tts_sandbox_hook.cc 3.1 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879
  1. // Copyright 2018 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #include "chromeos/services/tts/tts_sandbox_hook.h"
  5. #include <dlfcn.h>
  6. #include <vector>
  7. #include "base/files/file_path.h"
  8. #include "base/files/file_util.h"
  9. #include "base/logging.h"
  10. #include "chromeos/services/tts/constants.h"
  11. #include "sandbox/linux/syscall_broker/broker_command.h"
  12. #include "sandbox/linux/syscall_broker/broker_file_permission.h"
  13. using sandbox::syscall_broker::BrokerFilePermission;
  14. using sandbox::syscall_broker::MakeBrokerCommandSet;
  15. namespace chromeos {
  16. namespace tts {
  17. void AddBundleFolder(std::vector<BrokerFilePermission>* permissions) {
  18. base::FilePath bundle_dir =
  19. base::FilePath(FILE_PATH_LITERAL(kLibchromettsPath))
  20. .AsEndingWithSeparator();
  21. permissions->push_back(
  22. BrokerFilePermission::ReadOnlyRecursive(bundle_dir.value()));
  23. }
  24. void AddTempDataDirectory(std::vector<BrokerFilePermission>* permissions) {
  25. // TODO: figure out read-write directory for tts.
  26. base::FilePath rw_dir = base::FilePath(FILE_PATH_LITERAL(kTempDataDirectory))
  27. .AsEndingWithSeparator();
  28. permissions->push_back(
  29. BrokerFilePermission::ReadWriteCreateRecursive(rw_dir.value()));
  30. }
  31. void AddReadOnlyFiles(std::vector<BrokerFilePermission>* permissions) {
  32. // These files are required for some syscalls e.g. get_nprocs, sysinfo.
  33. permissions->push_back(BrokerFilePermission::ReadOnly("/proc/stat"));
  34. permissions->push_back(BrokerFilePermission::ReadOnly("/proc/meminfo"));
  35. }
  36. std::vector<BrokerFilePermission> GetTtsFilePermissions() {
  37. std::vector<BrokerFilePermission> permissions;
  38. AddBundleFolder(&permissions);
  39. AddTempDataDirectory(&permissions);
  40. AddReadOnlyFiles(&permissions);
  41. return permissions;
  42. }
  43. bool TtsPreSandboxHook(sandbox::policy::SandboxLinux::Options options) {
  44. if (!dlopen(kLibchromettsPath, RTLD_LAZY))
  45. LOG(ERROR) << "Unable to open libchrometts.so: " << dlerror();
  46. // Ensure this directory is created.
  47. base::FilePath temp_data_dir(kTempDataDirectory);
  48. base::CreateDirectoryAndGetError(temp_data_dir, nullptr);
  49. auto* instance = sandbox::policy::SandboxLinux::GetInstance();
  50. instance->StartBrokerProcess(MakeBrokerCommandSet({
  51. sandbox::syscall_broker::COMMAND_ACCESS,
  52. sandbox::syscall_broker::COMMAND_OPEN,
  53. sandbox::syscall_broker::COMMAND_MKDIR,
  54. sandbox::syscall_broker::COMMAND_STAT,
  55. sandbox::syscall_broker::COMMAND_STAT64,
  56. sandbox::syscall_broker::COMMAND_RENAME,
  57. sandbox::syscall_broker::COMMAND_UNLINK,
  58. }),
  59. GetTtsFilePermissions(),
  60. sandbox::policy::SandboxLinux::PreSandboxHook(),
  61. options);
  62. instance->EngageNamespaceSandboxIfPossible();
  63. return true;
  64. }
  65. } // namespace tts
  66. } // namespace chromeos