Home | History | Annotate | Download | only in zygote 
      1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
      2 // Use of this source code is governed by a BSD-style license that can be
      3 // found in the LICENSE file.
      4 
      5 #include "components/nacl/zygote/nacl_fork_delegate_linux.h"
      6 
      7 #include <signal.h>
      8 #include <stdlib.h>
      9 #include <sys/resource.h>
     10 #include <sys/socket.h>
     11 
     12 #include <set>
     13 
     14 #include "base/basictypes.h"
     15 #include "base/command_line.h"
     16 #include "base/cpu.h"
     17 #include "base/files/file_path.h"
     18 #include "base/files/scoped_file.h"
     19 #include "base/logging.h"
     20 #include "base/memory/scoped_ptr.h"
     21 #include "base/memory/scoped_vector.h"
     22 #include "base/path_service.h"
     23 #include "base/pickle.h"
     24 #include "base/posix/eintr_wrapper.h"
     25 #include "base/posix/global_descriptors.h"
     26 #include "base/posix/unix_domain_socket_linux.h"
     27 #include "base/process/kill.h"
     28 #include "base/process/launch.h"
     29 #include "base/strings/string_split.h"
     30 #include "base/third_party/dynamic_annotations/dynamic_annotations.h"
     31 #include "build/build_config.h"
     32 #include "components/nacl/common/nacl_nonsfi_util.h"
     33 #include "components/nacl/common/nacl_paths.h"
     34 #include "components/nacl/common/nacl_switches.h"
     35 #include "components/nacl/loader/nacl_helper_linux.h"
     36 #include "content/public/common/content_descriptors.h"
     37 #include "content/public/common/content_switches.h"
     38 #include "sandbox/linux/suid/client/setuid_sandbox_client.h"
     39 #include "sandbox/linux/suid/common/sandbox.h"
     40 
     41 namespace {
     42 
     43 // Note these need to match up with their counterparts in nacl_helper_linux.c
     44 // and nacl_helper_bootstrap_linux.c.
     45 const char kNaClHelperReservedAtZero[] =
     46     "--reserved_at_zero=0xXXXXXXXXXXXXXXXX";
     47 const char kNaClHelperRDebug[] = "--r_debug=0xXXXXXXXXXXXXXXXX";
     48 
     49 // This is an environment variable which controls which (if any) other
     50 // environment variables are passed through to NaCl processes.  e.g.,
     51 // NACL_ENV_PASSTHROUGH="PATH,CWD" would pass both $PATH and $CWD to the child
     52 // process.
     53 const char kNaClEnvPassthrough[] = "NACL_ENV_PASSTHROUGH";
     54 char kNaClEnvPassthroughDelimiter = ',';
     55 
     56 // The following environment variables are always passed through if they exist
     57 // in the parent process.
     58 const char kNaClExeStderr[] = "NACL_EXE_STDERR";
     59 const char kNaClExeStdout[] = "NACL_EXE_STDOUT";
     60 const char kNaClVerbosity[] = "NACLVERBOSITY";
     61 
     62 #if defined(ARCH_CPU_X86)
     63 bool NonZeroSegmentBaseIsSlow() {
     64   base::CPU cpuid;
     65   // Using a non-zero segment base is known to be very slow on Intel
     66   // Atom CPUs.  See "Segmentation-based Memory Protection Mechanism
     67   // on Intel Atom Microarchitecture: Coding Optimizations" (Leonardo
     68   // Potenza, Intel).
     69   //
     70   // The following list of CPU model numbers is taken from:
     71   // "Intel 64 and IA-32 Architectures Software Developer's Manual"
     72   // (http://download.intel.com/products/processor/manual/325462.pdf),
     73   // "Table 35-1. CPUID Signature Values of DisplayFamily_DisplayModel"
     74   // (Volume 3C, 35-1), which contains:
     75   //   "06_36H - Intel Atom S Processor Family
     76   //    06_1CH, 06_26H, 06_27H, 06_35, 06_36 - Intel Atom Processor Family"
     77   if (cpuid.family() == 6) {
     78     switch (cpuid.model()) {
     79       case 0x1c:
     80       case 0x26:
     81       case 0x27:
     82       case 0x35:
     83       case 0x36:
     84         return true;
     85     }
     86   }
     87   return false;
     88 }
     89 #endif
     90 
     91 // Send an IPC request on |ipc_channel|. The request is contained in
     92 // |request_pickle| and can have file descriptors attached in |attached_fds|.
     93 // |reply_data_buffer| must be allocated by the caller and will contain the
     94 // reply. The size of the reply will be written to |reply_size|.
     95 // This code assumes that only one thread can write to |ipc_channel| to make
     96 // requests.
     97 bool SendIPCRequestAndReadReply(int ipc_channel,
     98                                 const std::vector<int>& attached_fds,
     99                                 const Pickle& request_pickle,
    100                                 char* reply_data_buffer,
    101                                 size_t reply_data_buffer_size,
    102                                 ssize_t* reply_size) {
    103   DCHECK_LE(static_cast<size_t>(kNaClMaxIPCMessageLength),
    104             reply_data_buffer_size);
    105   DCHECK(reply_size);
    106 
    107   if (!UnixDomainSocket::SendMsg(ipc_channel, request_pickle.data(),
    108                                  request_pickle.size(), attached_fds)) {
    109     LOG(ERROR) << "SendIPCRequestAndReadReply: SendMsg failed";
    110     return false;
    111   }
    112 
    113   // Then read the remote reply.
    114   ScopedVector<base::ScopedFD> received_fds;
    115   const ssize_t msg_len =
    116       UnixDomainSocket::RecvMsg(ipc_channel, reply_data_buffer,
    117                                 reply_data_buffer_size, &received_fds);
    118   if (msg_len <= 0) {
    119     LOG(ERROR) << "SendIPCRequestAndReadReply: RecvMsg failed";
    120     return false;
    121   }
    122   *reply_size = msg_len;
    123   return true;
    124 }
    125 
    126 }  // namespace.
    127 
    128 namespace nacl {
    129 
    130 void AddNaClZygoteForkDelegates(
    131     ScopedVector<content::ZygoteForkDelegate>* delegates) {
    132   delegates->push_back(new NaClForkDelegate(false /* nonsfi_mode */));
    133   delegates->push_back(new NaClForkDelegate(true /* nonsfi_mode */));
    134 }
    135 
    136 NaClForkDelegate::NaClForkDelegate(bool nonsfi_mode)
    137     : nonsfi_mode_(nonsfi_mode), status_(kNaClHelperUnused), fd_(-1) {
    138 }
    139 
    140 void NaClForkDelegate::Init(const int sandboxdesc,
    141                             const bool enable_layer1_sandbox) {
    142   VLOG(1) << "NaClForkDelegate::Init()";
    143 
    144   // Only launch the non-SFI helper process if non-SFI mode is enabled.
    145   if (nonsfi_mode_ && !IsNonSFIModeEnabled()) {
    146     return;
    147   }
    148 
    149   scoped_ptr<sandbox::SetuidSandboxClient> setuid_sandbox_client(
    150       sandbox::SetuidSandboxClient::Create());
    151 
    152   // For communications between the NaCl loader process and
    153   // the SUID sandbox.
    154   int nacl_sandbox_descriptor =
    155       base::GlobalDescriptors::kBaseDescriptor + kSandboxIPCChannel;
    156   // Confirm a hard-wired assumption.
    157   DCHECK_EQ(sandboxdesc, nacl_sandbox_descriptor);
    158 
    159   int fds[2];
    160   PCHECK(0 == socketpair(PF_UNIX, SOCK_SEQPACKET, 0, fds));
    161   base::FileHandleMappingVector fds_to_map;
    162   fds_to_map.push_back(std::make_pair(fds[1], kNaClZygoteDescriptor));
    163   fds_to_map.push_back(std::make_pair(sandboxdesc, nacl_sandbox_descriptor));
    164 
    165   bool use_nacl_bootstrap = false;
    166   // For non-SFI mode, we do not use fixed address space.
    167   if (!nonsfi_mode_) {
    168     // Using nacl_helper_bootstrap is not necessary on x86-64 because
    169     // NaCl's x86-64 sandbox is not zero-address-based.  Starting
    170     // nacl_helper through nacl_helper_bootstrap works on x86-64, but it
    171     // leaves nacl_helper_bootstrap mapped at a fixed address at the
    172     // bottom of the address space, which is undesirable because it
    173     // effectively defeats ASLR.
    174 #if defined(ARCH_CPU_X86_64)
    175     use_nacl_bootstrap = false;
    176 #elif defined(ARCH_CPU_X86)
    177     // Performance vs. security trade-off: We prefer using a
    178     // non-zero-address-based sandbox on x86-32 because it provides some
    179     // ASLR and so is more secure.  However, on Atom CPUs, using a
    180     // non-zero segment base is very slow, so we use a zero-based
    181     // sandbox on those.
    182     use_nacl_bootstrap = NonZeroSegmentBaseIsSlow();
    183 #else
    184     use_nacl_bootstrap = true;
    185 #endif
    186   }
    187 
    188   status_ = kNaClHelperUnused;
    189   base::FilePath helper_exe;
    190   base::FilePath helper_bootstrap_exe;
    191   if (!PathService::Get(nacl::FILE_NACL_HELPER, &helper_exe)) {
    192     status_ = kNaClHelperMissing;
    193   } else if (use_nacl_bootstrap &&
    194              !PathService::Get(nacl::FILE_NACL_HELPER_BOOTSTRAP,
    195                                &helper_bootstrap_exe)) {
    196     status_ = kNaClHelperBootstrapMissing;
    197   } else if (RunningOnValgrind()) {
    198     status_ = kNaClHelperValgrind;
    199   } else {
    200     CommandLine::StringVector argv_to_launch;
    201     {
    202       CommandLine cmd_line(CommandLine::NO_PROGRAM);
    203       if (use_nacl_bootstrap)
    204         cmd_line.SetProgram(helper_bootstrap_exe);
    205       else
    206         cmd_line.SetProgram(helper_exe);
    207 
    208       // Append any switches that need to be forwarded to the NaCl helper.
    209       static const char* kForwardSwitches[] = {
    210         switches::kDisableSeccompFilterSandbox,
    211         switches::kNaClDangerousNoSandboxNonSfi,
    212         switches::kNoSandbox,
    213       };
    214       const CommandLine& current_cmd_line = *CommandLine::ForCurrentProcess();
    215       cmd_line.CopySwitchesFrom(current_cmd_line, kForwardSwitches,
    216                                 arraysize(kForwardSwitches));
    217 
    218       // The command line needs to be tightly controlled to use
    219       // |helper_bootstrap_exe|. So from now on, argv_to_launch should be
    220       // modified directly.
    221       argv_to_launch = cmd_line.argv();
    222     }
    223     if (use_nacl_bootstrap) {
    224       // Arguments to the bootstrap helper which need to be at the start
    225       // of the command line, right after the helper's path.
    226       CommandLine::StringVector bootstrap_prepend;
    227       bootstrap_prepend.push_back(helper_exe.value());
    228       bootstrap_prepend.push_back(kNaClHelperReservedAtZero);
    229       bootstrap_prepend.push_back(kNaClHelperRDebug);
    230       argv_to_launch.insert(argv_to_launch.begin() + 1,
    231                             bootstrap_prepend.begin(),
    232                             bootstrap_prepend.end());
    233     }
    234 
    235     base::LaunchOptions options;
    236 
    237     base::ScopedFD dummy_fd;
    238     if (enable_layer1_sandbox) {
    239       // NaCl needs to keep tight control of the cmd_line, so prepend the
    240       // setuid sandbox wrapper manually.
    241       base::FilePath sandbox_path =
    242           setuid_sandbox_client->GetSandboxBinaryPath();
    243       argv_to_launch.insert(argv_to_launch.begin(), sandbox_path.value());
    244       setuid_sandbox_client->SetupLaunchOptions(
    245           &options, &fds_to_map, &dummy_fd);
    246       setuid_sandbox_client->SetupLaunchEnvironment();
    247     }
    248 
    249     options.fds_to_remap = &fds_to_map;
    250 
    251     // The NaCl processes spawned may need to exceed the ambient soft limit
    252     // on RLIMIT_AS to allocate the untrusted address space and its guard
    253     // regions.  The nacl_helper itself cannot just raise its own limit,
    254     // because the existing limit may prevent the initial exec of
    255     // nacl_helper_bootstrap from succeeding, with its large address space
    256     // reservation.
    257     std::vector<int> max_these_limits;
    258     max_these_limits.push_back(RLIMIT_AS);
    259     options.maximize_rlimits = &max_these_limits;
    260 
    261     // To avoid information leaks in Non-SFI mode, clear the environment for
    262     // the NaCl Helper process.
    263     options.clear_environ = true;
    264     AddPassthroughEnvToOptions(&options);
    265 
    266     if (!base::LaunchProcess(argv_to_launch, options, NULL))
    267       status_ = kNaClHelperLaunchFailed;
    268     // parent and error cases are handled below
    269 
    270     if (enable_layer1_sandbox) {
    271       // Sanity check that dummy_fd was kept alive for LaunchProcess.
    272       DCHECK(dummy_fd.is_valid());
    273     }
    274   }
    275   if (IGNORE_EINTR(close(fds[1])) != 0)
    276     LOG(ERROR) << "close(fds[1]) failed";
    277   if (status_ == kNaClHelperUnused) {
    278     const ssize_t kExpectedLength = strlen(kNaClHelperStartupAck);
    279     char buf[kExpectedLength];
    280 
    281     // Wait for ack from nacl_helper, indicating it is ready to help
    282     const ssize_t nread = HANDLE_EINTR(read(fds[0], buf, sizeof(buf)));
    283     if (nread == kExpectedLength &&
    284         memcmp(buf, kNaClHelperStartupAck, nread) == 0) {
    285       // all is well
    286       status_ = kNaClHelperSuccess;
    287       fd_ = fds[0];
    288       return;
    289     }
    290 
    291     status_ = kNaClHelperAckFailed;
    292     LOG(ERROR) << "Bad NaCl helper startup ack (" << nread << " bytes)";
    293   }
    294   // TODO(bradchen): Make this LOG(ERROR) when the NaCl helper
    295   // becomes the default.
    296   fd_ = -1;
    297   if (IGNORE_EINTR(close(fds[0])) != 0)
    298     LOG(ERROR) << "close(fds[0]) failed";
    299 }
    300 
    301 void NaClForkDelegate::InitialUMA(std::string* uma_name,
    302                                   int* uma_sample,
    303                                   int* uma_boundary_value) {
    304   *uma_name = nonsfi_mode_ ? "NaCl.Client.HelperNonSFI.InitState"
    305                            : "NaCl.Client.Helper.InitState";
    306   *uma_sample = status_;
    307   *uma_boundary_value = kNaClHelperStatusBoundary;
    308 }
    309 
    310 NaClForkDelegate::~NaClForkDelegate() {
    311   // side effect of close: delegate process will terminate
    312   if (status_ == kNaClHelperSuccess) {
    313     if (IGNORE_EINTR(close(fd_)) != 0)
    314       LOG(ERROR) << "close(fd_) failed";
    315   }
    316 }
    317 
    318 bool NaClForkDelegate::CanHelp(const std::string& process_type,
    319                                std::string* uma_name,
    320                                int* uma_sample,
    321                                int* uma_boundary_value) {
    322   // We can only help with a specific process type depending on nonsfi_mode_.
    323   const char* helpable_process_type = nonsfi_mode_
    324                                           ? switches::kNaClLoaderNonSfiProcess
    325                                           : switches::kNaClLoaderProcess;
    326   if (process_type != helpable_process_type)
    327     return false;
    328   *uma_name = nonsfi_mode_ ? "NaCl.Client.HelperNonSFI.StateOnFork"
    329                            : "NaCl.Client.Helper.StateOnFork";
    330   *uma_sample = status_;
    331   *uma_boundary_value = kNaClHelperStatusBoundary;
    332   return true;
    333 }
    334 
    335 pid_t NaClForkDelegate::Fork(const std::string& process_type,
    336                              const std::vector<int>& fds,
    337                              const std::string& channel_id) {
    338   VLOG(1) << "NaClForkDelegate::Fork";
    339 
    340   DCHECK(fds.size() == kNumPassedFDs);
    341 
    342   if (status_ != kNaClHelperSuccess) {
    343     LOG(ERROR) << "Cannot launch NaCl process: nacl_helper failed to start";
    344     return -1;
    345   }
    346 
    347   // First, send a remote fork request.
    348   Pickle write_pickle;
    349   write_pickle.WriteInt(nacl::kNaClForkRequest);
    350   // TODO(hamaji): When we split the helper binary for non-SFI mode
    351   // from nacl_helper, stop sending this information.
    352   write_pickle.WriteBool(nonsfi_mode_);
    353   write_pickle.WriteString(channel_id);
    354 
    355   char reply_buf[kNaClMaxIPCMessageLength];
    356   ssize_t reply_size = 0;
    357   bool got_reply =
    358       SendIPCRequestAndReadReply(fd_, fds, write_pickle,
    359                                  reply_buf, sizeof(reply_buf), &reply_size);
    360   if (!got_reply) {
    361     LOG(ERROR) << "Could not perform remote fork.";
    362     return -1;
    363   }
    364 
    365   // Now see if the other end managed to fork.
    366   Pickle reply_pickle(reply_buf, reply_size);
    367   PickleIterator iter(reply_pickle);
    368   pid_t nacl_child;
    369   if (!iter.ReadInt(&nacl_child)) {
    370     LOG(ERROR) << "NaClForkDelegate::Fork: pickle failed";
    371     return -1;
    372   }
    373   VLOG(1) << "nacl_child is " << nacl_child;
    374   return nacl_child;
    375 }
    376 
    377 bool NaClForkDelegate::GetTerminationStatus(pid_t pid, bool known_dead,
    378                                             base::TerminationStatus* status,
    379                                             int* exit_code) {
    380   VLOG(1) << "NaClForkDelegate::GetTerminationStatus";
    381   DCHECK(status);
    382   DCHECK(exit_code);
    383 
    384   Pickle write_pickle;
    385   write_pickle.WriteInt(nacl::kNaClGetTerminationStatusRequest);
    386   write_pickle.WriteInt(pid);
    387   write_pickle.WriteBool(known_dead);
    388 
    389   const std::vector<int> empty_fds;
    390   char reply_buf[kNaClMaxIPCMessageLength];
    391   ssize_t reply_size = 0;
    392   bool got_reply =
    393       SendIPCRequestAndReadReply(fd_, empty_fds, write_pickle,
    394                                  reply_buf, sizeof(reply_buf), &reply_size);
    395   if (!got_reply) {
    396     LOG(ERROR) << "Could not perform remote GetTerminationStatus.";
    397     return false;
    398   }
    399 
    400   Pickle reply_pickle(reply_buf, reply_size);
    401   PickleIterator iter(reply_pickle);
    402   int termination_status;
    403   if (!iter.ReadInt(&termination_status) ||
    404       termination_status < 0 ||
    405       termination_status >= base::TERMINATION_STATUS_MAX_ENUM) {
    406     LOG(ERROR) << "GetTerminationStatus: pickle failed";
    407     return false;
    408   }
    409 
    410   int remote_exit_code;
    411   if (!iter.ReadInt(&remote_exit_code)) {
    412     LOG(ERROR) << "GetTerminationStatus: pickle failed";
    413     return false;
    414   }
    415 
    416   *status = static_cast<base::TerminationStatus>(termination_status);
    417   *exit_code = remote_exit_code;
    418   return true;
    419 }
    420 
    421 // static
    422 void NaClForkDelegate::AddPassthroughEnvToOptions(
    423     base::LaunchOptions* options) {
    424   scoped_ptr<base::Environment> env(base::Environment::Create());
    425   std::string pass_through_string;
    426   std::vector<std::string> pass_through_vars;
    427   if (env->GetVar(kNaClEnvPassthrough, &pass_through_string)) {
    428     base::SplitString(
    429         pass_through_string, kNaClEnvPassthroughDelimiter, &pass_through_vars);
    430   }
    431   pass_through_vars.push_back(kNaClExeStderr);
    432   pass_through_vars.push_back(kNaClExeStdout);
    433   pass_through_vars.push_back(kNaClVerbosity);
    434   pass_through_vars.push_back(sandbox::kSandboxEnvironmentApiRequest);
    435   for (size_t i = 0; i < pass_through_vars.size(); ++i) {
    436     std::string temp;
    437     if (env->GetVar(pass_through_vars[i].c_str(), &temp))
    438       options->environ[pass_through_vars[i]] = temp;
    439   }
    440 }
    441 
    442 }  // namespace nacl
    443