mirror of
https://github.com/google/sandboxed-api.git
synced 2024-03-22 13:11:30 +08:00
Automated rollback of commit 4b018757c3
.
PiperOrigin-RevId: 395067992 Change-Id: I5db335ed881aa81748a0fc8082091b160fe83e86
This commit is contained in:
parent
4b018757c3
commit
2036f5b2f0
|
@ -388,7 +388,6 @@ cc_library(
|
|||
"//sandboxed_api/util:strerror",
|
||||
"@com_google_absl//absl/base:core_headers",
|
||||
"@com_google_absl//absl/container:flat_hash_set",
|
||||
"@com_google_absl//absl/status",
|
||||
"@com_google_absl//absl/status:statusor",
|
||||
"@com_google_absl//absl/strings",
|
||||
"@com_google_glog//:glog",
|
||||
|
@ -775,7 +774,6 @@ cc_test(
|
|||
"//sandboxed_api:testing",
|
||||
"//sandboxed_api/sandbox2/util:bpf_helper",
|
||||
"//sandboxed_api/util:status_matchers",
|
||||
"@com_google_absl//absl/container:flat_hash_set",
|
||||
"@com_google_absl//absl/memory",
|
||||
"@com_google_absl//absl/strings",
|
||||
"@com_google_googletest//:gtest_main",
|
||||
|
|
|
@ -556,13 +556,11 @@ void ForkServer::CreateInitialNamespaces() {
|
|||
void ForkServer::SanitizeEnvironment() {
|
||||
// Mark all file descriptors, except the standard ones (needed
|
||||
// for proper sandboxed process operations), as close-on-exec.
|
||||
absl::Status status = sanitizer::SanitizeCurrentProcess(
|
||||
SAPI_RAW_CHECK(sanitizer::SanitizeCurrentProcess(
|
||||
{STDIN_FILENO, STDOUT_FILENO, STDERR_FILENO,
|
||||
Comms::kSandbox2ClientCommsFD},
|
||||
/* close_fds = */ false);
|
||||
SAPI_RAW_CHECK(
|
||||
status.ok(),
|
||||
absl::StrCat("while sanitizing process: ", status.message()).c_str());
|
||||
/* close_fds = */ false),
|
||||
"while sanitizing process");
|
||||
}
|
||||
|
||||
void ForkServer::ExecuteProcess(int execve_fd, const char** argv,
|
||||
|
|
|
@ -32,13 +32,9 @@ int main() {
|
|||
google::LogToStderr();
|
||||
|
||||
// Close all non-essential FDs to keep newly opened FD numbers consistent.
|
||||
absl::Status status = sandbox2::sanitizer::CloseAllFDsExcept(
|
||||
sandbox2::sanitizer::CloseAllFDsExcept(
|
||||
{0, 1, 2, sandbox2::Comms::kSandbox2ClientCommsFD});
|
||||
|
||||
if (!status.ok()) {
|
||||
SAPI_RAW_LOG(WARNING, "Closing non-essential FDs failed");
|
||||
}
|
||||
|
||||
// Make the process' name easily recognizable with ps/pstree.
|
||||
if (prctl(PR_SET_NAME, "S2-FORK-SERV", 0, 0, 0) != 0) {
|
||||
SAPI_RAW_PLOG(WARNING, "prctl(PR_SET_NAME, 'S2-FORK-SERV')");
|
||||
|
|
|
@ -44,7 +44,6 @@
|
|||
|
||||
#include <glog/logging.h>
|
||||
#include "absl/cleanup/cleanup.h"
|
||||
#include "absl/container/flat_hash_set.h"
|
||||
#include "sandboxed_api/util/flag.h"
|
||||
#include "absl/memory/memory.h"
|
||||
#include "absl/status/status.h"
|
||||
|
@ -642,12 +641,9 @@ bool Monitor::InitPtraceAttach() {
|
|||
sanitizer::WaitForTsan();
|
||||
|
||||
// Get a list of tasks.
|
||||
absl::flat_hash_set<int> tasks;
|
||||
if (auto task_list = sanitizer::GetListOfTasks(pid_); task_list.ok()) {
|
||||
tasks = *std::move(task_list);
|
||||
} else {
|
||||
LOG(ERROR) << "Could not get list of tasks: "
|
||||
<< task_list.status().message();
|
||||
std::set<int> tasks;
|
||||
if (!sanitizer::GetListOfTasks(pid_, &tasks)) {
|
||||
LOG(ERROR) << "Could not get list of tasks";
|
||||
return false;
|
||||
}
|
||||
|
||||
|
@ -666,13 +662,13 @@ bool Monitor::InitPtraceAttach() {
|
|||
<< ".";
|
||||
}
|
||||
|
||||
absl::flat_hash_set<int> tasks_attached;
|
||||
std::set<int> tasks_attached;
|
||||
int retries = 0;
|
||||
absl::Time deadline = absl::Now() + absl::Seconds(2);
|
||||
|
||||
// In some situations we allow ptrace to try again when it fails.
|
||||
while (!tasks.empty()) {
|
||||
absl::flat_hash_set<int> tasks_left;
|
||||
std::set<int> tasks_left;
|
||||
for (int task : tasks) {
|
||||
constexpr intptr_t options =
|
||||
PTRACE_O_TRACESYSGOOD | PTRACE_O_TRACEFORK | PTRACE_O_TRACEVFORK |
|
||||
|
@ -723,11 +719,8 @@ bool Monitor::InitPtraceAttach() {
|
|||
}
|
||||
|
||||
// Get a list of tasks after attaching.
|
||||
if (auto tasks_list = sanitizer::GetListOfTasks(pid_); tasks_list.ok()) {
|
||||
tasks = *std::move(tasks_list);
|
||||
} else {
|
||||
LOG(ERROR) << "Could not get list of tasks: "
|
||||
<< tasks_list.status().message();
|
||||
if (!sanitizer::GetListOfTasks(pid_, &tasks)) {
|
||||
LOG(ERROR) << "Could not get list of tasks";
|
||||
return false;
|
||||
}
|
||||
|
||||
|
|
|
@ -42,7 +42,6 @@
|
|||
#include "sandboxed_api/sandbox2/util.h"
|
||||
#include "sandboxed_api/util/file_helpers.h"
|
||||
#include "sandboxed_api/util/fileops.h"
|
||||
#include "sandboxed_api/util/os_error.h"
|
||||
#include "sandboxed_api/util/raw_logging.h"
|
||||
#include "sandboxed_api/util/status_macros.h"
|
||||
#include "sandboxed_api/util/strerror.h"
|
||||
|
@ -92,29 +91,41 @@ absl::StatusOr<absl::flat_hash_set<int>> GetListOfFDs() {
|
|||
return fds;
|
||||
}
|
||||
|
||||
absl::StatusOr<absl::flat_hash_set<int>> GetListOfTasks(int pid) {
|
||||
bool GetListOfTasks(int pid, std::set<int>* tasks) {
|
||||
const std::string task_dir = absl::StrCat("/proc/", pid, "/task");
|
||||
return ListNumericalDirectoryEntries(task_dir);
|
||||
auto task_entries = ListNumericalDirectoryEntries(task_dir);
|
||||
if (!task_entries.ok()) {
|
||||
return false;
|
||||
}
|
||||
|
||||
absl::Status CloseAllFDsExcept(const absl::flat_hash_set<int>& fd_exceptions) {
|
||||
SAPI_ASSIGN_OR_RETURN(absl::flat_hash_set<int> fds, GetListOfFDs());
|
||||
tasks->clear();
|
||||
tasks->insert(task_entries->begin(), task_entries->end());
|
||||
return true;
|
||||
}
|
||||
|
||||
for (const auto& fd : fds) {
|
||||
bool CloseAllFDsExcept(const std::set<int>& fd_exceptions) {
|
||||
absl::StatusOr<absl::flat_hash_set<int>> fds = GetListOfFDs();
|
||||
if (!fds.ok()) {
|
||||
return false;
|
||||
}
|
||||
|
||||
for (auto fd : *fds) {
|
||||
if (fd_exceptions.find(fd) != fd_exceptions.end()) {
|
||||
continue;
|
||||
}
|
||||
SAPI_RAW_VLOG(2, "Closing FD:%d", fd);
|
||||
close(fd);
|
||||
}
|
||||
return absl::OkStatus();
|
||||
return true;
|
||||
}
|
||||
|
||||
absl::Status MarkAllFDsAsCOEExcept(
|
||||
const absl::flat_hash_set<int>& fd_exceptions) {
|
||||
SAPI_ASSIGN_OR_RETURN(absl::flat_hash_set<int> fds, GetListOfFDs());
|
||||
bool MarkAllFDsAsCOEExcept(const std::set<int>& fd_exceptions) {
|
||||
auto fds = GetListOfFDs();
|
||||
if (!fds.ok()) {
|
||||
return false;
|
||||
}
|
||||
|
||||
for (const auto& fd : fds) {
|
||||
for (auto fd : *fds) {
|
||||
if (fd_exceptions.find(fd) != fd_exceptions.end()) {
|
||||
continue;
|
||||
}
|
||||
|
@ -123,16 +134,17 @@ absl::Status MarkAllFDsAsCOEExcept(
|
|||
|
||||
int flags = fcntl(fd, F_GETFD);
|
||||
if (flags == -1) {
|
||||
return absl::InternalError(
|
||||
sapi::OsErrorMessage(errno, "fcntl(", fd, ", F_GETFD) failed"));
|
||||
SAPI_RAW_PLOG(ERROR, "fcntl(%d, F_GETFD) failed", fd);
|
||||
return false;
|
||||
}
|
||||
if (fcntl(fd, F_SETFD, flags | FD_CLOEXEC) == -1) {
|
||||
return absl::InternalError(sapi::OsErrorMessage(
|
||||
errno, "fcntl(", fd, ", F_SETFD, ", flags, " | FD_CLOEXEC) failed"));
|
||||
SAPI_RAW_PLOG(ERROR, "fcntl(%d, F_SETFD, %x | FD_CLOEXEC) failed", fd,
|
||||
flags);
|
||||
return false;
|
||||
}
|
||||
}
|
||||
|
||||
return absl::OkStatus();
|
||||
return true;
|
||||
}
|
||||
|
||||
int GetNumberOfThreads(int pid) {
|
||||
|
@ -168,8 +180,8 @@ void WaitForTsan() {
|
|||
#endif
|
||||
}
|
||||
|
||||
absl::Status SanitizeCurrentProcess(
|
||||
const absl::flat_hash_set<int>& fd_exceptions, bool close_fds) {
|
||||
bool SanitizeCurrentProcess(const std::set<int>& fd_exceptions,
|
||||
bool close_fds) {
|
||||
SAPI_RAW_VLOG(1, "Sanitizing PID: %zu, close_fds: %d", syscall(__NR_getpid),
|
||||
close_fds);
|
||||
|
||||
|
@ -178,13 +190,23 @@ absl::Status SanitizeCurrentProcess(
|
|||
|
||||
// If the parent goes down, so should we.
|
||||
if (prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0) != 0) {
|
||||
return absl::InternalError(
|
||||
sapi::OsErrorMessage(errno, "prctl(PR_SET_PDEATHSIG, SIGKILL) failed"));
|
||||
SAPI_RAW_PLOG(ERROR, "prctl(PR_SET_PDEATHSIG, SIGKILL) failed");
|
||||
return false;
|
||||
}
|
||||
|
||||
// Close or mark as close-on-exec open file descriptors.
|
||||
return close_fds ? CloseAllFDsExcept(fd_exceptions)
|
||||
: MarkAllFDsAsCOEExcept(fd_exceptions);
|
||||
if (close_fds) {
|
||||
if (!CloseAllFDsExcept(fd_exceptions)) {
|
||||
SAPI_RAW_LOG(ERROR, "Failed to close all fds");
|
||||
return false;
|
||||
}
|
||||
} else {
|
||||
if (!MarkAllFDsAsCOEExcept(fd_exceptions)) {
|
||||
SAPI_RAW_LOG(ERROR, "Failed to mark all fds as closed");
|
||||
return false;
|
||||
}
|
||||
}
|
||||
return true;
|
||||
}
|
||||
|
||||
} // namespace sandbox2::sanitizer
|
||||
|
|
|
@ -18,9 +18,10 @@
|
|||
#ifndef SANDBOXED_API_SANDBOX2_SANITIZER_H_
|
||||
#define SANDBOXED_API_SANDBOX2_SANITIZER_H_
|
||||
|
||||
#include <set>
|
||||
|
||||
#include "absl/base/macros.h"
|
||||
#include "absl/container/flat_hash_set.h"
|
||||
#include "absl/status/status.h"
|
||||
#include "absl/status/statusor.h"
|
||||
|
||||
namespace sandbox2 {
|
||||
|
@ -31,12 +32,11 @@ absl::StatusOr<absl::flat_hash_set<int>> GetListOfFDs();
|
|||
|
||||
// Closes all file descriptors in the current process except the ones in
|
||||
// fd_exceptions.
|
||||
absl::Status CloseAllFDsExcept(const absl::flat_hash_set<int>& fd_exceptions);
|
||||
bool CloseAllFDsExcept(const std::set<int>& fd_exceptions);
|
||||
|
||||
// Marks all file descriptors as close-on-exec, except the ones in
|
||||
// fd_exceptions.
|
||||
absl::Status MarkAllFDsAsCOEExcept(
|
||||
const absl::flat_hash_set<int>& fd_exceptions);
|
||||
bool MarkAllFDsAsCOEExcept(const std::set<int>& fd_exceptions);
|
||||
|
||||
// Returns the number of threads in the process 'pid'. Returns -1 in case of
|
||||
// errors.
|
||||
|
@ -53,11 +53,10 @@ void WaitForTsan();
|
|||
// Sanitizes current process (which will not execve a sandboxed binary).
|
||||
// File-descriptors in fd_exceptions will be either closed
|
||||
// (close_fds == true), or marked as close-on-exec (close_fds == false).
|
||||
absl::Status SanitizeCurrentProcess(
|
||||
const absl::flat_hash_set<int>& fd_exceptions, bool close_fds);
|
||||
bool SanitizeCurrentProcess(const std::set<int>& fd_exceptions, bool close_fds);
|
||||
|
||||
// Returns a list of tasks for a pid.
|
||||
absl::StatusOr<absl::flat_hash_set<int>> GetListOfTasks(int pid);
|
||||
bool GetListOfTasks(int pid, std::set<int>* tasks);
|
||||
|
||||
} // namespace sanitizer
|
||||
} // namespace sandbox2
|
||||
|
|
|
@ -27,7 +27,6 @@
|
|||
#include <glog/logging.h>
|
||||
#include "gmock/gmock.h"
|
||||
#include "gtest/gtest.h"
|
||||
#include "absl/container/flat_hash_set.h"
|
||||
#include "absl/memory/memory.h"
|
||||
#include "absl/strings/numbers.h"
|
||||
#include "absl/strings/str_cat.h"
|
||||
|
@ -90,13 +89,13 @@ TEST(SanitizerTest, TestMarkFDsAsCOE) {
|
|||
int null_fd = open("/dev/null", O_RDWR);
|
||||
ASSERT_THAT(null_fd, Ne(-1));
|
||||
|
||||
const absl::flat_hash_set<int> keep = {STDIN_FILENO, STDOUT_FILENO,
|
||||
STDERR_FILENO, null_fd};
|
||||
ASSERT_THAT(sanitizer::MarkAllFDsAsCOEExcept(keep), sapi::IsOk());
|
||||
const std::set<int> exceptions = {STDIN_FILENO, STDOUT_FILENO, STDERR_FILENO,
|
||||
null_fd};
|
||||
ASSERT_THAT(sanitizer::MarkAllFDsAsCOEExcept(exceptions), IsTrue());
|
||||
|
||||
const std::string path = GetTestSourcePath("sandbox2/testcases/sanitizer");
|
||||
std::vector<std::string> args;
|
||||
for (auto fd : keep) {
|
||||
for (auto fd : exceptions) {
|
||||
args.push_back(absl::StrCat(fd));
|
||||
}
|
||||
ASSERT_THAT(RunTestcase(path, args), Eq(0));
|
||||
|
|
Loading…
Reference in New Issue
Block a user