Elly Fong-Jones | d9a16cd | 2012-11-12 16:09:49 -0500 | [diff] [blame] | 1 | // Copyright (c) 2012 The Chromium OS Authors. All rights reserved. |
| 2 | // Use of this source code is governed by a BSD-style license that can be |
| 3 | // found in the LICENSE file. |
| 4 | |
Alex Vakulenko | 262be3f | 2014-07-30 15:25:50 -0700 | [diff] [blame] | 5 | #include "debugd/src/sandboxed_process.h" |
Elly Fong-Jones | d9a16cd | 2012-11-12 16:09:49 -0500 | [diff] [blame] | 6 | |
Ben Chan | 297c3c2 | 2013-07-17 17:34:12 -0700 | [diff] [blame] | 7 | #include <base/strings/stringprintf.h> |
| 8 | |
Elly Fong-Jones | d9a16cd | 2012-11-12 16:09:49 -0500 | [diff] [blame] | 9 | namespace debugd { |
| 10 | |
Elly Fong-Jones | 215b562 | 2013-03-20 14:32:18 -0400 | [diff] [blame] | 11 | const char *SandboxedProcess::kDefaultUser = "debugd"; |
| 12 | const char *SandboxedProcess::kDefaultGroup = "debugd"; |
| 13 | |
Elly Fong-Jones | d9a16cd | 2012-11-12 16:09:49 -0500 | [diff] [blame] | 14 | SandboxedProcess::SandboxedProcess() |
Jorge Lucangeli Obes | c99a12a | 2014-09-17 16:43:40 -0700 | [diff] [blame] | 15 | : sandboxing_(true), |
| 16 | access_root_mount_ns_(false), |
| 17 | user_(kDefaultUser), |
| 18 | group_(kDefaultGroup) { |
| 19 | } |
Elly Fong-Jones | d9a16cd | 2012-11-12 16:09:49 -0500 | [diff] [blame] | 20 | |
Ben Chan | 297c3c2 | 2013-07-17 17:34:12 -0700 | [diff] [blame] | 21 | // static |
| 22 | bool SandboxedProcess::GetHelperPath(const std::string& relative_path, |
| 23 | std::string* full_path) { |
| 24 | // This environment variable controls the root directory for debugd helpers, |
| 25 | // which lets people develop helpers even when verified boot is on. |
| 26 | const char* helpers_dir = getenv("DEBUGD_HELPERS"); |
| 27 | std::string path = base::StringPrintf( |
| 28 | "%s/%s", |
| 29 | helpers_dir ? helpers_dir : "/usr/libexec/debugd/helpers", |
| 30 | relative_path.c_str()); |
| 31 | |
| 32 | if (path.length() > PATH_MAX) |
| 33 | return false; |
| 34 | |
| 35 | *full_path = path; |
| 36 | return true; |
| 37 | } |
| 38 | |
Elly Fong-Jones | d9a16cd | 2012-11-12 16:09:49 -0500 | [diff] [blame] | 39 | bool SandboxedProcess::Init() { |
| 40 | const char *kMiniJail = "/sbin/minijail0"; |
Jorge Lucangeli Obes | 623f8ca | 2014-09-18 10:50:06 -0700 | [diff] [blame] | 41 | |
| 42 | AddArg(kMiniJail); |
| 43 | // Enter a new mount namespace. This is done for every process to avoid |
| 44 | // affecting the original mount namespace. |
| 45 | AddArg("-v"); |
| 46 | |
Elly Fong-Jones | d9a16cd | 2012-11-12 16:09:49 -0500 | [diff] [blame] | 47 | if (sandboxing_) { |
| 48 | if (user_.empty() || group_.empty()) |
| 49 | return false; |
Jorge Lucangeli Obes | c99a12a | 2014-09-17 16:43:40 -0700 | [diff] [blame] | 50 | |
Elly Fong-Jones | e56a8f6 | 2013-01-23 15:50:21 -0500 | [diff] [blame] | 51 | if (user_ != "root") { |
| 52 | AddArg("-u"); |
| 53 | AddArg(user_); |
| 54 | } |
| 55 | if (group_ != "root") { |
| 56 | AddArg("-g"); |
| 57 | AddArg(group_); |
| 58 | } |
Elly Fong-Jones | d9a16cd | 2012-11-12 16:09:49 -0500 | [diff] [blame] | 59 | } |
Jorge Lucangeli Obes | 623f8ca | 2014-09-18 10:50:06 -0700 | [diff] [blame] | 60 | |
| 61 | if (access_root_mount_ns_) { |
| 62 | // Enter root mount namespace. |
| 63 | AddStringOption("-V", "/proc/1/ns/mnt"); |
| 64 | } |
| 65 | |
| 66 | AddArg("--"); |
| 67 | |
Elly Fong-Jones | d9a16cd | 2012-11-12 16:09:49 -0500 | [diff] [blame] | 68 | return true; |
| 69 | } |
| 70 | |
| 71 | void SandboxedProcess::DisableSandbox() { |
| 72 | sandboxing_ = false; |
| 73 | } |
| 74 | |
| 75 | void SandboxedProcess::SandboxAs(const std::string& user, |
| 76 | const std::string& group) { |
| 77 | sandboxing_ = true; |
| 78 | user_ = user; |
| 79 | group_ = group; |
| 80 | } |
| 81 | |
Jorge Lucangeli Obes | c99a12a | 2014-09-17 16:43:40 -0700 | [diff] [blame] | 82 | void SandboxedProcess::AllowAccessRootMountNamespace() { |
| 83 | access_root_mount_ns_ = true; |
| 84 | } |
| 85 | |
Ben Chan | a0011d8 | 2014-05-13 00:19:29 -0700 | [diff] [blame] | 86 | } // namespace debugd |