1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. 2 // Use of this source code is governed by a BSD-style license that can be 3 // found in the LICENSE file. 4 5 #include "sandbox/linux/services/broker_process.h" 6 7 #include <fcntl.h> 8 #include <signal.h> 9 #include <sys/socket.h> 10 #include <sys/stat.h> 11 #include <sys/syscall.h> 12 #include <sys/types.h> 13 #include <sys/wait.h> 14 #include <unistd.h> 15 16 #include <algorithm> 17 #include <string> 18 #include <vector> 19 20 #include "base/basictypes.h" 21 #include "base/callback.h" 22 #include "base/compiler_specific.h" 23 #include "base/files/scoped_file.h" 24 #include "base/logging.h" 25 #include "base/memory/scoped_vector.h" 26 #include "base/pickle.h" 27 #include "base/posix/eintr_wrapper.h" 28 #include "base/posix/unix_domain_socket_linux.h" 29 #include "base/process/process_metrics.h" 30 #include "base/third_party/valgrind/valgrind.h" 31 #include "build/build_config.h" 32 #include "sandbox/linux/services/linux_syscalls.h" 33 34 #if defined(OS_ANDROID) && !defined(MSG_CMSG_CLOEXEC) 35 #define MSG_CMSG_CLOEXEC 0x40000000 36 #endif 37 38 namespace { 39 40 bool IsRunningOnValgrind() { return RUNNING_ON_VALGRIND; } 41 42 // A little open(2) wrapper to handle some oddities for us. In the general case 43 // make a direct system call since we want to keep in control of the broker 44 // process' system calls profile to be able to loosely sandbox it. 45 int sys_open(const char* pathname, int flags) { 46 // Always pass a defined |mode| in case flags mistakenly contains O_CREAT. 47 const int mode = 0; 48 if (IsRunningOnValgrind()) { 49 // Valgrind does not support AT_FDCWD, just use libc's open() in this case. 50 return open(pathname, flags, mode); 51 } else { 52 return syscall(__NR_openat, AT_FDCWD, pathname, flags, mode); 53 } 54 } 55 56 static const size_t kMaxMessageLength = 4096; 57 58 // Some flags are local to the current process and cannot be sent over a Unix 59 // socket. They need special treatment from the client. 60 // O_CLOEXEC is tricky because in theory another thread could call execve() 61 // before special treatment is made on the client, so a client needs to call 62 // recvmsg(2) with MSG_CMSG_CLOEXEC. 63 // To make things worse, there are two CLOEXEC related flags, FD_CLOEXEC (see 64 // F_GETFD in fcntl(2)) and O_CLOEXEC (see F_GETFL in fcntl(2)). O_CLOEXEC 65 // doesn't affect the semantics on execve(), it's merely a note that the 66 // descriptor was originally opened with O_CLOEXEC as a flag. And it is sent 67 // over unix sockets just fine, so a receiver that would (incorrectly) look at 68 // O_CLOEXEC instead of FD_CLOEXEC may be tricked in thinking that the file 69 // descriptor will or won't be closed on execve(). 70 static const int kCurrentProcessOpenFlagsMask = O_CLOEXEC; 71 72 // Check whether |requested_filename| is in |allowed_file_names|. 73 // See GetFileNameIfAllowedToOpen() for an explanation of |file_to_open|. 74 // async signal safe if |file_to_open| is NULL. 75 // TODO(jln): assert signal safety. 76 bool GetFileNameInWhitelist(const std::vector<std::string>& allowed_file_names, 77 const char* requested_filename, 78 const char** file_to_open) { 79 if (file_to_open && *file_to_open) { 80 // Make sure that callers never pass a non-empty string. In case callers 81 // wrongly forget to check the return value and look at the string 82 // instead, this could catch bugs. 83 RAW_LOG(FATAL, "*file_to_open should be NULL"); 84 return false; 85 } 86 87 // Look for |requested_filename| in |allowed_file_names|. 88 // We don't use ::find() because it takes a std::string and 89 // the conversion allocates memory. 90 std::vector<std::string>::const_iterator it; 91 for (it = allowed_file_names.begin(); it != allowed_file_names.end(); it++) { 92 if (strcmp(requested_filename, it->c_str()) == 0) { 93 if (file_to_open) 94 *file_to_open = it->c_str(); 95 return true; 96 } 97 } 98 return false; 99 } 100 101 // We maintain a list of flags that have been reviewed for "sanity" and that 102 // we're ok to allow in the broker. 103 // I.e. here is where we wouldn't add O_RESET_FILE_SYSTEM. 104 bool IsAllowedOpenFlags(int flags) { 105 // First, check the access mode. 106 const int access_mode = flags & O_ACCMODE; 107 if (access_mode != O_RDONLY && access_mode != O_WRONLY && 108 access_mode != O_RDWR) { 109 return false; 110 } 111 112 // We only support a 2-parameters open, so we forbid O_CREAT. 113 if (flags & O_CREAT) { 114 return false; 115 } 116 117 // Some flags affect the behavior of the current process. We don't support 118 // them and don't allow them for now. 119 if (flags & kCurrentProcessOpenFlagsMask) 120 return false; 121 122 // Now check that all the flags are known to us. 123 const int creation_and_status_flags = flags & ~O_ACCMODE; 124 125 const int known_flags = 126 O_APPEND | O_ASYNC | O_CLOEXEC | O_CREAT | O_DIRECT | 127 O_DIRECTORY | O_EXCL | O_LARGEFILE | O_NOATIME | O_NOCTTY | 128 O_NOFOLLOW | O_NONBLOCK | O_NDELAY | O_SYNC | O_TRUNC; 129 130 const int unknown_flags = ~known_flags; 131 const bool has_unknown_flags = creation_and_status_flags & unknown_flags; 132 return !has_unknown_flags; 133 } 134 135 } // namespace 136 137 namespace sandbox { 138 139 BrokerProcess::BrokerProcess(int denied_errno, 140 const std::vector<std::string>& allowed_r_files, 141 const std::vector<std::string>& allowed_w_files, 142 bool fast_check_in_client, 143 bool quiet_failures_for_tests) 144 : denied_errno_(denied_errno), 145 initialized_(false), 146 is_child_(false), 147 fast_check_in_client_(fast_check_in_client), 148 quiet_failures_for_tests_(quiet_failures_for_tests), 149 broker_pid_(-1), 150 allowed_r_files_(allowed_r_files), 151 allowed_w_files_(allowed_w_files), 152 ipc_socketpair_(-1) { 153 } 154 155 BrokerProcess::~BrokerProcess() { 156 if (initialized_ && ipc_socketpair_ != -1) { 157 // Closing the socket should be enough to notify the child to die, 158 // unless it has been duplicated. 159 PCHECK(0 == IGNORE_EINTR(close(ipc_socketpair_))); 160 PCHECK(0 == kill(broker_pid_, SIGKILL)); 161 siginfo_t process_info; 162 // Reap the child. 163 int ret = HANDLE_EINTR(waitid(P_PID, broker_pid_, &process_info, WEXITED)); 164 PCHECK(0 == ret); 165 } 166 } 167 168 bool BrokerProcess::Init( 169 const base::Callback<bool(void)>& broker_process_init_callback) { 170 CHECK(!initialized_); 171 int socket_pair[2]; 172 // Use SOCK_SEQPACKET, because we need to preserve message boundaries 173 // but we also want to be notified (recvmsg should return and not block) 174 // when the connection has been broken (one of the processes died). 175 if (socketpair(AF_UNIX, SOCK_SEQPACKET, 0, socket_pair)) { 176 LOG(ERROR) << "Failed to create socketpair"; 177 return false; 178 } 179 180 #if !defined(THREAD_SANITIZER) 181 DCHECK_EQ(1, base::GetNumberOfThreads(base::GetCurrentProcessHandle())); 182 #endif 183 int child_pid = fork(); 184 if (child_pid == -1) { 185 close(socket_pair[0]); 186 close(socket_pair[1]); 187 return false; 188 } 189 if (child_pid) { 190 // We are the parent and we have just forked our broker process. 191 close(socket_pair[0]); 192 // We should only be able to write to the IPC channel. We'll always send 193 // a new file descriptor to receive the reply on. 194 shutdown(socket_pair[1], SHUT_RD); 195 ipc_socketpair_ = socket_pair[1]; 196 is_child_ = false; 197 broker_pid_ = child_pid; 198 initialized_ = true; 199 return true; 200 } else { 201 // We are the broker. 202 close(socket_pair[1]); 203 // We should only be able to read from this IPC channel. We will send our 204 // replies on a new file descriptor attached to the requests. 205 shutdown(socket_pair[0], SHUT_WR); 206 ipc_socketpair_ = socket_pair[0]; 207 is_child_ = true; 208 CHECK(broker_process_init_callback.Run()); 209 initialized_ = true; 210 for (;;) { 211 HandleRequest(); 212 } 213 _exit(1); 214 } 215 NOTREACHED(); 216 } 217 218 int BrokerProcess::Access(const char* pathname, int mode) const { 219 return PathAndFlagsSyscall(kCommandAccess, pathname, mode); 220 } 221 222 int BrokerProcess::Open(const char* pathname, int flags) const { 223 return PathAndFlagsSyscall(kCommandOpen, pathname, flags); 224 } 225 226 // Make a remote system call over IPC for syscalls that take a path and flags 227 // as arguments, currently open() and access(). 228 // Will return -errno like a real system call. 229 // This function needs to be async signal safe. 230 int BrokerProcess::PathAndFlagsSyscall(enum IPCCommands syscall_type, 231 const char* pathname, int flags) const { 232 int recvmsg_flags = 0; 233 RAW_CHECK(initialized_); // async signal safe CHECK(). 234 RAW_CHECK(syscall_type == kCommandOpen || syscall_type == kCommandAccess); 235 if (!pathname) 236 return -EFAULT; 237 238 // For this "remote system call" to work, we need to handle any flag that 239 // cannot be sent over a Unix socket in a special way. 240 // See the comments around kCurrentProcessOpenFlagsMask. 241 if (syscall_type == kCommandOpen && (flags & kCurrentProcessOpenFlagsMask)) { 242 // This implementation only knows about O_CLOEXEC, someone needs to look at 243 // this code if other flags are added. 244 RAW_CHECK(kCurrentProcessOpenFlagsMask == O_CLOEXEC); 245 recvmsg_flags |= MSG_CMSG_CLOEXEC; 246 flags &= ~O_CLOEXEC; 247 } 248 249 // There is no point in forwarding a request that we know will be denied. 250 // Of course, the real security check needs to be on the other side of the 251 // IPC. 252 if (fast_check_in_client_) { 253 if (syscall_type == kCommandOpen && 254 !GetFileNameIfAllowedToOpen(pathname, flags, NULL)) { 255 return -denied_errno_; 256 } 257 if (syscall_type == kCommandAccess && 258 !GetFileNameIfAllowedToAccess(pathname, flags, NULL)) { 259 return -denied_errno_; 260 } 261 } 262 263 Pickle write_pickle; 264 write_pickle.WriteInt(syscall_type); 265 write_pickle.WriteString(pathname); 266 write_pickle.WriteInt(flags); 267 RAW_CHECK(write_pickle.size() <= kMaxMessageLength); 268 269 int returned_fd = -1; 270 uint8_t reply_buf[kMaxMessageLength]; 271 272 // Send a request (in write_pickle) as well that will include a new 273 // temporary socketpair (created internally by SendRecvMsg()). 274 // Then read the reply on this new socketpair in reply_buf and put an 275 // eventual attached file descriptor in |returned_fd|. 276 ssize_t msg_len = UnixDomainSocket::SendRecvMsgWithFlags(ipc_socketpair_, 277 reply_buf, 278 sizeof(reply_buf), 279 recvmsg_flags, 280 &returned_fd, 281 write_pickle); 282 if (msg_len <= 0) { 283 if (!quiet_failures_for_tests_) 284 RAW_LOG(ERROR, "Could not make request to broker process"); 285 return -ENOMEM; 286 } 287 288 Pickle read_pickle(reinterpret_cast<char*>(reply_buf), msg_len); 289 PickleIterator iter(read_pickle); 290 int return_value = -1; 291 // Now deserialize the return value and eventually return the file 292 // descriptor. 293 if (read_pickle.ReadInt(&iter, &return_value)) { 294 switch (syscall_type) { 295 case kCommandAccess: 296 // We should never have a fd to return. 297 RAW_CHECK(returned_fd == -1); 298 return return_value; 299 case kCommandOpen: 300 if (return_value < 0) { 301 RAW_CHECK(returned_fd == -1); 302 return return_value; 303 } else { 304 // We have a real file descriptor to return. 305 RAW_CHECK(returned_fd >= 0); 306 return returned_fd; 307 } 308 default: 309 RAW_LOG(ERROR, "Unsupported command"); 310 return -ENOSYS; 311 } 312 } else { 313 RAW_LOG(ERROR, "Could not read pickle"); 314 NOTREACHED(); 315 return -ENOMEM; 316 } 317 } 318 319 // Handle a request on the IPC channel ipc_socketpair_. 320 // A request should have a file descriptor attached on which we will reply and 321 // that we will then close. 322 // A request should start with an int that will be used as the command type. 323 bool BrokerProcess::HandleRequest() const { 324 ScopedVector<base::ScopedFD> fds; 325 char buf[kMaxMessageLength]; 326 errno = 0; 327 const ssize_t msg_len = UnixDomainSocket::RecvMsg(ipc_socketpair_, buf, 328 sizeof(buf), &fds); 329 330 if (msg_len == 0 || (msg_len == -1 && errno == ECONNRESET)) { 331 // EOF from our parent, or our parent died, we should die. 332 _exit(0); 333 } 334 335 // The parent should send exactly one file descriptor, on which we 336 // will write the reply. 337 // TODO(mdempsky): ScopedVector doesn't have 'at()', only 'operator[]'. 338 if (msg_len < 0 || fds.size() != 1 || fds[0]->get() < 0) { 339 PLOG(ERROR) << "Error reading message from the client"; 340 return false; 341 } 342 343 base::ScopedFD temporary_ipc(fds[0]->Pass()); 344 345 Pickle pickle(buf, msg_len); 346 PickleIterator iter(pickle); 347 int command_type; 348 if (pickle.ReadInt(&iter, &command_type)) { 349 bool r = false; 350 // Go through all the possible IPC messages. 351 switch (command_type) { 352 case kCommandAccess: 353 case kCommandOpen: 354 // We reply on the file descriptor sent to us via the IPC channel. 355 r = HandleRemoteCommand(static_cast<IPCCommands>(command_type), 356 temporary_ipc.get(), pickle, iter); 357 break; 358 default: 359 NOTREACHED(); 360 r = false; 361 break; 362 } 363 return r; 364 } 365 366 LOG(ERROR) << "Error parsing IPC request"; 367 return false; 368 } 369 370 // Handle a |command_type| request contained in |read_pickle| and send the reply 371 // on |reply_ipc|. 372 // Currently kCommandOpen and kCommandAccess are supported. 373 bool BrokerProcess::HandleRemoteCommand(IPCCommands command_type, int reply_ipc, 374 const Pickle& read_pickle, 375 PickleIterator iter) const { 376 // Currently all commands have two arguments: filename and flags. 377 std::string requested_filename; 378 int flags = 0; 379 if (!read_pickle.ReadString(&iter, &requested_filename) || 380 !read_pickle.ReadInt(&iter, &flags)) { 381 return -1; 382 } 383 384 Pickle write_pickle; 385 std::vector<int> opened_files; 386 387 switch (command_type) { 388 case kCommandAccess: 389 AccessFileForIPC(requested_filename, flags, &write_pickle); 390 break; 391 case kCommandOpen: 392 OpenFileForIPC(requested_filename, flags, &write_pickle, &opened_files); 393 break; 394 default: 395 LOG(ERROR) << "Invalid IPC command"; 396 break; 397 } 398 399 CHECK_LE(write_pickle.size(), kMaxMessageLength); 400 ssize_t sent = UnixDomainSocket::SendMsg(reply_ipc, write_pickle.data(), 401 write_pickle.size(), opened_files); 402 403 // Close anything we have opened in this process. 404 for (std::vector<int>::iterator it = opened_files.begin(); 405 it != opened_files.end(); ++it) { 406 int ret = IGNORE_EINTR(close(*it)); 407 DCHECK(!ret) << "Could not close file descriptor"; 408 } 409 410 if (sent <= 0) { 411 LOG(ERROR) << "Could not send IPC reply"; 412 return false; 413 } 414 return true; 415 } 416 417 // Perform access(2) on |requested_filename| with mode |mode| if allowed by our 418 // policy. Write the syscall return value (-errno) to |write_pickle|. 419 void BrokerProcess::AccessFileForIPC(const std::string& requested_filename, 420 int mode, Pickle* write_pickle) const { 421 DCHECK(write_pickle); 422 const char* file_to_access = NULL; 423 const bool safe_to_access_file = GetFileNameIfAllowedToAccess( 424 requested_filename.c_str(), mode, &file_to_access); 425 426 if (safe_to_access_file) { 427 CHECK(file_to_access); 428 int access_ret = access(file_to_access, mode); 429 int access_errno = errno; 430 if (!access_ret) 431 write_pickle->WriteInt(0); 432 else 433 write_pickle->WriteInt(-access_errno); 434 } else { 435 write_pickle->WriteInt(-denied_errno_); 436 } 437 } 438 439 // Open |requested_filename| with |flags| if allowed by our policy. 440 // Write the syscall return value (-errno) to |write_pickle| and append 441 // a file descriptor to |opened_files| if relevant. 442 void BrokerProcess::OpenFileForIPC(const std::string& requested_filename, 443 int flags, Pickle* write_pickle, 444 std::vector<int>* opened_files) const { 445 DCHECK(write_pickle); 446 DCHECK(opened_files); 447 const char* file_to_open = NULL; 448 const bool safe_to_open_file = GetFileNameIfAllowedToOpen( 449 requested_filename.c_str(), flags, &file_to_open); 450 451 if (safe_to_open_file) { 452 CHECK(file_to_open); 453 int opened_fd = sys_open(file_to_open, flags); 454 if (opened_fd < 0) { 455 write_pickle->WriteInt(-errno); 456 } else { 457 // Success. 458 opened_files->push_back(opened_fd); 459 write_pickle->WriteInt(0); 460 } 461 } else { 462 write_pickle->WriteInt(-denied_errno_); 463 } 464 } 465 466 467 // Check if calling access() should be allowed on |requested_filename| with 468 // mode |requested_mode|. 469 // Note: access() being a system call to check permissions, this can get a bit 470 // confusing. We're checking if calling access() should even be allowed with 471 // the same policy we would use for open(). 472 // If |file_to_access| is not NULL, we will return the matching pointer from 473 // the whitelist. For paranoia a caller should then use |file_to_access|. See 474 // GetFileNameIfAllowedToOpen() fore more explanation. 475 // return true if calling access() on this file should be allowed, false 476 // otherwise. 477 // Async signal safe if and only if |file_to_access| is NULL. 478 bool BrokerProcess::GetFileNameIfAllowedToAccess(const char* requested_filename, 479 int requested_mode, const char** file_to_access) const { 480 // First, check if |requested_mode| is existence, ability to read or ability 481 // to write. We do not support X_OK. 482 if (requested_mode != F_OK && 483 requested_mode & ~(R_OK | W_OK)) { 484 return false; 485 } 486 switch (requested_mode) { 487 case F_OK: 488 // We allow to check for file existence if we can either read or write. 489 return GetFileNameInWhitelist(allowed_r_files_, requested_filename, 490 file_to_access) || 491 GetFileNameInWhitelist(allowed_w_files_, requested_filename, 492 file_to_access); 493 case R_OK: 494 return GetFileNameInWhitelist(allowed_r_files_, requested_filename, 495 file_to_access); 496 case W_OK: 497 return GetFileNameInWhitelist(allowed_w_files_, requested_filename, 498 file_to_access); 499 case R_OK | W_OK: 500 { 501 bool allowed_for_read_and_write = 502 GetFileNameInWhitelist(allowed_r_files_, requested_filename, NULL) && 503 GetFileNameInWhitelist(allowed_w_files_, requested_filename, 504 file_to_access); 505 return allowed_for_read_and_write; 506 } 507 default: 508 return false; 509 } 510 } 511 512 // Check if |requested_filename| can be opened with flags |requested_flags|. 513 // If |file_to_open| is not NULL, we will return the matching pointer from the 514 // whitelist. For paranoia, a caller should then use |file_to_open| rather 515 // than |requested_filename|, so that it never attempts to open an 516 // attacker-controlled file name, even if an attacker managed to fool the 517 // string comparison mechanism. 518 // Return true if opening should be allowed, false otherwise. 519 // Async signal safe if and only if |file_to_open| is NULL. 520 bool BrokerProcess::GetFileNameIfAllowedToOpen(const char* requested_filename, 521 int requested_flags, const char** file_to_open) const { 522 if (!IsAllowedOpenFlags(requested_flags)) { 523 return false; 524 } 525 switch (requested_flags & O_ACCMODE) { 526 case O_RDONLY: 527 return GetFileNameInWhitelist(allowed_r_files_, requested_filename, 528 file_to_open); 529 case O_WRONLY: 530 return GetFileNameInWhitelist(allowed_w_files_, requested_filename, 531 file_to_open); 532 case O_RDWR: 533 { 534 bool allowed_for_read_and_write = 535 GetFileNameInWhitelist(allowed_r_files_, requested_filename, NULL) && 536 GetFileNameInWhitelist(allowed_w_files_, requested_filename, 537 file_to_open); 538 return allowed_for_read_and_write; 539 } 540 default: 541 return false; 542 } 543 } 544 545 } // namespace sandbox. 546
