sandbox.cc 4.5 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116
  1. // Copyright 2017 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #include "sandbox/policy/sandbox.h"
  5. #include "base/command_line.h"
  6. #include "build/build_config.h"
  7. #include "sandbox/policy/mojom/sandbox.mojom.h"
  8. #include "sandbox/policy/switches.h"
  9. #if BUILDFLAG(IS_ANDROID)
  10. #include "base/android/jni_android.h"
  11. #endif // BUILDFLAG(IS_ANDROID)
  12. #if BUILDFLAG(IS_LINUX) || BUILDFLAG(IS_CHROMEOS)
  13. #include "sandbox/policy/linux/sandbox_linux.h"
  14. #endif // BUILDFLAG(IS_LINUX) || BUILDFLAG(IS_CHROMEOS)
  15. #if BUILDFLAG(IS_MAC)
  16. #include "sandbox/mac/seatbelt.h"
  17. #endif // BUILDFLAG(IS_MAC)
  18. #if BUILDFLAG(IS_WIN)
  19. #include "base/process/process_info.h"
  20. #include "sandbox/policy/win/sandbox_win.h"
  21. #include "sandbox/win/src/sandbox.h"
  22. #endif // BUILDFLAG(IS_WIN)
  23. namespace sandbox {
  24. namespace policy {
  25. #if BUILDFLAG(IS_LINUX) || BUILDFLAG(IS_CHROMEOS)
  26. bool Sandbox::Initialize(sandbox::mojom::Sandbox sandbox_type,
  27. SandboxLinux::PreSandboxHook hook,
  28. const SandboxLinux::Options& options) {
  29. return SandboxLinux::GetInstance()->InitializeSandbox(
  30. sandbox_type, std::move(hook), options);
  31. }
  32. #endif // BUILDFLAG(IS_LINUX) || BUILDFLAG(IS_CHROMEOS)
  33. #if BUILDFLAG(IS_WIN)
  34. bool Sandbox::Initialize(sandbox::mojom::Sandbox sandbox_type,
  35. SandboxInterfaceInfo* sandbox_info) {
  36. BrokerServices* broker_services = sandbox_info->broker_services;
  37. if (broker_services) {
  38. const base::CommandLine& command_line =
  39. *base::CommandLine::ForCurrentProcess();
  40. if (!SandboxWin::InitBrokerServices(broker_services))
  41. return false;
  42. // Only pre-create alternate desktop if there will be sandboxed processes in
  43. // the future.
  44. if (!command_line.HasSwitch(switches::kNoSandbox)) {
  45. // IMPORTANT: This piece of code needs to run as early as possible in the
  46. // process because it will initialize the sandbox broker, which requires
  47. // the process to swap its window station. During this time all the UI
  48. // will be broken. This has to run before threads and windows are created.
  49. ResultCode result =
  50. broker_services->CreatePolicy()->CreateAlternateDesktop(true);
  51. CHECK(SBOX_ERROR_FAILED_TO_SWITCH_BACK_WINSTATION != result);
  52. }
  53. return true;
  54. }
  55. return IsUnsandboxedSandboxType(sandbox_type) ||
  56. SandboxWin::InitTargetServices(sandbox_info->target_services);
  57. }
  58. #endif // BUILDFLAG(IS_WIN)
  59. // static
  60. bool Sandbox::IsProcessSandboxed() {
  61. auto* command_line = base::CommandLine::ForCurrentProcess();
  62. bool is_browser = !command_line->HasSwitch(switches::kProcessType);
  63. if (!is_browser &&
  64. base::CommandLine::ForCurrentProcess()->HasSwitch(switches::kNoSandbox)) {
  65. // When running with --no-sandbox, unconditionally report the process as
  66. // sandboxed. This lets code write |DCHECK(IsProcessSandboxed())| and not
  67. // break when testing with the --no-sandbox switch.
  68. return true;
  69. }
  70. #if BUILDFLAG(IS_ANDROID)
  71. // Note that this does not check the status of the Seccomp sandbox. Call
  72. // https://developer.android.com/reference/android/os/Process#isIsolated().
  73. JNIEnv* env = base::android::AttachCurrentThread();
  74. base::android::ScopedJavaLocalRef<jclass> process_class =
  75. base::android::GetClass(env, "android/os/Process");
  76. jmethodID is_isolated =
  77. base::android::MethodID::Get<base::android::MethodID::TYPE_STATIC>(
  78. env, process_class.obj(), "isIsolated", "()Z");
  79. return env->CallStaticBooleanMethod(process_class.obj(), is_isolated);
  80. #elif BUILDFLAG(IS_FUCHSIA)
  81. // TODO(https://crbug.com/1071420): Figure out what to do here. Process
  82. // launching controls the sandbox and there are no ambient capabilities, so
  83. // basically everything but the browser is considered sandboxed.
  84. return !is_browser;
  85. #elif BUILDFLAG(IS_LINUX) || BUILDFLAG(IS_CHROMEOS)
  86. int status = SandboxLinux::GetInstance()->GetStatus();
  87. constexpr int kLayer1Flags = SandboxLinux::Status::kSUID |
  88. SandboxLinux::Status::kPIDNS |
  89. SandboxLinux::Status::kUserNS;
  90. constexpr int kLayer2Flags =
  91. SandboxLinux::Status::kSeccompBPF | SandboxLinux::Status::kSeccompTSYNC;
  92. return (status & kLayer1Flags) != 0 && (status & kLayer2Flags) != 0;
  93. #elif BUILDFLAG(IS_MAC)
  94. return Seatbelt::IsSandboxed();
  95. #elif BUILDFLAG(IS_WIN)
  96. return base::GetCurrentProcessIntegrityLevel() < base::MEDIUM_INTEGRITY;
  97. #else
  98. return false;
  99. #endif
  100. }
  101. } // namespace policy
  102. } // namespace sandbox