1 // Copyright 2013 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
5 // A mini-zygote specifically for Native Client.
7 #include "components/nacl/loader/nacl_helper_linux.h"
15 #include <sys/socket.h>
17 #include <sys/types.h>
22 #include "base/at_exit.h"
23 #include "base/command_line.h"
24 #include "base/files/scoped_file.h"
25 #include "base/logging.h"
26 #include "base/memory/scoped_ptr.h"
27 #include "base/memory/scoped_vector.h"
28 #include "base/message_loop/message_loop.h"
29 #include "base/posix/eintr_wrapper.h"
30 #include "base/posix/global_descriptors.h"
31 #include "base/posix/unix_domain_socket_linux.h"
32 #include "base/process/kill.h"
33 #include "base/process/process_handle.h"
34 #include "base/rand_util.h"
35 #include "components/nacl/common/nacl_switches.h"
36 #include "components/nacl/loader/nacl_listener.h"
37 #include "components/nacl/loader/nonsfi/irt_exception_handling.h"
38 #include "components/nacl/loader/sandbox_linux/nacl_sandbox_linux.h"
39 #include "content/public/common/child_process_sandbox_support_linux.h"
40 #include "content/public/common/content_descriptors.h"
41 #include "content/public/common/zygote_fork_delegate_linux.h"
42 #include "crypto/nss_util.h"
43 #include "ipc/ipc_descriptors.h"
44 #include "ipc/ipc_switches.h"
45 #include "sandbox/linux/services/libc_urandom_override.h"
49 struct NaClLoaderSystemInfo {
50 size_t prereserved_sandbox_size;
54 // Replace |file_descriptor| with the reading end of a closed pipe.
55 void ReplaceFDWithDummy(int file_descriptor) {
56 // Make sure that file_descriptor is an open descriptor.
57 PCHECK(-1 != fcntl(file_descriptor, F_GETFD, 0));
59 PCHECK(0 == pipe(pipefd));
60 PCHECK(-1 != dup2(pipefd[0], file_descriptor));
61 PCHECK(0 == IGNORE_EINTR(close(pipefd[0])));
62 PCHECK(0 == IGNORE_EINTR(close(pipefd[1])));
65 // The child must mimic the behavior of zygote_main_linux.cc on the child
66 // side of the fork. See zygote_main_linux.cc:HandleForkRequest from
68 void BecomeNaClLoader(base::ScopedFD browser_fd,
69 const NaClLoaderSystemInfo& system_info,
70 bool uses_nonsfi_mode,
71 nacl::NaClSandbox* nacl_sandbox) {
73 VLOG(1) << "NaCl loader: setting up IPC descriptor";
74 // Close or shutdown IPC channels that we don't need anymore.
75 PCHECK(0 == IGNORE_EINTR(close(kNaClZygoteDescriptor)));
76 // In Non-SFI mode, it's important to close any non-expected IPC channels.
77 if (uses_nonsfi_mode) {
78 // The low-level kSandboxIPCChannel is used by renderers and NaCl for
79 // various operations. See the LinuxSandbox::METHOD_* methods. NaCl uses
80 // LinuxSandbox::METHOD_MAKE_SHARED_MEMORY_SEGMENT in SFI mode, so this
81 // should only be closed in Non-SFI mode.
82 // This file descriptor is insidiously used by a number of APIs. Closing it
83 // could lead to difficult to debug issues. Instead of closing it, replace
85 const int sandbox_ipc_channel =
86 base::GlobalDescriptors::kBaseDescriptor + kSandboxIPCChannel;
88 ReplaceFDWithDummy(sandbox_ipc_channel);
90 // Install crash signal handlers before disallowing system calls.
91 nacl::nonsfi::InitializeSignalHandler();
94 // Always ignore SIGPIPE, for consistency with other Chrome processes and
95 // because some IPC code, such as sync_socket_posix.cc, requires this.
96 // We do this before seccomp-bpf is initialized.
97 PCHECK(signal(SIGPIPE, SIG_IGN) != SIG_ERR);
99 // Finish layer-1 sandbox initialization and initialize the layer-2 sandbox.
100 CHECK(!nacl_sandbox->HasOpenDirectory());
101 nacl_sandbox->InitializeLayerTwoSandbox(uses_nonsfi_mode);
102 nacl_sandbox->SealLayerOneSandbox();
103 nacl_sandbox->CheckSandboxingStateWithPolicy();
105 base::GlobalDescriptors::GetInstance()->Set(kPrimaryIPCChannel,
106 browser_fd.release());
108 base::MessageLoopForIO main_message_loop;
109 NaClListener listener;
110 listener.set_uses_nonsfi_mode(uses_nonsfi_mode);
111 listener.set_prereserved_sandbox_size(system_info.prereserved_sandbox_size);
112 listener.set_number_of_cores(system_info.number_of_cores);
117 // Start the NaCl loader in a child created by the NaCl loader Zygote.
118 void ChildNaClLoaderInit(ScopedVector<base::ScopedFD> child_fds,
119 const NaClLoaderSystemInfo& system_info,
120 bool uses_nonsfi_mode,
121 nacl::NaClSandbox* nacl_sandbox,
122 const std::string& channel_id) {
123 DCHECK(child_fds.size() >
124 std::max(content::ZygoteForkDelegate::kPIDOracleFDIndex,
125 content::ZygoteForkDelegate::kBrowserFDIndex));
127 // Ping the PID oracle socket.
128 CHECK(content::SendZygoteChildPing(
129 child_fds[content::ZygoteForkDelegate::kPIDOracleFDIndex]->get()));
131 CommandLine::ForCurrentProcess()->AppendSwitchASCII(
132 switches::kProcessChannelID, channel_id);
134 // Save the browser socket and close the rest.
135 base::ScopedFD browser_fd(
136 child_fds[content::ZygoteForkDelegate::kBrowserFDIndex]->Pass());
140 browser_fd.Pass(), system_info, uses_nonsfi_mode, nacl_sandbox);
144 // Handle a fork request from the Zygote.
145 // Some of this code was lifted from
146 // content/browser/zygote_main_linux.cc:ForkWithRealPid()
147 bool HandleForkRequest(ScopedVector<base::ScopedFD> child_fds,
148 const NaClLoaderSystemInfo& system_info,
149 nacl::NaClSandbox* nacl_sandbox,
150 PickleIterator* input_iter,
151 Pickle* output_pickle) {
152 bool uses_nonsfi_mode;
153 if (!input_iter->ReadBool(&uses_nonsfi_mode)) {
154 LOG(ERROR) << "Could not read uses_nonsfi_mode status";
158 std::string channel_id;
159 if (!input_iter->ReadString(&channel_id)) {
160 LOG(ERROR) << "Could not read channel_id string";
164 if (content::ZygoteForkDelegate::kNumPassedFDs != child_fds.size()) {
165 LOG(ERROR) << "nacl_helper: unexpected number of fds, got "
170 VLOG(1) << "nacl_helper: forking";
171 pid_t child_pid = fork();
173 PLOG(ERROR) << "*** fork() failed.";
176 if (child_pid == 0) {
177 ChildNaClLoaderInit(child_fds.Pass(),
186 // First, close the dummy_fd so the sandbox won't find me when
187 // looking for the child's pid in /proc. Also close other fds.
189 VLOG(1) << "nacl_helper: child_pid is " << child_pid;
191 // Now send child_pid (eventually -1 if fork failed) to the Chrome Zygote.
192 output_pickle->WriteInt(child_pid);
196 bool HandleGetTerminationStatusRequest(PickleIterator* input_iter,
197 Pickle* output_pickle) {
199 if (!input_iter->ReadInt(&child_to_wait)) {
200 LOG(ERROR) << "Could not read pid to wait for";
205 if (!input_iter->ReadBool(&known_dead)) {
206 LOG(ERROR) << "Could not read known_dead status";
209 // TODO(jln): With NaCl, known_dead seems to never be set to true (unless
210 // called from the Zygote's kZygoteCommandReap command). This means that we
211 // will sometimes detect the process as still running when it's not. Fix
215 base::TerminationStatus status;
217 status = base::GetKnownDeadTerminationStatus(child_to_wait, &exit_code);
219 status = base::GetTerminationStatus(child_to_wait, &exit_code);
220 output_pickle->WriteInt(static_cast<int>(status));
221 output_pickle->WriteInt(exit_code);
225 // Honor a command |command_type|. Eventual command parameters are
226 // available in |input_iter| and eventual file descriptors attached to
227 // the command are in |attached_fds|.
228 // Reply to the command on |reply_fds|.
229 bool HonorRequestAndReply(int reply_fd,
231 ScopedVector<base::ScopedFD> attached_fds,
232 const NaClLoaderSystemInfo& system_info,
233 nacl::NaClSandbox* nacl_sandbox,
234 PickleIterator* input_iter) {
236 bool have_to_reply = false;
237 // Commands must write anything to send back to |write_pickle|.
238 switch (command_type) {
239 case nacl::kNaClForkRequest:
240 have_to_reply = HandleForkRequest(attached_fds.Pass(),
246 case nacl::kNaClGetTerminationStatusRequest:
248 HandleGetTerminationStatusRequest(input_iter, &write_pickle);
251 LOG(ERROR) << "Unsupported command from Zygote";
256 const std::vector<int> empty; // We never send file descriptors back.
257 if (!UnixDomainSocket::SendMsg(reply_fd, write_pickle.data(),
258 write_pickle.size(), empty)) {
259 LOG(ERROR) << "*** send() to zygote failed";
265 // Read a request from the Zygote from |zygote_ipc_fd| and handle it.
266 // Die on EOF from |zygote_ipc_fd|.
267 bool HandleZygoteRequest(int zygote_ipc_fd,
268 const NaClLoaderSystemInfo& system_info,
269 nacl::NaClSandbox* nacl_sandbox) {
270 ScopedVector<base::ScopedFD> fds;
271 char buf[kNaClMaxIPCMessageLength];
272 const ssize_t msglen = UnixDomainSocket::RecvMsg(zygote_ipc_fd,
273 &buf, sizeof(buf), &fds);
274 // If the Zygote has started handling requests, we should be sandboxed via
275 // the setuid sandbox.
276 if (!nacl_sandbox->layer_one_enabled()) {
277 LOG(ERROR) << "NaCl helper process running without a sandbox!\n"
278 << "Most likely you need to configure your SUID sandbox "
281 if (msglen == 0 || (msglen == -1 && errno == ECONNRESET)) {
282 // EOF from the browser. Goodbye!
286 PLOG(ERROR) << "nacl_helper: receive from zygote failed";
290 Pickle read_pickle(buf, msglen);
291 PickleIterator read_iter(read_pickle);
293 if (!read_iter.ReadInt(&command_type)) {
294 LOG(ERROR) << "Unable to read command from Zygote";
297 return HonorRequestAndReply(zygote_ipc_fd,
305 static const char kNaClHelperReservedAtZero[] = "reserved_at_zero";
306 static const char kNaClHelperRDebug[] = "r_debug";
308 // Since we were started by nacl_helper_bootstrap rather than in the
309 // usual way, the debugger cannot figure out where our executable
310 // or the dynamic linker or the shared libraries are in memory,
311 // so it won't find any symbols. But we can fake it out to find us.
313 // The zygote passes --r_debug=0xXXXXXXXXXXXXXXXX.
314 // nacl_helper_bootstrap replaces the Xs with the address of its _r_debug
315 // structure. The debugger will look for that symbol by name to
316 // discover the addresses of key dynamic linker data structures.
317 // Since all it knows about is the original main executable, which
318 // is the bootstrap program, it finds the symbol defined there. The
319 // dynamic linker's structure is somewhere else, but it is filled in
320 // after initialization. The parts that really matter to the
321 // debugger never change. So we just copy the contents of the
322 // dynamic linker's structure into the address provided by the option.
323 // Hereafter, if someone attaches a debugger (or examines a core dump),
324 // the debugger will find all the symbols in the normal way.
325 static void CheckRDebug(char* argv0) {
326 std::string r_debug_switch_value =
327 CommandLine::ForCurrentProcess()->GetSwitchValueASCII(kNaClHelperRDebug);
328 if (!r_debug_switch_value.empty()) {
330 uintptr_t r_debug_addr = strtoul(r_debug_switch_value.c_str(), &endp, 0);
331 if (r_debug_addr != 0 && *endp == '\0') {
332 r_debug* bootstrap_r_debug = reinterpret_cast<r_debug*>(r_debug_addr);
333 *bootstrap_r_debug = _r_debug;
335 // Since the main executable (the bootstrap program) does not
336 // have a dynamic section, the debugger will not skip the
337 // first element of the link_map list as it usually would for
338 // an executable or PIE that was loaded normally. But the
339 // dynamic linker has set l_name for the PIE to "" as is
340 // normal for the main executable. So the debugger doesn't
341 // know which file it is. Fill in the actual file name, which
342 // came in as our argv[0].
343 link_map* l = _r_debug.r_map;
344 if (l->l_name[0] == '\0')
350 // The zygote passes --reserved_at_zero=0xXXXXXXXXXXXXXXXX.
351 // nacl_helper_bootstrap replaces the Xs with the amount of prereserved
354 // CheckReservedAtZero parses the value of the argument reserved_at_zero
355 // and returns the amount of prereserved sandbox memory.
356 static size_t CheckReservedAtZero() {
357 size_t prereserved_sandbox_size = 0;
358 std::string reserved_at_zero_switch_value =
359 CommandLine::ForCurrentProcess()->GetSwitchValueASCII(
360 kNaClHelperReservedAtZero);
361 if (!reserved_at_zero_switch_value.empty()) {
363 prereserved_sandbox_size =
364 strtoul(reserved_at_zero_switch_value.c_str(), &endp, 0);
366 LOG(ERROR) << "Could not parse reserved_at_zero argument value of "
367 << reserved_at_zero_switch_value;
369 return prereserved_sandbox_size;
374 #if defined(ADDRESS_SANITIZER)
375 // Do not install the SIGSEGV handler in ASan. This should make the NaCl
376 // platform qualification test pass.
377 static const char kAsanDefaultOptionsNaCl[] = "handle_segv=0";
379 // Override the default ASan options for the NaCl helper.
380 // __asan_default_options should not be instrumented, because it is called
381 // before ASan is initialized.
383 __attribute__((no_sanitize_address))
384 // The function isn't referenced from the executable itself. Make sure it isn't
385 // stripped by the linker.
386 __attribute__((used))
387 __attribute__((visibility("default")))
388 const char* __asan_default_options() {
389 return kAsanDefaultOptionsNaCl;
393 int main(int argc, char* argv[]) {
394 CommandLine::Init(argc, argv);
395 base::AtExitManager exit_manager;
396 base::RandUint64(); // acquire /dev/urandom fd before sandbox is raised
397 // Allows NSS to fopen() /dev/urandom.
398 sandbox::InitLibcUrandomOverrides();
400 // Configure NSS for use inside the NaCl process.
401 // The fork check has not caused problems for NaCl, but this appears to be
402 // best practice (see other places LoadNSSLibraries is called.)
403 crypto::DisableNSSForkCheck();
404 // Without this line on Linux, HMAC::Init will instantiate a singleton that
405 // in turn attempts to open a file. Disabling this behavior avoids a ~70 ms
406 // stall the first time HMAC is used.
407 crypto::ForceNSSNoDBInit();
408 // Load shared libraries before sandbox is raised.
409 // NSS is needed to perform hashing for validation caching.
410 crypto::LoadNSSLibraries();
412 const NaClLoaderSystemInfo system_info = {
413 CheckReservedAtZero(),
414 sysconf(_SC_NPROCESSORS_ONLN)
417 CheckRDebug(argv[0]);
419 scoped_ptr<nacl::NaClSandbox> nacl_sandbox(new nacl::NaClSandbox);
420 // Make sure that the early initialization did not start any spurious
422 #if !defined(THREAD_SANITIZER)
423 CHECK(nacl_sandbox->IsSingleThreaded());
426 const bool is_init_process = 1 == getpid();
427 nacl_sandbox->InitializeLayerOneSandbox();
428 CHECK_EQ(is_init_process, nacl_sandbox->layer_one_enabled());
430 const std::vector<int> empty;
431 // Send the zygote a message to let it know we are ready to help
432 if (!UnixDomainSocket::SendMsg(kNaClZygoteDescriptor,
433 kNaClHelperStartupAck,
434 sizeof(kNaClHelperStartupAck), empty)) {
435 LOG(ERROR) << "*** send() to zygote failed";
438 // Now handle requests from the Zygote.
440 bool request_handled = HandleZygoteRequest(
441 kNaClZygoteDescriptor, system_info, nacl_sandbox.get());
442 // Do not turn this into a CHECK() without thinking about robustness
443 // against malicious IPC requests.
444 DCHECK(request_handled);