broker_process.h 5.0 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131
  1. // Copyright (c) 2012 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #ifndef SANDBOX_LINUX_SYSCALL_BROKER_BROKER_PROCESS_H_
  5. #define SANDBOX_LINUX_SYSCALL_BROKER_BROKER_PROCESS_H_
  6. #include <sys/stat.h>
  7. #include <memory>
  8. #include <string>
  9. #include <vector>
  10. #include "base/callback_forward.h"
  11. #include "base/files/scoped_file.h"
  12. #include "base/pickle.h"
  13. #include "base/process/process.h"
  14. #include "sandbox/linux/syscall_broker/broker_channel.h"
  15. #include "sandbox/linux/syscall_broker/broker_command.h"
  16. #include "sandbox/linux/syscall_broker/broker_sandbox_config.h"
  17. #include "sandbox/sandbox_export.h"
  18. #include "third_party/abseil-cpp/absl/types/optional.h"
  19. namespace sandbox {
  20. namespace syscall_broker {
  21. class BrokerClient;
  22. // Create a new "broker" process to which we can send requests via an IPC
  23. // channel by forking the current process.
  24. // This is a low level IPC mechanism that is suitable to be called from a
  25. // signal handler.
  26. // A process would typically create a broker process before entering
  27. // sandboxing.
  28. // 1. BrokerProcess open_broker(read_allowlist, write_allowlist);
  29. // 2. CHECK(open_broker.Init(NULL));
  30. // 3. Enable sandbox.
  31. // 4. Use open_broker.Open() to open files.
  32. class SANDBOX_EXPORT BrokerProcess {
  33. public:
  34. enum class BrokerType { SIGNAL_BASED };
  35. using BrokerSideCallback =
  36. base::OnceCallback<bool(const BrokerSandboxConfig&)>;
  37. // |policy| is the policy for the broker process.
  38. //
  39. // |denied_errno| is the error code returned when methods such as Open() or
  40. // Access() are invoked on a file which is not in the allowlist (EACCESS would
  41. // be a typical value).
  42. //
  43. // |fast_check_in_client| controls whether requests are
  44. // first filtered on the client side before being proxied. Apart from tests,
  45. // this should always be true since our main clients are not always
  46. // well-behaved. They may have third party libraries that don't know about
  47. // sandboxing, and typically try to open all sorts of stuff they don't really
  48. // need. It's important to reduce this load given that there is only one
  49. // pipeline to the broker process, and it is not multi-threaded.
  50. //
  51. // |quiet_failures_for_tests| is reserved for unit tests, don't use it.
  52. BrokerProcess(absl::optional<BrokerSandboxConfig> policy,
  53. BrokerType broker_type,
  54. bool fast_check_in_client = true,
  55. bool quiet_failures_for_tests = false);
  56. BrokerProcess(const BrokerProcess&) = delete;
  57. BrokerProcess& operator=(const BrokerProcess&) = delete;
  58. ~BrokerProcess();
  59. // Will initialize the broker process. There should be no threads at this
  60. // point, since we need to fork().
  61. // broker_process_init_callback will be called in the new broker process,
  62. // after fork() returns.
  63. bool Fork(BrokerSideCallback broker_process_init_callback);
  64. // Return the PID of the child created by Fork().
  65. int broker_pid() const { return broker_pid_; }
  66. // Can be used in bpf_dsl::Policy::EvaluateSyscall() implementations to
  67. // determine if the system call |sysno| should be trapped and forwarded
  68. // to the broker process for handling. This examines the
  69. // |policy_->allowed_command_set| iff |fast_check_in_client_| is true. If
  70. // the fast checks are disabled, then all possible brokerable system
  71. // calls are forwarded to the broker process for handling.
  72. bool IsSyscallAllowed(int sysno) const;
  73. // Gets the signal-based BrokerClient created by Fork().
  74. syscall_broker::BrokerClient* GetBrokerClientSignalBased() const {
  75. return broker_client_.get();
  76. }
  77. private:
  78. friend class BrokerProcessTestHelper;
  79. friend class HandleFilesystemViaBrokerPolicy;
  80. // IsSyscallBrokerable() answers the same question as IsSyscallAllowed(),
  81. // but takes |fast_check| as a parameter. If |fast_check| is false, do not
  82. // check |policy_->allowed_command_set| before returning true for a syscall
  83. // that is brokerable.
  84. bool IsSyscallBrokerable(int sysno, bool fast_check) const;
  85. // Close the IPC channel with the other party. This should only be used
  86. // by tests and none of the class methods should be used afterwards.
  87. void CloseChannel();
  88. // Forks the signal-based broker, where syscall emulation is performed using
  89. // signals in the sandboxed process that connect to the broker via Unix
  90. // socket.
  91. bool ForkSignalBasedBroker(BrokerSideCallback broker_process_init_callback);
  92. // Variables initialized by the constructor.
  93. absl::optional<BrokerSandboxConfig>
  94. policy_; // Can also be created by SendPolicy().
  95. const BrokerType broker_type_;
  96. const bool fast_check_in_client_;
  97. const bool quiet_failures_for_tests_;
  98. bool initialized_ = false; // Whether we've been through Fork() yet.
  99. pid_t broker_pid_ = -1; // The PID of the broker (child) created in Fork().
  100. // Created in the parent process.
  101. std::unique_ptr<syscall_broker::BrokerClient> broker_client_;
  102. };
  103. } // namespace syscall_broker
  104. } // namespace sandbox
  105. #endif // SANDBOX_LINUX_SYSCALL_BROKER_BROKER_PROCESS_H_