?/tmp/nacl-")) diff --git a/chrome/browser/worker.sb b/chrome/browser/worker.sb deleted file mode 100644 index 6d3907b..0000000 --- a/chrome/browser/worker.sb +++ /dev/null @@ -1,35 +0,0 @@ -;; -;; Copyright (c) 2009 The Chromium Authors. All rights reserved. -;; Use of this source code is governed by a BSD-style license that can be -;; found in the LICENSE file. -;; -; This is the Sandbox configuration file used for safeguarding the worker -; process which is used to run web workers in a sandboxed environment. -; -; This is the most restrictive sandbox profile and only enables just enough -; to allow basic use of Cocoa. -(version 1) -(deny default) -; Support for programmatically enabling verbose debugging. -;ENABLE_LOGGING (debug deny) - -; Allow sending signals to self - http://crbug.com/20370 -(allow signal (target self)) - -; Needed for full-page-zoomed controls - http://crbug.com/11325 -(allow sysctl-read) - -; Each line is marked with the System version that needs it. -; This profile is tested with the following system versions: -; 10.5.6, 10.6 - -; Allow following symlinks -(allow file-read-metadata) ; 10.5.6 - -; Loading System Libraries. -(allow file-read-data (regex #"^/System/Library/Frameworks($|/)")) ; 10.5.6 -(allow file-read-data (regex #"^/System/Library/PrivateFrameworks($|/)")) ; 10.5.6 -(allow file-read-data (regex #"^/System/Library/CoreServices($|/)")) ; 10.5.6 - -; Needed for IPC on 10.6 -;10.6_ONLY (allow ipc-posix-shm) diff --git a/chrome/chrome_browser.gypi b/chrome/chrome_browser.gypi index 6d1a117..42f18ee 100755 --- a/chrome/chrome_browser.gypi +++ b/chrome/chrome_browser.gypi @@ -2572,7 +2572,7 @@ ], 'mac_bundle_resources': [ 'browser/utility.sb', - 'browser/worker.sb', + 'browser/most-restrictive.sb', ], }, 'actions': [ diff --git a/chrome/common/sandbox_init_wrapper_mac.cc b/chrome/common/sandbox_init_wrapper_mac.cc index 898faed..3ed61ed 100644 --- a/chrome/common/sandbox_init_wrapper_mac.cc +++ b/chrome/common/sandbox_init_wrapper_mac.cc @@ -20,8 +20,17 @@ bool SandboxInitWrapper::InitializeSandbox(const CommandLine& command_line, // Browser process isn't sandboxed. return true; } else if (process_type == switches::kRendererProcess) { - // Renderer process sandbox. - sandbox_process_type = sandbox::SANDBOX_TYPE_RENDERER; + // Renderer process sandbox. If --internal_nacl is present then use the + // version of the renderer sandbox which allows Native Client to use Unix + // sockets. + // TODO(msneck): Remove the use of Unix sockets from Native Client and + // then get rid of the SANDBOX_TYPE_NACL_PLUGIN enum. + // See http://code.google.com/p/nativeclient/issues/detail?id=344 + if (command_line.HasSwitch(switches::kInternalNaCl)) { + sandbox_process_type = sandbox::SANDBOX_TYPE_NACL_PLUGIN; + } else { + sandbox_process_type = sandbox::SANDBOX_TYPE_RENDERER; + } } else if (process_type == switches::kExtensionProcess) { // Extension processes are just renderers [they use RenderMain()] with a // different set of command line flags. @@ -39,8 +48,10 @@ bool SandboxInitWrapper::InitializeSandbox(const CommandLine& command_line, } else if (process_type == switches::kWorkerProcess) { // Worker process sandbox. sandbox_process_type = sandbox::SANDBOX_TYPE_WORKER; - } else if ((process_type == switches::kNaClLoaderProcess) || - (process_type == switches::kPluginProcess) || + } else if (process_type == switches::kNaClLoaderProcess) { + // Native Client sel_ldr (user untrusted code) sandbox. + sandbox_process_type = sandbox::SANDBOX_TYPE_NACL_LOADER; + } else if ((process_type == switches::kPluginProcess) || (process_type == switches::kProfileImportProcess) || (process_type == switches::kGpuProcess)) { return true; diff --git a/chrome/common/sandbox_mac.h b/chrome/common/sandbox_mac.h index a8a55b0..cf2652d 100644 --- a/chrome/common/sandbox_mac.h +++ b/chrome/common/sandbox_mac.h @@ -12,12 +12,23 @@ namespace sandbox { enum SandboxProcessType { SANDBOX_TYPE_RENDERER, - // Worker process has *everything* not needed for Cocoa locked down. + // The most restrictive sandbox has almost *everything* locked down. + // Only a couple of /System/Library/ paths and some other very basic + // operations (e.g., reading metadata to allow following symlinks) + // are permitted. + SANDBOX_TYPE_MOST_RESTRICTIVE, + + // Worker process uses the most restrictive sandbox. SANDBOX_TYPE_WORKER, // Utility process is as restrictive as the worker process except full access // is allowed to one configurable directory. SANDBOX_TYPE_UTILITY, + + // Native Client sandboxes. The plugin contains trusted code and the + // loader contains the user's untrusted code. + SANDBOX_TYPE_NACL_PLUGIN, + SANDBOX_TYPE_NACL_LOADER, }; // Warm up System APIs that empirically need to be accessed before the Sandbox diff --git a/chrome/common/sandbox_mac.mm b/chrome/common/sandbox_mac.mm index ca8ac6c..63869ee 100644 --- a/chrome/common/sandbox_mac.mm +++ b/chrome/common/sandbox_mac.mm @@ -15,6 +15,7 @@ extern "C" { #include "base/command_line.h" #include "base/file_util.h" #include "base/mac_util.h" +#include "base/rand_util_c.h" #include "base/scoped_cftyperef.h" #include "base/scoped_nsautorelease_pool.h" #include "base/string16.h" @@ -234,6 +235,10 @@ void SandboxWarmup() { NULL)); CGImageSourceGetStatus(img); } + + { // Native Client access to /dev/random. + GetUrandomFD(); + } } // Turns on the OS X sandbox for this process. @@ -250,16 +255,37 @@ bool EnableSandbox(SandboxProcessType sandbox_type, // TODO(jeremy): Look at using include syntax to unify common parts of sandbox // definition files. NSString* sandbox_config_filename = nil; + bool allow_nacl_lines = false; switch (sandbox_type) { case SANDBOX_TYPE_RENDERER: sandbox_config_filename = @"renderer"; break; + case SANDBOX_TYPE_MOST_RESTRICTIVE: case SANDBOX_TYPE_WORKER: - sandbox_config_filename = @"worker"; + sandbox_config_filename = @"most-restrictive"; break; case SANDBOX_TYPE_UTILITY: sandbox_config_filename = @"utility"; break; + case SANDBOX_TYPE_NACL_PLUGIN: + // The Native Client plugin is a standard renderer sandbox with some + // additional lines to support use of Unix sockets. + // TODO(msneck): Remove the use of Unix sockets from Native Client and + // then remove the associated rules from chrome/renderer/renderer.sb. + // See http://code.google.com/p/nativeclient/issues/detail?id=344 + sandbox_config_filename = @"renderer"; + allow_nacl_lines = true; + break; + case SANDBOX_TYPE_NACL_LOADER: + // The Native Client loader is the most-restrictive sandbox with some + // additional lines to support use of Unix sockets. + // TODO(msneck): Remove the use of Unix sockets from Native Client and + // then remove the associated rules from + // chrome/browser/most-restrictive.sb. + // See http://code.google.com/p/nativeclient/issues/detail?id=344 + sandbox_config_filename = @"most-restrictive"; + allow_nacl_lines = true; + break; default: NOTREACHED(); return false; @@ -288,6 +314,13 @@ bool EnableSandbox(SandboxProcessType sandbox_type, withString:@""]; } + // Enable Native Client lines if they are allowed. + if (allow_nacl_lines) { + sandbox_data = [sandbox_data + stringByReplacingOccurrencesOfString:@";NACL" + withString:@""]; + } + if (!allowed_dir.empty()) { // The sandbox only understands "real" paths. This resolving step is // needed so the caller doesn't need to worry about things like /var @@ -341,6 +374,11 @@ bool EnableSandbox(SandboxProcessType sandbox_type, sandbox_data = [sandbox_data stringByReplacingOccurrencesOfString:@"USER_HOMEDIR" withString:home_dir_escaped_ns]; + } else { + // Sandbox rules only for versions before 10.6. + sandbox_data = [sandbox_data + stringByReplacingOccurrencesOfString:@";BEFORE_10.6" + withString:@""]; } char* error_buff = NULL; diff --git a/chrome/renderer/renderer.sb b/chrome/renderer/renderer.sb index 27b2a90c..57fa479 100644 --- a/chrome/renderer/renderer.sb +++ b/chrome/renderer/renderer.sb @@ -32,8 +32,20 @@ (allow mach-lookup (global-name "com.apple.FontObjectsServer")) ; 10.5.6 ;10.6_ONLY (allow mach-lookup (global-name "com.apple.FontServer")) ; 10.6 -; USER_HOMEDIR is substitued at runtime - http://crbug.com/11269 +; USER_HOMEDIR is substitued at runtime - http://crbug.com/11269 ;10.6_ONLY (allow file-read-data (subpath "USER_HOMEDIR/Library/Fonts")) ; 10.6 ; Needed for IPC on 10.6 ;10.6_ONLY (allow ipc-posix-shm) + +; Needed for the Native Client plugin and loader. These lines are enabled +; if and only if --internal-nacl (or --enable-nacl) are used (and they +; are off by default.) +; TODO(msneck): Refactor Native Client to use something other than Unix +; sockets. Then change the code in chrome/common/sandbox_mac.mm which +; deals with the ";NACL" prefix. +; See http://code.google.com/p/nativeclient/issues/detail?id=344 +;NACL;BEFORE_10.6 (allow network-inbound (from unix-socket)) +;NACL;BEFORE_10.6 (allow network-outbound (to unix-socket)) +;NACL;10.6_ONLY (allow network-inbound (regex #"^(/private)?/tmp/nacl-")) +;NACL;10.6_ONLY (allow network-outbound (regex #"^(/private)?/tmp/nacl-")) diff --git a/chrome/test/nacl/nacl_test.cc b/chrome/test/nacl/nacl_test.cc index 1560484..6038310 100644 --- a/chrome/test/nacl/nacl_test.cc +++ b/chrome/test/nacl/nacl_test.cc @@ -57,9 +57,6 @@ const FilePath::CharType kServerHtmlFileName[] = NaClTest::NaClTest() : UITest() { launch_arguments_.AppendSwitch(switches::kEnableNaCl); -#if defined(OS_MACOSX) - launch_arguments_.AppendSwitch(switches::kNoSandbox); -#endif } NaClTest::~NaClTest() {} -- cgit v1.1