Share the zygote's fopen overrides with nacl_helper.

This will allow ChromeOS's version of NSS to initialize inside of nacl_helper
without killing the process, which in turn allows validation caching to be
enabled on ChromeOS.

BUG= https://code.google.com/p/chromium/issues/detail?id=134538
TEST= none


Review URL: https://chromiumcodereview.appspot.com/10736017

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@146498 0039d316-1c4b-4281-b951-d872f2087c98

chrome/browser/nacl_host/nacl_browser.cc

@@ -22,14 +22,7 @@ const char kValidationCacheSequenceName[] = "NaClValidationCache";
 const FilePath::CharType kValidationCacheFileName[] =
     FILE_PATH_LITERAL("nacl_validation_cache.bin");
 
-#if defined(OS_CHROMEOS)
-// TODO(ncbray) enable on ChromeOS.
-// http://code.google.com/p/chromium/issues/detail?id=131218
-const bool kValidationCacheEnabledByDefault = false;
-#else
 const bool kValidationCacheEnabledByDefault = true;
-#endif
-
 
 enum ValidationCacheStatus {
   CACHE_MISS = 0,

chrome/nacl.gypi

@@ -141,6 +141,7 @@
               ],
               'dependencies': [
                 '../crypto/crypto.gyp:crypto',
+                '../sandbox/sandbox.gyp:libc_urandom_override',
                 'nacl',
               ],
               'sources': [

chrome/nacl/DEPS

@@ -1,6 +1,7 @@
 include_rules = [
   "+chrome/app/breakpad_win.h",
   "+content/public/app/startup_helper_win.h",
+  "+sandbox/linux/services",
   "+sandbox/src",
   "+seccompsandbox",
   "+native_client/src",

chrome/nacl/nacl_helper_linux.cc

@@ -29,6 +29,7 @@
 #include "crypto/nss_util.h"
 #include "ipc/ipc_descriptors.h"
 #include "ipc/ipc_switches.h"
+#include "sandbox/linux/services/libc_urandom_override.h"
 
 namespace {
 
@@ -201,6 +202,10 @@ int main(int argc, char *argv[]) {
   CommandLine::Init(argc, argv);
   base::AtExitManager exit_manager;
   base::RandUint64();  // acquire /dev/urandom fd before sandbox is raised
+#if !defined(CHROMIUM_SELINUX)
+  // Allows NSS to fopen() /dev/urandom.
+  sandbox::InitLibcUrandomOverrides();
+#endif
 #if defined(USE_NSS)
   // Configure NSS for use inside the NaCl process.
   // The fork check has not caused problems for NaCl, but this appears to be

content/content_browser.gypi

@@ -852,6 +852,7 @@
     ['OS=="linux"', {
       'dependencies': [
         '../build/linux/system.gyp:udev',
+        '../sandbox/sandbox.gyp:libc_urandom_override',
       ],
       # Set LINUX_SANDBOX_PATH for Linux, including Chrome OS
       'conditions': [

content/zygote/zygote_main_linux.cc

@@ -36,6 +36,7 @@
 #include "content/public/common/sandbox_linux.h"
 #include "content/public/common/zygote_fork_delegate_linux.h"
 #include "content/zygote/zygote_linux.h"
+#include "sandbox/linux/services/libc_urandom_override.h"
 #include "skia/ext/SkFontHost_fontconfig_control.h"
 #include "unicode/timezone.h"
 
@@ -51,8 +52,6 @@ namespace content {
 
 // See http://code.google.com/p/chromium/wiki/LinuxZygote
 
-static const char kUrandomDevPath[] = "/dev/urandom";
-
 // The SUID sandbox sets this environment variable to a file descriptor
 // over which we can signal that we have completed our startup and can be
 // chrooted.
@@ -141,10 +140,6 @@ static bool g_am_zygote_or_renderer = false;
 typedef struct tm* (*LocaltimeFunction)(const time_t* timep);
 typedef struct tm* (*LocaltimeRFunction)(const time_t* timep,
                                          struct tm* result);
-typedef FILE* (*FopenFunction)(const char* path, const char* mode);
-typedef int (*XstatFunction)(int version, const char *path, struct stat *buf);
-typedef int (*Xstat64Function)(int version, const char *path,
-                               struct stat64 *buf);
 
 static pthread_once_t g_libc_localtime_funcs_guard = PTHREAD_ONCE_INIT;
 static LocaltimeFunction g_libc_localtime;
@@ -152,15 +147,6 @@ static LocaltimeFunction g_libc_localtime64;
 static LocaltimeRFunction g_libc_localtime_r;
 static LocaltimeRFunction g_libc_localtime64_r;
 
-// http://crbug.com/123263, see below.
-#if !defined(ADDRESS_SANITIZER)
-static pthread_once_t g_libc_file_io_funcs_guard = PTHREAD_ONCE_INIT;
-static FopenFunction g_libc_fopen;
-static FopenFunction g_libc_fopen64;
-static XstatFunction g_libc_xstat;
-static Xstat64Function g_libc_xstat64;
-#endif
-
 static void InitLibcLocaltimeFunctions() {
   g_libc_localtime = reinterpret_cast<LocaltimeFunction>(
       dlsym(RTLD_NEXT, "localtime"));
@@ -266,125 +252,6 @@ struct tm* localtime64_r_override(const time_t* timep, struct tm* result) {
   }
 }
 
-// TODO(sergeyu): Currently this code doesn't work properly under ASAN
-// - it crashes content_unittests. Make sure it works properly and
-// enable it here. http://crbug.com/123263
-#if !defined(ADDRESS_SANITIZER)
-
-static void InitLibcFileIOFunctions() {
-  g_libc_fopen = reinterpret_cast<FopenFunction>(
-      dlsym(RTLD_NEXT, "fopen"));
-  g_libc_fopen64 = reinterpret_cast<FopenFunction>(
-      dlsym(RTLD_NEXT, "fopen64"));
-
-  if (!g_libc_fopen) {
-    LOG(FATAL) << "Failed to get fopen() from libc.";
-  } else if (!g_libc_fopen64) {
-#if !defined(OS_OPENBSD) && !defined(OS_FREEBSD)
-    LOG(WARNING) << "Failed to get fopen64() from libc. Using fopen() instead.";
-#endif  // !defined(OS_OPENBSD) && !defined(OS_FREEBSD)
-    g_libc_fopen64 = g_libc_fopen;
-  }
-
-  // TODO(sergeyu): This works only on systems with glibc. Fix it to
-  // work properly on other systems if necessary.
-  g_libc_xstat = reinterpret_cast<XstatFunction>(
-      dlsym(RTLD_NEXT, "__xstat"));
-  g_libc_xstat64 = reinterpret_cast<Xstat64Function>(
-      dlsym(RTLD_NEXT, "__xstat64"));
-
-  if (!g_libc_xstat) {
-    LOG(FATAL) << "Failed to get __xstat() from libc.";
-  }
-  if (!g_libc_xstat64) {
-    LOG(WARNING) << "Failed to get __xstat64() from libc.";
-  }
-}
-
-// fopen() and fopen64() are intercepted here so that NSS can open
-// /dev/urandom to seed its random number generator. NSS is used by
-// remoting in the sendbox.
-
-// fopen() call may be redirected to fopen64() in stdio.h using
-// __REDIRECT(), which sets asm name for fopen() to "fopen64". This
-// means that we cannot override fopen() directly here. Instead the
-// the code below defines fopen_override() function with asm name
-// "fopen", so that all references to fopen() will resolve to this
-// function.
-__attribute__ ((__visibility__("default")))
-FILE* fopen_override(const char* path, const char* mode)  __asm__ ("fopen");
-
-__attribute__ ((__visibility__("default")))
-FILE* fopen_override(const char* path, const char* mode) {
-  if (g_am_zygote_or_renderer && strcmp(path, kUrandomDevPath) == 0) {
-    int fd = HANDLE_EINTR(dup(base::GetUrandomFD()));
-    if (fd < 0) {
-      PLOG(ERROR) << "dup() failed.";
-      return NULL;
-    }
-    return fdopen(fd, mode);
-  } else {
-    CHECK_EQ(0, pthread_once(&g_libc_file_io_funcs_guard,
-                             InitLibcFileIOFunctions));
-    return g_libc_fopen(path, mode);
-  }
-}
-
-__attribute__ ((__visibility__("default")))
-FILE* fopen64(const char* path, const char* mode) {
-  if (g_am_zygote_or_renderer && strcmp(path, kUrandomDevPath) == 0) {
-    int fd = HANDLE_EINTR(dup(base::GetUrandomFD()));
-    if (fd < 0) {
-      PLOG(ERROR) << "dup() failed.";
-      return NULL;
-    }
-    return fdopen(fd, mode);
-  } else {
-    CHECK_EQ(0, pthread_once(&g_libc_file_io_funcs_guard,
-                             InitLibcFileIOFunctions));
-    return g_libc_fopen64(path, mode);
-  }
-}
-
-// stat() is subject to the same problem as fopen(), so we have to use
-// the same trick to override it.
-__attribute__ ((__visibility__("default")))
-int xstat_override(int version,
-                   const char *path,
-                   struct stat *buf)  __asm__ ("__xstat");
-
-__attribute__ ((__visibility__("default")))
-int xstat_override(int version, const char *path, struct stat *buf) {
-  if (g_am_zygote_or_renderer && strcmp(path, kUrandomDevPath) == 0) {
-    int result = __fxstat(version, base::GetUrandomFD(), buf);
-    return result;
-  } else {
-    CHECK_EQ(0, pthread_once(&g_libc_file_io_funcs_guard,
-                             InitLibcFileIOFunctions));
-    return g_libc_xstat(version, path, buf);
-  }
-}
-
-__attribute__ ((__visibility__("default")))
-int xstat64_override(int version,
-                     const char *path,
-                     struct stat64 *buf)  __asm__ ("__xstat64");
-
-__attribute__ ((__visibility__("default")))
-int xstat64_override(int version, const char *path, struct stat64 *buf) {
-  if (g_am_zygote_or_renderer && strcmp(path, kUrandomDevPath) == 0) {
-    int result = __fxstat64(version, base::GetUrandomFD(), buf);
-    return result;
-  } else {
-    CHECK_EQ(0, pthread_once(&g_libc_file_io_funcs_guard,
-                             InitLibcFileIOFunctions));
-    CHECK(g_libc_xstat64);
-    return g_libc_xstat64(version, path, buf);
-  }
-}
-
-#endif  // !ADDRESS_SANITIZER
-
 #endif  // !CHROMIUM_SELINUX
 
 // This function triggers the static and lazy construction of objects that need
@@ -622,6 +489,7 @@ bool ZygoteMain(const MainFunctionParams& params,
                 ZygoteForkDelegate* forkdelegate) {
 #if !defined(CHROMIUM_SELINUX)
   g_am_zygote_or_renderer = true;
+  sandbox::InitLibcUrandomOverrides();
 #endif
 
   int proc_fd_for_seccomp = -1;

sandbox/linux/services/libc_urandom_override.cc

@@ -0,0 +1,166 @@
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "sandbox/linux/services/libc_urandom_override.h"
+
+#include <dlfcn.h>
+#include <pthread.h>
+#include <stdio.h>
+#include <sys/stat.h>
+
+#include "base/eintr_wrapper.h"
+#include "base/logging.h"
+#include "base/rand_util.h"
+
+// Note: this file is used by the zygote and nacl_helper.
+
+namespace sandbox {
+
+// With SELinux we can carve out a precise sandbox, so we don't have to play
+// with intercepting libc calls.
+#if !defined(CHROMIUM_SELINUX)
+
+static bool g_override_urandom = false;
+
+void InitLibcUrandomOverrides() {
+  // Make sure /dev/urandom is open.
+  base::GetUrandomFD();
+  g_override_urandom = true;
+}
+
+// TODO(sergeyu): Currently this code doesn't work properly under ASAN
+// - it crashes content_unittests. Make sure it works properly and
+// enable it here. http://crbug.com/123263
+#if !defined(ADDRESS_SANITIZER)
+
+static const char kUrandomDevPath[] = "/dev/urandom";
+
+typedef FILE* (*FopenFunction)(const char* path, const char* mode);
+typedef int (*XstatFunction)(int version, const char *path, struct stat *buf);
+typedef int (*Xstat64Function)(int version, const char *path,
+                               struct stat64 *buf);
+
+static pthread_once_t g_libc_file_io_funcs_guard = PTHREAD_ONCE_INIT;
+static FopenFunction g_libc_fopen;
+static FopenFunction g_libc_fopen64;
+static XstatFunction g_libc_xstat;
+static Xstat64Function g_libc_xstat64;
+
+static void InitLibcFileIOFunctions() {
+  g_libc_fopen = reinterpret_cast<FopenFunction>(
+      dlsym(RTLD_NEXT, "fopen"));
+  g_libc_fopen64 = reinterpret_cast<FopenFunction>(
+      dlsym(RTLD_NEXT, "fopen64"));
+
+  if (!g_libc_fopen) {
+    LOG(FATAL) << "Failed to get fopen() from libc.";
+  } else if (!g_libc_fopen64) {
+#if !defined(OS_OPENBSD) && !defined(OS_FREEBSD)
+    LOG(WARNING) << "Failed to get fopen64() from libc. Using fopen() instead.";
+#endif  // !defined(OS_OPENBSD) && !defined(OS_FREEBSD)
+    g_libc_fopen64 = g_libc_fopen;
+  }
+
+  // TODO(sergeyu): This works only on systems with glibc. Fix it to
+  // work properly on other systems if necessary.
+  g_libc_xstat = reinterpret_cast<XstatFunction>(
+      dlsym(RTLD_NEXT, "__xstat"));
+  g_libc_xstat64 = reinterpret_cast<Xstat64Function>(
+      dlsym(RTLD_NEXT, "__xstat64"));
+
+  if (!g_libc_xstat) {
+    LOG(FATAL) << "Failed to get __xstat() from libc.";
+  }
+  if (!g_libc_xstat64) {
+    LOG(WARNING) << "Failed to get __xstat64() from libc.";
+  }
+}
+
+// fopen() and fopen64() are intercepted here so that NSS can open
+// /dev/urandom to seed its random number generator. NSS is used by
+// remoting in the sendbox.
+
+// fopen() call may be redirected to fopen64() in stdio.h using
+// __REDIRECT(), which sets asm name for fopen() to "fopen64". This
+// means that we cannot override fopen() directly here. Instead the
+// the code below defines fopen_override() function with asm name
+// "fopen", so that all references to fopen() will resolve to this
+// function.
+__attribute__ ((__visibility__("default")))
+FILE* fopen_override(const char* path, const char* mode)  __asm__ ("fopen");
+
+__attribute__ ((__visibility__("default")))
+FILE* fopen_override(const char* path, const char* mode) {
+  if (g_override_urandom && strcmp(path, kUrandomDevPath) == 0) {
+    int fd = HANDLE_EINTR(dup(base::GetUrandomFD()));
+    if (fd < 0) {
+      PLOG(ERROR) << "dup() failed.";
+      return NULL;
+    }
+    return fdopen(fd, mode);
+  } else {
+    CHECK_EQ(0, pthread_once(&g_libc_file_io_funcs_guard,
+                             InitLibcFileIOFunctions));
+    return g_libc_fopen(path, mode);
+  }
+}
+
+__attribute__ ((__visibility__("default")))
+FILE* fopen64(const char* path, const char* mode) {
+  if (g_override_urandom && strcmp(path, kUrandomDevPath) == 0) {
+    int fd = HANDLE_EINTR(dup(base::GetUrandomFD()));
+    if (fd < 0) {
+      PLOG(ERROR) << "dup() failed.";
+      return NULL;
+    }
+    return fdopen(fd, mode);
+  } else {
+    CHECK_EQ(0, pthread_once(&g_libc_file_io_funcs_guard,
+                             InitLibcFileIOFunctions));
+    return g_libc_fopen64(path, mode);
+  }
+}
+
+// stat() is subject to the same problem as fopen(), so we have to use
+// the same trick to override it.
+__attribute__ ((__visibility__("default")))
+int xstat_override(int version,
+                   const char *path,
+                   struct stat *buf)  __asm__ ("__xstat");
+
+__attribute__ ((__visibility__("default")))
+int xstat_override(int version, const char *path, struct stat *buf) {
+  if (g_override_urandom && strcmp(path, kUrandomDevPath) == 0) {
+    int result = __fxstat(version, base::GetUrandomFD(), buf);
+    return result;
+  } else {
+    CHECK_EQ(0, pthread_once(&g_libc_file_io_funcs_guard,
+                             InitLibcFileIOFunctions));
+    return g_libc_xstat(version, path, buf);
+  }
+}
+
+__attribute__ ((__visibility__("default")))
+int xstat64_override(int version,
+                     const char *path,
+                     struct stat64 *buf)  __asm__ ("__xstat64");
+
+__attribute__ ((__visibility__("default")))
+int xstat64_override(int version, const char *path, struct stat64 *buf) {
+  if (g_override_urandom && strcmp(path, kUrandomDevPath) == 0) {
+    int result = __fxstat64(version, base::GetUrandomFD(), buf);
+    return result;
+  } else {
+    CHECK_EQ(0, pthread_once(&g_libc_file_io_funcs_guard,
+                             InitLibcFileIOFunctions));
+    CHECK(g_libc_xstat64);
+    return g_libc_xstat64(version, path, buf);
+  }
+}
+
+#endif  // !ADDRESS_SANITIZER
+
+#endif  // !CHROMIUM_SELINUX
+
+}  // namespace content

sandbox/linux/services/libc_urandom_override.h

@@ -0,0 +1,18 @@
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef SANDBOX_LINUX_SERVICES_LIBC_URANDOM_OVERRIDE_H_
+#define SANDBOX_LINUX_SERVICES_LIBC_URANDOM_OVERRIDE_H_
+
+namespace sandbox {
+
+#if !defined(CHROMIUM_SELINUX)
+
+void InitLibcUrandomOverrides();
+
+#endif  // !CHROMIUM_SELINUX
+
+}  // namespace sandbox
+
+#endif  // SANDBOX_LINUX_SERVICES_LIBC_URANDOM_OVERRIDE_H_

sandbox/sandbox_linux.gypi

@@ -86,5 +86,19 @@
         '..',
       ],
     },
+    {
+      'target_name': 'libc_urandom_override',
+      'type': 'static_library',
+      'sources': [
+        'linux/services/libc_urandom_override.cc',
+        'linux/services/libc_urandom_override.h',
+      ],
+      'dependencies': [
+        '../base/base.gyp:base',
+      ],
+      'include_dirs': [
+        '..',
+      ],
+    },
   ],
 }