1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
|
// Copyright 2017 The Chromium Authors
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
#include "sandbox/linux/seccomp-bpf-helpers/seccomp_starter_android.h"
#include <signal.h>
#include "base/logging.h"
#if BUILDFLAG(USE_SECCOMP_BPF)
#include "base/android/build_info.h"
#include "sandbox/linux/seccomp-bpf/sandbox_bpf.h"
#endif
namespace sandbox {
SeccompStarterAndroid::SeccompStarterAndroid(int build_sdk)
: sdk_int_(build_sdk) {}
SeccompStarterAndroid::~SeccompStarterAndroid() = default;
#if BUILDFLAG(USE_SECCOMP_BPF)
BaselinePolicyAndroid::RuntimeOptions
SeccompStarterAndroid::GetDefaultBaselineOptions() const {
BaselinePolicyAndroid::RuntimeOptions options;
// On Android S+, there are CTS-enforced requirements that the kernel carries
// patches to userfaultfd that enforce usermode pages only (i.e.
// UFFD_USER_MODE_ONLY). Userfaultfd is used for a new ART garbage collector.
// See https://crbug.com/1300653 for details.
options.allow_userfaultfd_ioctls = sdk_int_ >= base::android::SDK_VERSION_S;
return options;
}
#endif
bool SeccompStarterAndroid::StartSandbox() {
#if BUILDFLAG(USE_SECCOMP_BPF)
DCHECK(policy_);
// Do run-time detection to ensure that support is present.
if (!SandboxBPF::SupportsSeccompSandbox(
SandboxBPF::SeccompLevel::MULTI_THREADED)) {
status_ = SeccompSandboxStatus::DETECTION_FAILED;
LOG(WARNING) << "Seccomp support should be present, but detection "
<< "failed. Continuing without Seccomp-BPF.";
return false;
}
sig_t old_handler = signal(SIGSYS, SIG_DFL);
if (old_handler != SIG_DFL && sdk_int_ < base::android::SDK_VERSION_OREO) {
// On Android O and later, the zygote applies a seccomp filter to all
// apps. It has its own SIGSYS handler that must be un-hooked so that
// the Chromium one can be used instead. If pre-O devices have a SIGSYS
// handler, then warn about that.
DLOG(WARNING) << "Un-hooking existing SIGSYS handler before starting "
<< "Seccomp sandbox";
}
SandboxBPF sandbox(std::move(policy_));
CHECK(sandbox.StartSandbox(SandboxBPF::SeccompLevel::MULTI_THREADED));
status_ = SeccompSandboxStatus::ENGAGED;
return true;
#else
return false;
#endif
}
} // namespace sandbox
|
