File: mach_port_rendezvous_mac.h

package info (click to toggle)
chromium 139.0.7258.127-1
  • links: PTS, VCS
  • area: main
  • in suites:
  • size: 6,122,068 kB
  • sloc: cpp: 35,100,771; ansic: 7,163,530; javascript: 4,103,002; python: 1,436,920; asm: 946,517; xml: 746,709; pascal: 187,653; perl: 88,691; sh: 88,436; objc: 79,953; sql: 51,488; cs: 44,583; fortran: 24,137; makefile: 22,147; tcl: 15,277; php: 13,980; yacc: 8,984; ruby: 7,485; awk: 3,720; lisp: 3,096; lex: 1,327; ada: 727; jsp: 228; sed: 36
file content (185 lines) | stat: -rw-r--r-- 7,184 bytes parent folder | download | duplicates (5)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
// Copyright 2019 The Chromium Authors
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

#ifndef BASE_APPLE_MACH_PORT_RENDEZVOUS_MAC_H_
#define BASE_APPLE_MACH_PORT_RENDEZVOUS_MAC_H_

#include <dispatch/dispatch.h>
#include <mach/mach.h>
#include <stdint.h>
#include <sys/types.h>

#include <map>
#include <memory>
#include <string>
#include <vector>

#include "base/apple/dispatch_source.h"
#include "base/apple/mach_port_rendezvous.h"
#include "base/apple/scoped_mach_port.h"
#include "base/base_export.h"
#include "base/containers/buffer_iterator.h"
#include "base/environment.h"
#include "base/feature_list.h"
#include "base/mac/process_requirement.h"
#include "base/synchronization/lock.h"
#include "base/thread_annotations.h"

namespace base {

// An implementation class that uses bootstrap to register ports to many
// processes.
class BASE_EXPORT MachPortRendezvousServerMac final
    : public MachPortRendezvousServerBase {
 public:
  // Returns the instance of the server. Upon the first call to this method,
  // the server is created, which registers an endpoint in the Mach bootstrap
  // namespace.
  static MachPortRendezvousServerMac* GetInstance();

  // Add feature state to an environment variable that will be used when
  // launching a child process. MachPortRendezvousClient is used during
  // feature list initialization so any state it uses must be passed
  // via a side channel.
  // TODO(crbug.com/362302761): Remove once enforcement is enabled by default.
  static void AddFeatureStateToEnvironment(EnvironmentMap& environment);

  MachPortRendezvousServerMac(const MachPortRendezvousServerMac&) = delete;
  MachPortRendezvousServerMac& operator=(const MachPortRendezvousServerMac&) =
      delete;

  // Registers a collection of Mach ports |ports| to be acquirable by the
  // process known by |pid|. This cannot be called again for the same |pid|
  // until the process known by |pid| has either acquired the ports or died.
  //
  // This must be called with the lock from GetLock() held.
  void RegisterPortsForPid(pid_t pid, const MachPortsForRendezvous& ports)
      EXCLUSIVE_LOCKS_REQUIRED(GetLock());

  // Sets the process requirement that `pid` must match before it
  // can acquire any Mach ports. This cannot be called again for the same `pid`
  // until the process known by `pid` has acquired the ports or died.
  //
  // This must be called with the lock from GetLock() held.
  void SetProcessRequirementForPid(pid_t pid,
                                   mac::ProcessRequirement requirement)
      EXCLUSIVE_LOCKS_REQUIRED(GetLock());

  // Returns a lock on the internal port registration map. The parent process
  // should hold this lock for the duration of launching a process, including
  // after calling RegisterPortsForPid(). This ensures that a child process
  // cannot race acquiring ports before they are registered. The lock should
  // be released after the child process is launched and the ports are
  // registered.
  Lock& GetLock() LOCK_RETURNED(lock_) { return lock_; }

  void ClearClientDataForTesting() EXCLUSIVE_LOCKS_REQUIRED(GetLock());

 protected:
  // Returns the registered collection of ports for the specified `audit_token`.
  // `std::nullopt` indicates that the client is not authorized to retrieve the
  // ports. This claims the collection of ports and removes the entry from
  // `client_data_`.
  std::optional<MachPortsForRendezvous> PortsForClient(
      audit_token_t audit_token) override;

  bool IsValidAdditionalMessageId(mach_msg_id_t) const override;
  std::vector<uint8_t> AdditionalDataForReply(
      mach_msg_id_t request) const override;

 private:
  friend class MachPortRendezvousServerTest;
  friend struct MachPortRendezvousFuzzer;

  MachPortRendezvousServerMac();
  ~MachPortRendezvousServerMac() override;

  struct ClientData;

  // Returns the `ClientData` for `pid`, creating it if necessary.
  // It will be cleaned up automatically when `pid` exits.
  ClientData& ClientDataForPid(int pid) EXCLUSIVE_LOCKS_REQUIRED(GetLock());

  // Called by the ClientData::exit_watcher dispatch sources when a process
  // for which ports have been registered exits. This releases port rights
  // that are strongly owned, in the event that the child has not claimed them.
  void OnClientExited(pid_t pid);

  Lock lock_;
  // Association of pid-to-ports.
  std::map<pid_t, ClientData> client_data_ GUARDED_BY(lock_);
};

// Describes how the `ProcessRequirement` should be used during Mach port
// rendezvous. The active policy is derived from the feature flags in the
// browser process and is passed via an environment variable to child processes.
// TODO(crbug.com/362302761): Remove this policy once enforcement is enabled by
// default.
enum class MachPortRendezvousPeerValidationPolicy {
  // Do not validate the peer against a process requirement.
  kNoValidation,

  // Validate the peer against a process requirement, if specified, but do not
  // abort rendezvous if validation fails. Used to gather success metrics during
  // experiment rollout.
  kValidateOnly,

  // Validate the peer against a process requirement, if specified, and abort
  // rendezvous if the validation fails.
  kEnforce,
};

class BASE_EXPORT MachPortRendezvousClientMac final
    : public MachPortRendezvousClient {
 public:
  // Set a ProcessRequirement that the server should be validated
  // against before accepting any Mach ports from it.
  //
  // Must be called before `GetInstance` or this will have no effect.
  static void SetServerProcessRequirement(mac::ProcessRequirement requirement);

  // Get the peer validation policy that was derived from feature flags.
  static MachPortRendezvousPeerValidationPolicy
  PeerValidationPolicyForTesting();

 protected:
  // Validate the server against a process requirement if one was set via
  // `SetServerProcessRequirement`.
  bool ValidateMessage(mach_msg_base_t* message,
                       BufferIterator<uint8_t> body) override;

 private:
  friend class MachPortRendezvousClient;

  MachPortRendezvousClientMac();
  ~MachPortRendezvousClientMac() override;

  // Returns the name of the server to look up in the bootstrap namespace.
  static std::string GetBootstrapName();

  // Helper method to look up the server in the bootstrap namespace and send
  // the acquisition request message.
  bool AcquirePorts();

  // Take ownership of the server process requirement, if any.
  static std::optional<mac::ProcessRequirement>
  TakeServerCodeSigningRequirement();

  // Whether Info.plist data is needed from the server in order
  // to validate `server_requirement_`.
  bool NeedsInfoPlistData() const;

  std::optional<mac::ProcessRequirement> server_requirement_;
};

// Whether any peer process requirements should be validated.
BASE_EXPORT BASE_DECLARE_FEATURE(kMachPortRendezvousValidatePeerRequirements);

// Whether a failure to validate a peer process against a requirement
// should result in aborting the rendezvous.
BASE_EXPORT BASE_DECLARE_FEATURE(kMachPortRendezvousEnforcePeerRequirements);

}  // namespace base

#endif  // BASE_APPLE_MACH_PORT_RENDEZVOUS_MAC_H_