diff options
Diffstat (limited to '')
| -rw-r--r-- | ipc/glue/GeckoChildProcessHost.cpp | 1896 |
1 files changed, 1896 insertions, 0 deletions
diff --git a/ipc/glue/GeckoChildProcessHost.cpp b/ipc/glue/GeckoChildProcessHost.cpp new file mode 100644 index 0000000000..b4895e0e45 --- /dev/null +++ b/ipc/glue/GeckoChildProcessHost.cpp @@ -0,0 +1,1896 @@ +/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */ +/* vim: set ts=8 sts=2 et sw=2 tw=80: */ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +#include "GeckoChildProcessHost.h" + +#include "base/command_line.h" +#include "base/process_util.h" +#include "base/string_util.h" +#include "base/task.h" +#include "chrome/common/chrome_switches.h" +#include "chrome/common/process_watcher.h" +#ifdef MOZ_WIDGET_COCOA +# include <bsm/libbsm.h> +# include <mach/mach_traps.h> +# include <servers/bootstrap.h> +# include "SharedMemoryBasic.h" +# include "base/rand_util.h" +# include "chrome/common/mach_ipc_mac.h" +# include "nsILocalFileMac.h" +#endif + +#include "GeckoProfiler.h" +#include "MainThreadUtils.h" +#include "mozilla/Preferences.h" +#include "mozilla/Sprintf.h" +#include "nsXPCOMPrivate.h" +#include "prenv.h" +#include "prerror.h" + +#if defined(MOZ_SANDBOX) +# include "mozilla/SandboxSettings.h" +# include "nsAppDirectoryServiceDefs.h" +#endif + +#include <sys/stat.h> + +#include "ProtocolUtils.h" +#include "mozilla/LinkedList.h" +#include "mozilla/Logging.h" +#include "mozilla/Maybe.h" +#include "mozilla/GeckoArgs.h" +#include "mozilla/Omnijar.h" +#include "mozilla/RDDProcessHost.h" +#include "mozilla/Scoped.h" +#include "mozilla/Services.h" +#include "mozilla/SharedThreadPool.h" +#include "mozilla/StaticMutex.h" +#include "mozilla/TaskQueue.h" +#include "mozilla/Telemetry.h" +#include "mozilla/UniquePtrExtensions.h" +#include "mozilla/ipc/BrowserProcessSubThread.h" +#include "mozilla/ipc/EnvironmentMap.h" +#include "mozilla/ipc/NodeController.h" +#include "mozilla/net/SocketProcessHost.h" +#include "nsDirectoryService.h" +#include "nsDirectoryServiceDefs.h" +#include "nsExceptionHandler.h" +#include "nsIFile.h" +#include "nsIObserverService.h" +#include "nsPrintfCString.h" + +#ifdef XP_WIN +# include <stdlib.h> + +# include "nsIWinTaskbar.h" +# define NS_TASKBAR_CONTRACTID "@mozilla.org/windows-taskbar;1" + +# if defined(MOZ_SANDBOX) +# include "WinUtils.h" +# include "mozilla/Preferences.h" +# include "mozilla/sandboxing/sandboxLogging.h" +# if defined(_ARM64_) +# include "mozilla/remoteSandboxBroker.h" +# endif +# endif + +# include "mozilla/NativeNt.h" +# include "mozilla/CacheNtDllThunk.h" +#endif + +#if defined(XP_LINUX) && defined(MOZ_SANDBOX) +# include "mozilla/SandboxLaunch.h" +#endif + +#if defined(XP_MACOSX) && defined(MOZ_SANDBOX) +# include "GMPProcessParent.h" +# include "nsMacUtilsImpl.h" +#endif + +#include "mozilla/ipc/UtilityProcessHost.h" + +#include "nsClassHashtable.h" +#include "nsHashKeys.h" +#include "nsNativeCharsetUtils.h" +#include "nsTArray.h" +#include "nscore.h" // for NS_FREE_PERMANENT_DATA +#include "private/pprio.h" +#include "nsIThread.h" + +using mozilla::MonitorAutoLock; +using mozilla::Preferences; +using mozilla::StaticMutexAutoLock; + +namespace mozilla { +MOZ_TYPE_SPECIFIC_SCOPED_POINTER_TEMPLATE(ScopedPRFileDesc, PRFileDesc, + PR_Close) +} + +using mozilla::ScopedPRFileDesc; + +#ifdef MOZ_WIDGET_ANDROID +# include "AndroidBridge.h" +# include "mozilla/java/GeckoProcessManagerWrappers.h" +# include "mozilla/java/GeckoProcessTypeWrappers.h" +# include "mozilla/java/GeckoResultWrappers.h" +# include "mozilla/jni/Refs.h" +# include "mozilla/jni/Utils.h" +#endif + +#ifdef MOZ_ENABLE_FORKSERVER +# include "mozilla/ipc/ForkServiceChild.h" +#endif + +static bool ShouldHaveDirectoryService() { + return GeckoProcessType_Default == XRE_GetProcessType(); +} + +namespace mozilla { +namespace ipc { + +struct LaunchResults { + base::ProcessHandle mHandle = 0; +#ifdef XP_MACOSX + task_t mChildTask = MACH_PORT_NULL; +#endif +#if defined(XP_WIN) && defined(MOZ_SANDBOX) + RefPtr<AbstractSandboxBroker> mSandboxBroker; +#endif +}; +typedef mozilla::MozPromise<LaunchResults, LaunchError, true> + ProcessLaunchPromise; + +static Atomic<int32_t> gChildCounter; + +static inline nsISerialEventTarget* IOThread() { + return XRE_GetIOMessageLoop()->SerialEventTarget(); +} + +class BaseProcessLauncher { + public: + BaseProcessLauncher(GeckoChildProcessHost* aHost, + std::vector<std::string>&& aExtraOpts) + : mProcessType(aHost->mProcessType), + mLaunchOptions(std::move(aHost->mLaunchOptions)), + mExtraOpts(std::move(aExtraOpts)), +#ifdef XP_WIN + mGroupId(aHost->mGroupId), +#endif +#if defined(XP_WIN) && defined(MOZ_SANDBOX) + mAllowedFilesRead(aHost->mAllowedFilesRead), + mSandboxLevel(aHost->mSandboxLevel), + mSandbox(aHost->mSandbox), + mIsFileContent(aHost->mIsFileContent), + mEnableSandboxLogging(aHost->mEnableSandboxLogging), +#endif +#if defined(XP_MACOSX) && defined(MOZ_SANDBOX) + mDisableOSActivityMode(aHost->mDisableOSActivityMode), +#endif + mTmpDirName(aHost->mTmpDirName), + mChildId(++gChildCounter) { + SprintfLiteral(mPidString, "%" PRIPID, base::GetCurrentProcId()); + aHost->mInitialChannelId.ToProvidedString(mInitialChannelIdString); + + // Compute the serial event target we'll use for launching. + nsCOMPtr<nsIEventTarget> threadOrPool = GetIPCLauncher(); + mLaunchThread = + TaskQueue::Create(threadOrPool.forget(), "BaseProcessLauncher"); + + if (ShouldHaveDirectoryService()) { + // "Current process directory" means the app dir, not the current + // working dir or similar. + mozilla::Unused + << nsDirectoryService::gService->GetCurrentProcessDirectory( + getter_AddRefs(mAppDir)); + } + } + + NS_INLINE_DECL_THREADSAFE_REFCOUNTING(BaseProcessLauncher); + +#ifdef ALLOW_GECKO_CHILD_PROCESS_ARCH + void SetLaunchArchitecture(uint32_t aLaunchArch) { + mLaunchArch = aLaunchArch; + } +#endif + + RefPtr<ProcessLaunchPromise> Launch(GeckoChildProcessHost*); + + protected: + virtual ~BaseProcessLauncher() = default; + + RefPtr<ProcessLaunchPromise> PerformAsyncLaunch(); + RefPtr<ProcessLaunchPromise> FinishLaunch(); + + // Overrideable hooks. If superclass behavior is invoked, it's always at the + // top of the override. + virtual bool SetChannel(IPC::Channel*) = 0; + virtual Result<Ok, LaunchError> DoSetup(); + virtual RefPtr<ProcessHandlePromise> DoLaunch() = 0; + virtual Result<Ok, LaunchError> DoFinishLaunch() { return Ok(); }; + + void MapChildLogging(); + + static BinPathType GetPathToBinary(FilePath&, GeckoProcessType); + + void GetChildLogName(const char* origLogName, nsACString& buffer); + + const char* ChildProcessType() { + return XRE_GeckoProcessTypeToString(mProcessType); + } + + nsCOMPtr<nsISerialEventTarget> mLaunchThread; + GeckoProcessType mProcessType; + UniquePtr<base::LaunchOptions> mLaunchOptions; +#ifdef ALLOW_GECKO_CHILD_PROCESS_ARCH + uint32_t mLaunchArch = base::PROCESS_ARCH_INVALID; +#endif + std::vector<std::string> mExtraOpts; +#ifdef XP_WIN + nsString mGroupId; +#endif +#if defined(XP_WIN) && defined(MOZ_SANDBOX) + std::vector<std::wstring> mAllowedFilesRead; + int32_t mSandboxLevel; + SandboxingKind mSandbox; + bool mIsFileContent; + bool mEnableSandboxLogging; +#endif +#if defined(XP_MACOSX) && defined(MOZ_SANDBOX) + // Controls whether or not the process will be launched with + // environment variable OS_ACTIVITY_MODE set to "disabled". + bool mDisableOSActivityMode; +#endif + nsCString mTmpDirName; + LaunchResults mResults = LaunchResults(); + int32_t mChildId; + TimeStamp mStartTimeStamp = TimeStamp::Now(); + char mPidString[32]; + char mInitialChannelIdString[NSID_LENGTH]; + + // Set during launch. + IPC::Channel::ChannelId mChannelId; + ScopedPRFileDesc mCrashAnnotationReadPipe; + ScopedPRFileDesc mCrashAnnotationWritePipe; + nsCOMPtr<nsIFile> mAppDir; +}; + +#ifdef XP_WIN +class WindowsProcessLauncher : public BaseProcessLauncher { + public: + WindowsProcessLauncher(GeckoChildProcessHost* aHost, + std::vector<std::string>&& aExtraOpts) + : BaseProcessLauncher(aHost, std::move(aExtraOpts)), + mCachedNtdllThunk(GetCachedNtDllThunk()), + mWerDataPointer(&(aHost->mWerData)) {} + + protected: + bool SetChannel(IPC::Channel*) override { return true; } + virtual Result<Ok, LaunchError> DoSetup() override; + virtual RefPtr<ProcessHandlePromise> DoLaunch() override; + virtual Result<Ok, LaunchError> DoFinishLaunch() override; + + mozilla::Maybe<CommandLine> mCmdLine; + bool mUseSandbox = false; + + const Buffer<IMAGE_THUNK_DATA>* mCachedNtdllThunk; + CrashReporter::WindowsErrorReportingData const* mWerDataPointer; +}; +typedef WindowsProcessLauncher ProcessLauncher; +#endif // XP_WIN + +#ifdef OS_POSIX +class PosixProcessLauncher : public BaseProcessLauncher { + public: + PosixProcessLauncher(GeckoChildProcessHost* aHost, + std::vector<std::string>&& aExtraOpts) + : BaseProcessLauncher(aHost, std::move(aExtraOpts)), + mProfileDir(aHost->mProfileDir), + mChannelDstFd(-1) {} + + protected: + bool SetChannel(IPC::Channel* aChannel) override { + // The source fd is owned by the channel; take ownership by + // dup()ing it and closing the channel's copy. The destination fd + // is with respect to the not-yet-launched child process, so for + // this purpose it's just a number. + int origSrcFd; + aChannel->GetClientFileDescriptorMapping(&origSrcFd, &mChannelDstFd); +# ifndef MOZ_WIDGET_ANDROID + MOZ_ASSERT(mChannelDstFd >= 0); +# endif + mChannelSrcFd.reset(dup(origSrcFd)); + if (NS_WARN_IF(!mChannelSrcFd)) { + return false; + } + aChannel->CloseClientFileDescriptor(); + return true; + } + + virtual Result<Ok, LaunchError> DoSetup() override; + virtual RefPtr<ProcessHandlePromise> DoLaunch() override; + virtual Result<Ok, LaunchError> DoFinishLaunch() override; + + nsCOMPtr<nsIFile> mProfileDir; + + std::vector<std::string> mChildArgv; + UniqueFileHandle mChannelSrcFd; + int mChannelDstFd; +}; + +# if defined(XP_MACOSX) +class MacProcessLauncher : public PosixProcessLauncher { + public: + MacProcessLauncher(GeckoChildProcessHost* aHost, + std::vector<std::string>&& aExtraOpts) + : PosixProcessLauncher(aHost, std::move(aExtraOpts)), + // Put a random number into the channel name, so that + // a compromised renderer can't pretend being the child + // that's forked off. + mMachConnectionName( + StringPrintf("org.mozilla.machname.%d", + base::RandInt(0, std::numeric_limits<int>::max()))) { + MOZ_ASSERT(mMachConnectionName.size() < BOOTSTRAP_MAX_NAME_LEN); + } + + protected: + virtual Result<Ok, LaunchError> DoFinishLaunch() override; + + std::string mMachConnectionName; + // We add a mach port to the command line so the child can communicate its + // 'task_t' back to the parent. + mozilla::UniqueMachReceiveRight mParentRecvPort; + + friend class PosixProcessLauncher; +}; +typedef MacProcessLauncher ProcessLauncher; +# elif defined(MOZ_WIDGET_ANDROID) +class AndroidProcessLauncher : public PosixProcessLauncher { + public: + AndroidProcessLauncher(GeckoChildProcessHost* aHost, + std::vector<std::string>&& aExtraOpts) + : PosixProcessLauncher(aHost, std::move(aExtraOpts)) {} + + protected: + virtual RefPtr<ProcessHandlePromise> DoLaunch() override; + RefPtr<ProcessHandlePromise> LaunchAndroidService( + const GeckoProcessType aType, const std::vector<std::string>& argv, + const base::file_handle_mapping_vector& fds_to_remap); +}; +typedef AndroidProcessLauncher ProcessLauncher; +// NB: Technically Android is linux (i.e. XP_LINUX is defined), but we want +// orthogonal IPC machinery there. Conversely, there are tier-3 non-Linux +// platforms (BSD and Solaris) where we want the "linux" IPC machinery. So +// we use MOZ_WIDGET_* to choose the platform backend. +# elif defined(MOZ_WIDGET_GTK) +class LinuxProcessLauncher : public PosixProcessLauncher { + public: + LinuxProcessLauncher(GeckoChildProcessHost* aHost, + std::vector<std::string>&& aExtraOpts) + : PosixProcessLauncher(aHost, std::move(aExtraOpts)) {} + + protected: + virtual Result<Ok, LaunchError> DoSetup() override; +}; +typedef LinuxProcessLauncher ProcessLauncher; +# elif +# error "Unknown platform" +# endif +#endif // OS_POSIX + +using base::ProcessHandle; +using mozilla::ipc::BaseProcessLauncher; +using mozilla::ipc::ProcessLauncher; + +mozilla::StaticAutoPtr<mozilla::LinkedList<GeckoChildProcessHost>> + GeckoChildProcessHost::sGeckoChildProcessHosts; + +mozilla::StaticMutex GeckoChildProcessHost::sMutex; + +GeckoChildProcessHost::GeckoChildProcessHost(GeckoProcessType aProcessType, + bool aIsFileContent) + : mProcessType(aProcessType), + mIsFileContent(aIsFileContent), + mMonitor("mozilla.ipc.GeckoChildProcessHost.mMonitor"), + mLaunchOptions(MakeUnique<base::LaunchOptions>()), + mInitialChannelId(nsID::GenerateUUID()), + mProcessState(CREATING_CHANNEL), +#ifdef XP_WIN + mGroupId(u"-"), + mWerData{.mWerNotifyProc = CrashReporter::WerNotifyProc, + .mChildPid = 0, + .mMinidumpFile = {}}, +#endif +#if defined(MOZ_SANDBOX) && defined(XP_WIN) + mEnableSandboxLogging(false), + mSandboxLevel(0), +#endif + mHandleLock("mozilla.ipc.GeckoChildProcessHost.mHandleLock"), + mChildProcessHandle(0), +#if defined(MOZ_WIDGET_COCOA) + mChildTask(MACH_PORT_NULL), +#endif +#if defined(MOZ_SANDBOX) && defined(XP_MACOSX) + mDisableOSActivityMode(false), +#endif + mDestroying(false) { + MOZ_COUNT_CTOR(GeckoChildProcessHost); + StaticMutexAutoLock lock(sMutex); + if (!sGeckoChildProcessHosts) { + sGeckoChildProcessHosts = new mozilla::LinkedList<GeckoChildProcessHost>(); + } + sGeckoChildProcessHosts->insertBack(this); +#if defined(MOZ_SANDBOX) && defined(XP_LINUX) + if (aProcessType == GeckoProcessType_Content) { +# if defined(MOZ_CONTENT_TEMP_DIR) + // The content process needs the content temp dir: + nsCOMPtr<nsIFile> contentTempDir; + nsresult rv = NS_GetSpecialDirectory(NS_APP_CONTENT_PROCESS_TEMP_DIR, + getter_AddRefs(contentTempDir)); + if (NS_SUCCEEDED(rv)) { + contentTempDir->GetNativePath(mTmpDirName); + } +# endif + } else if (aProcessType == GeckoProcessType_RDD) { + // The RDD process makes limited use of EGL. If Mesa's shader + // cache is enabled and the directory isn't explicitly set, then + // it will try to getpwuid() the user which can cause problems + // with sandboxing. Because we shouldn't need shader caching in + // this process, we just disable the cache to prevent that. + mLaunchOptions->env_map["MESA_GLSL_CACHE_DISABLE"] = "true"; + mLaunchOptions->env_map["MESA_SHADER_CACHE_DISABLE"] = "true"; + // In case the nvidia driver is also loaded: + mLaunchOptions->env_map["__GL_SHADER_DISK_CACHE"] = "0"; + } +#endif +#if defined(MOZ_ENABLE_FORKSERVER) + if (aProcessType == GeckoProcessType_Content && ForkServiceChild::Get()) { + mLaunchOptions->use_forkserver = true; + } +#endif +} + +GeckoChildProcessHost::~GeckoChildProcessHost() + +{ + AssertIOThread(); + MOZ_RELEASE_ASSERT(mDestroying); + + MOZ_COUNT_DTOR(GeckoChildProcessHost); + + { + mozilla::AutoWriteLock hLock(mHandleLock); +#if defined(MOZ_WIDGET_COCOA) + if (mChildTask != MACH_PORT_NULL) { + mach_port_deallocate(mach_task_self(), mChildTask); + } +#endif + + if (mChildProcessHandle != 0) { +#if defined(XP_WIN) + CrashReporter::DeregisterChildCrashAnnotationFileDescriptor( + base::GetProcId(mChildProcessHandle)); +#else + CrashReporter::DeregisterChildCrashAnnotationFileDescriptor( + mChildProcessHandle); +#endif + + ProcessWatcher::EnsureProcessTerminated( + mChildProcessHandle +#ifdef NS_FREE_PERMANENT_DATA + // If we're doing leak logging, shutdown can be slow. + , + false // don't "force" +#endif + ); + mChildProcessHandle = 0; + } + } + +#if defined(MOZ_SANDBOX) && defined(XP_WIN) + if (mSandboxBroker) { + mSandboxBroker->Shutdown(); + mSandboxBroker = nullptr; + } +#endif +} + +base::ProcessHandle GeckoChildProcessHost::GetChildProcessHandle() { + mozilla::AutoReadLock handleLock(mHandleLock); + return mChildProcessHandle; +} + +base::ProcessId GeckoChildProcessHost::GetChildProcessId() { + mozilla::AutoReadLock handleLock(mHandleLock); + if (!mChildProcessHandle) { + return 0; + } + return base::GetProcId(mChildProcessHandle); +} + +#ifdef XP_MACOSX +task_t GeckoChildProcessHost::GetChildTask() { + mozilla::AutoReadLock handleLock(mHandleLock); + return mChildTask; +} +#endif + +void GeckoChildProcessHost::RemoveFromProcessList() { + StaticMutexAutoLock lock(sMutex); + if (!sGeckoChildProcessHosts) { + return; + } + LinkedListElement<GeckoChildProcessHost>::removeFrom( + *sGeckoChildProcessHosts); +} + +void GeckoChildProcessHost::Destroy() { + MOZ_RELEASE_ASSERT(!mDestroying); + // We can remove from the list before it's really destroyed + RemoveFromProcessList(); + RefPtr<ProcessHandlePromise> whenReady = mHandlePromise; + + if (!whenReady) { + // AsyncLaunch not called yet, so dispatch immediately. + whenReady = ProcessHandlePromise::CreateAndReject( + LaunchError("DestroyEarly"), __func__); + } + + using Value = ProcessHandlePromise::ResolveOrRejectValue; + mDestroying = true; + whenReady->Then(XRE_GetIOMessageLoop()->SerialEventTarget(), __func__, + [this](const Value&) { delete this; }); +} + +// static +mozilla::BinPathType BaseProcessLauncher::GetPathToBinary( + FilePath& exePath, GeckoProcessType processType) { + BinPathType pathType = XRE_GetChildProcBinPathType(processType); + + if (pathType == BinPathType::Self) { +#if defined(OS_WIN) + wchar_t exePathBuf[MAXPATHLEN]; + if (!::GetModuleFileNameW(nullptr, exePathBuf, MAXPATHLEN)) { + MOZ_CRASH("GetModuleFileNameW failed (FIXME)"); + } + exePath = FilePath::FromWStringHack(exePathBuf); +#elif defined(OS_POSIX) + exePath = FilePath(CommandLine::ForCurrentProcess()->argv()[0]); +#else +# error Sorry; target OS not supported yet. +#endif + return pathType; + } + + if (ShouldHaveDirectoryService()) { + MOZ_ASSERT(gGREBinPath); +#ifdef OS_WIN + exePath = FilePath(char16ptr_t(gGREBinPath)); +#elif MOZ_WIDGET_COCOA + nsCOMPtr<nsIFile> childProcPath; + NS_NewLocalFile(nsDependentString(gGREBinPath), false, + getter_AddRefs(childProcPath)); + + // We need to use an App Bundle on OS X so that we can hide + // the dock icon. See Bug 557225. + childProcPath->AppendNative("plugin-container.app"_ns); + childProcPath->AppendNative("Contents"_ns); + childProcPath->AppendNative("MacOS"_ns); + nsCString tempCPath; + childProcPath->GetNativePath(tempCPath); + exePath = FilePath(tempCPath.get()); +#else + nsCString path; + NS_CopyUnicodeToNative(nsDependentString(gGREBinPath), path); + exePath = FilePath(path.get()); +#endif + } + + if (exePath.empty()) { +#ifdef OS_WIN + exePath = + FilePath::FromWStringHack(CommandLine::ForCurrentProcess()->program()); +#else + exePath = FilePath(CommandLine::ForCurrentProcess()->argv()[0]); +#endif + exePath = exePath.DirName(); + } + + exePath = exePath.AppendASCII(MOZ_CHILD_PROCESS_NAME); + + return pathType; +} + +#ifdef MOZ_WIDGET_COCOA +class AutoCFTypeObject { + public: + explicit AutoCFTypeObject(CFTypeRef object) { mObject = object; } + ~AutoCFTypeObject() { ::CFRelease(mObject); } + + private: + CFTypeRef mObject; +}; +#endif + +// We start the unique IDs at 1 so that 0 can be used to mean that +// a component has no unique ID assigned to it. +uint32_t GeckoChildProcessHost::sNextUniqueID = 1; + +/* static */ +uint32_t GeckoChildProcessHost::GetUniqueID() { return sNextUniqueID++; } + +/* static */ +void GeckoChildProcessHost::SetEnv(const char* aKey, const char* aValue) { + MOZ_ASSERT(mLaunchOptions); + mLaunchOptions->env_map[ENVIRONMENT_STRING(aKey)] = + ENVIRONMENT_STRING(aValue); +} + +void GeckoChildProcessHost::PrepareLaunch() { + if (CrashReporter::GetEnabled()) { + CrashReporter::OOPInit(); + } + +#if defined(XP_LINUX) && defined(MOZ_SANDBOX) + SandboxLaunchPrepare(mProcessType, mLaunchOptions.get()); +#endif + +#ifdef XP_WIN + +# if defined(MOZ_SANDBOX) + // We need to get the pref here as the process is launched off main thread. + if (mProcessType == GeckoProcessType_Content) { + // Win32k Lockdown state must be initialized on the main thread. + // This is our last chance to do it before it is read on the IPC Launch + // thread + GetWin32kLockdownState(); + mSandboxLevel = GetEffectiveContentSandboxLevel(); + mEnableSandboxLogging = + Preferences::GetBool("security.sandbox.logging.enabled"); + + // We currently have to whitelist certain paths for tests to work in some + // development configurations. + nsAutoString readPaths; + nsresult rv = Preferences::GetString( + "security.sandbox.content.read_path_whitelist", readPaths); + if (NS_SUCCEEDED(rv)) { + for (const nsAString& readPath : readPaths.Split(',')) { + nsString trimmedPath(readPath); + trimmedPath.Trim(" ", true, true); + std::wstring resolvedPath(trimmedPath.Data()); + // Check if path ends with '\' as this indicates we want to give read + // access to a directory and so it needs a wildcard. + if (resolvedPath.back() == L'\\') { + resolvedPath.append(L"*"); + } + mAllowedFilesRead.push_back(resolvedPath); + } + } + } +# endif + +# if defined(MOZ_SANDBOX) + // For other process types we can't rely on them being launched on main + // thread and they may not have access to prefs in the child process, so allow + // them to turn on logging via an environment variable. + mEnableSandboxLogging = + mEnableSandboxLogging || !!PR_GetEnv("MOZ_SANDBOX_LOGGING"); + +# endif +#elif defined(XP_MACOSX) +# if defined(MOZ_SANDBOX) + if (ShouldHaveDirectoryService() && + mProcessType != GeckoProcessType_GMPlugin) { + mozilla::Unused << NS_GetSpecialDirectory(NS_APP_USER_PROFILE_50_DIR, + getter_AddRefs(mProfileDir)); + } +# endif +#endif +} + +#ifdef XP_WIN +void GeckoChildProcessHost::InitWindowsGroupID() { + // On Win7+, pass the application user model to the child, so it can + // register with it. This insures windows created by the container + // properly group with the parent app on the Win7 taskbar. + nsCOMPtr<nsIWinTaskbar> taskbarInfo = do_GetService(NS_TASKBAR_CONTRACTID); + if (taskbarInfo) { + bool isSupported = false; + taskbarInfo->GetAvailable(&isSupported); + nsAutoString appId; + if (isSupported && NS_SUCCEEDED(taskbarInfo->GetDefaultGroupId(appId))) { + MOZ_ASSERT(mGroupId.EqualsLiteral("-")); + mGroupId.Assign(appId); + } + } +} +#endif + +bool GeckoChildProcessHost::SyncLaunch(std::vector<std::string> aExtraOpts, + int aTimeoutMs) { + if (!AsyncLaunch(std::move(aExtraOpts))) { + return false; + } + return WaitUntilConnected(aTimeoutMs); +} + +// Note: for most process types, we currently call AsyncLaunch, and therefore +// the *ProcessLauncher constructor, on the main thread, while the +// ProcessLauncher methods to actually execute the launch are called on the IO +// or IPC launcher thread. GMP processes are an exception - the GMP code +// invokes GeckoChildProcessHost from non-main-threads, and therefore we cannot +// rely on having access to mainthread-only services (like the directory +// service) from this code if we're launching that type of process. +bool GeckoChildProcessHost::AsyncLaunch(std::vector<std::string> aExtraOpts) { + PrepareLaunch(); + +#if defined(XP_MACOSX) && defined(MOZ_SANDBOX) + if (IsMacSandboxLaunchEnabled() && !AppendMacSandboxParams(aExtraOpts)) { + return false; + } +#endif + + RefPtr<BaseProcessLauncher> launcher = + new ProcessLauncher(this, std::move(aExtraOpts)); +#ifdef ALLOW_GECKO_CHILD_PROCESS_ARCH + launcher->SetLaunchArchitecture(mLaunchArch); +#endif + + // Note: Destroy() waits on mHandlePromise to delete |this|. As such, we want + // to be sure that all of our post-launch processing on |this| happens before + // mHandlePromise notifies. + MOZ_ASSERT(mHandlePromise == nullptr); + mHandlePromise = + mozilla::InvokeAsync<GeckoChildProcessHost*>( + IOThread(), launcher.get(), __func__, &BaseProcessLauncher::Launch, + this) + ->Then( + IOThread(), __func__, + [this](LaunchResults&& aResults) { + { + { + mozilla::AutoWriteLock handleLock(mHandleLock); + if (!OpenPrivilegedHandle(base::GetProcId(aResults.mHandle)) +#ifdef XP_WIN + // If we failed in opening the process handle, try + // harder by duplicating one. + && !::DuplicateHandle( + ::GetCurrentProcess(), aResults.mHandle, + ::GetCurrentProcess(), &mChildProcessHandle, + PROCESS_DUP_HANDLE | PROCESS_TERMINATE | + PROCESS_QUERY_INFORMATION | PROCESS_VM_READ | + SYNCHRONIZE, + FALSE, 0) +#endif // XP_WIN + ) { + MOZ_CRASH("cannot open handle to child process"); + } + // The original handle is no longer needed; it must + // be closed to prevent a resource leak. + base::CloseProcessHandle(aResults.mHandle); + // FIXME (bug 1720523): define a cross-platform + // "safe" invalid value to use in places like this. + aResults.mHandle = 0; + +#ifdef XP_MACOSX + this->mChildTask = aResults.mChildTask; + if (mNodeChannel) { + mNodeChannel->SetMachTaskPort(this->mChildTask); + } +#endif + } +#if defined(XP_WIN) && defined(MOZ_SANDBOX) + this->mSandboxBroker = std::move(aResults.mSandboxBroker); +#endif + + MonitorAutoLock lock(mMonitor); + // The OnChannel{Connected,Error} may have already advanced + // the state. + if (mProcessState < PROCESS_CREATED) { + mProcessState = PROCESS_CREATED; + } + lock.Notify(); + } + return ProcessHandlePromise::CreateAndResolve( + GetChildProcessHandle(), __func__); + }, + [this](const LaunchError aError) { + // WaitUntilConnected might be waiting for us to signal. + // If something failed let's set the error state and notify. + CHROMIUM_LOG(ERROR) + << "Failed to launch " + << XRE_GeckoProcessTypeToString(mProcessType) + << " subprocess"; + Telemetry::Accumulate( + Telemetry::SUBPROCESS_LAUNCH_FAILURE, + nsDependentCString( + XRE_GeckoProcessTypeToString(mProcessType))); + nsCString telemetryKey = nsPrintfCString( +#if defined(XP_WIN) + "%s,0x%lx,%s", +#else + "%s,%d,%s", +#endif + aError.FunctionName(), aError.ErrorCode(), + XRE_GeckoProcessTypeToString(mProcessType)); + // Max telemetry key is 72 chars + // https://searchfox.org/mozilla-central/rev/c244b16815d1fc827d141472b9faac5610f250e7/toolkit/components/telemetry/core/TelemetryScalar.cpp#105 + if (telemetryKey.Length() > 72) { + NS_WARNING(nsPrintfCString("Truncating telemetry key: %s", + telemetryKey.get()) + .get()); + telemetryKey.Truncate(72); + } + Telemetry::ScalarAdd( + Telemetry::ScalarID:: + DOM_PARENTPROCESS_PROCESS_LAUNCH_ERRORS, + NS_ConvertUTF8toUTF16(telemetryKey), 1); + { + MonitorAutoLock lock(mMonitor); + mProcessState = PROCESS_ERROR; + lock.Notify(); + } + return ProcessHandlePromise::CreateAndReject(aError, __func__); + }); + return true; +} + +bool GeckoChildProcessHost::WaitUntilConnected(int32_t aTimeoutMs) { + AUTO_PROFILER_LABEL("GeckoChildProcessHost::WaitUntilConnected", OTHER); + + // NB: this uses a different mechanism than the chromium parent + // class. + TimeDuration timeout = (aTimeoutMs > 0) + ? TimeDuration::FromMilliseconds(aTimeoutMs) + : TimeDuration::Forever(); + + MonitorAutoLock lock(mMonitor); + TimeStamp waitStart = TimeStamp::Now(); + TimeStamp current; + + // We'll receive several notifications, we need to exit when we + // have either successfully launched or have timed out. + while (mProcessState != PROCESS_CONNECTED) { + // If there was an error then return it, don't wait out the timeout. + if (mProcessState == PROCESS_ERROR) { + break; + } + + CVStatus status = lock.Wait(timeout); + if (status == CVStatus::Timeout) { + break; + } + + if (timeout != TimeDuration::Forever()) { + current = TimeStamp::Now(); + timeout -= current - waitStart; + waitStart = current; + } + } + + return mProcessState == PROCESS_CONNECTED; +} + +bool GeckoChildProcessHost::WaitForProcessHandle() { + MonitorAutoLock lock(mMonitor); + while (mProcessState < PROCESS_CREATED) { + lock.Wait(); + } + MOZ_ASSERT(mProcessState == PROCESS_ERROR || GetChildProcessHandle()); + + return mProcessState < PROCESS_ERROR; +} + +bool GeckoChildProcessHost::LaunchAndWaitForProcessHandle( + StringVector aExtraOpts) { + if (!AsyncLaunch(std::move(aExtraOpts))) { + return false; + } + return WaitForProcessHandle(); +} + +void GeckoChildProcessHost::InitializeChannel( + const std::function<void(IPC::Channel*)>& aChannelReady) { + CreateChannel(); + + aChannelReady(GetChannel()); + + mNodeController = NodeController::GetSingleton(); + std::tie(mInitialPort, mNodeChannel) = + mNodeController->InviteChildProcess(TakeChannel()); + + MonitorAutoLock lock(mMonitor); + mProcessState = CHANNEL_INITIALIZED; + lock.Notify(); +} + +void GeckoChildProcessHost::SetAlreadyDead() { + mozilla::AutoWriteLock handleLock(mHandleLock); + if (mChildProcessHandle && + mChildProcessHandle != base::kInvalidProcessHandle) { + base::CloseProcessHandle(mChildProcessHandle); + } + + mChildProcessHandle = 0; +} + +void BaseProcessLauncher::GetChildLogName(const char* origLogName, + nsACString& buffer) { +#ifdef XP_WIN + // On Windows we must expand relative paths because sandboxing rules + // bound only to full paths. fopen fowards to NtCreateFile which checks + // the path against the sanboxing rules as passed to fopen (left relative). + char absPath[MAX_PATH + 2]; + if (_fullpath(absPath, origLogName, sizeof(absPath))) { + buffer.Append(absPath); + } else +#endif + { + buffer.Append(origLogName); + } + + // Remove .moz_log extension to avoid its duplication, it will be added + // automatically by the logging backend + static constexpr auto kMozLogExt = nsLiteralCString{MOZ_LOG_FILE_EXTENSION}; + if (StringEndsWith(buffer, kMozLogExt)) { + buffer.Truncate(buffer.Length() - kMozLogExt.Length()); + } + + // Append child-specific postfix to name + buffer.AppendLiteral(".child-"); + buffer.AppendInt(mChildId); +} + +// Windows needs a single dedicated thread for process launching, +// because of thread-safety restrictions/assertions in the sandbox +// code. +// +// Android also needs a single dedicated thread to simplify thread +// safety in java. +// +// Fork server needs a dedicated thread for accessing +// |ForkServiceChild|. +#if defined(XP_WIN) || defined(MOZ_WIDGET_ANDROID) || \ + defined(MOZ_ENABLE_FORKSERVER) + +static mozilla::StaticMutex gIPCLaunchThreadMutex; +static mozilla::StaticRefPtr<nsIThread> gIPCLaunchThread + MOZ_GUARDED_BY(gIPCLaunchThreadMutex); + +class IPCLaunchThreadObserver final : public nsIObserver { + public: + NS_DECL_ISUPPORTS + NS_DECL_NSIOBSERVER + protected: + virtual ~IPCLaunchThreadObserver() = default; +}; + +NS_IMPL_ISUPPORTS(IPCLaunchThreadObserver, nsIObserver, nsISupports) + +NS_IMETHODIMP +IPCLaunchThreadObserver::Observe(nsISupports* aSubject, const char* aTopic, + const char16_t* aData) { + MOZ_RELEASE_ASSERT(strcmp(aTopic, "xpcom-shutdown-threads") == 0); + StaticMutexAutoLock lock(gIPCLaunchThreadMutex); + + nsresult rv = NS_OK; + if (gIPCLaunchThread) { + rv = gIPCLaunchThread->Shutdown(); + gIPCLaunchThread = nullptr; + } + mozilla::Unused << NS_WARN_IF(NS_FAILED(rv)); + return rv; +} + +nsCOMPtr<nsIEventTarget> GetIPCLauncher() { + StaticMutexAutoLock lock(gIPCLaunchThreadMutex); + if (!gIPCLaunchThread) { + nsCOMPtr<nsIThread> thread; + nsresult rv = NS_NewNamedThread("IPC Launch"_ns, getter_AddRefs(thread)); + if (!NS_WARN_IF(NS_FAILED(rv))) { + NS_DispatchToMainThread( + NS_NewRunnableFunction("GeckoChildProcessHost::GetIPCLauncher", [] { + nsCOMPtr<nsIObserverService> obsService = + mozilla::services::GetObserverService(); + nsCOMPtr<nsIObserver> obs = new IPCLaunchThreadObserver(); + obsService->AddObserver(obs, "xpcom-shutdown-threads", false); + })); + gIPCLaunchThread = thread.forget(); + } + } + + nsCOMPtr<nsIEventTarget> thread = gIPCLaunchThread.get(); + MOZ_DIAGNOSTIC_ASSERT(thread); + return thread; +} + +#else // defined(XP_WIN) || defined(MOZ_WIDGET_ANDROID) || + // defined(MOZ_ENABLE_FORKSERVER) + +// Other platforms use an on-demand thread pool. + +nsCOMPtr<nsIEventTarget> GetIPCLauncher() { + nsCOMPtr<nsIEventTarget> pool = + mozilla::SharedThreadPool::Get("IPC Launch"_ns); + MOZ_DIAGNOSTIC_ASSERT(pool); + return pool; +} + +#endif // XP_WIN || MOZ_WIDGET_ANDROID || MOZ_ENABLE_FORKSERVER + +void +#if defined(XP_WIN) +AddAppDirToCommandLine(CommandLine& aCmdLine, nsIFile* aAppDir) +#else +AddAppDirToCommandLine(std::vector<std::string>& aCmdLine, nsIFile* aAppDir, + nsIFile* aProfileDir) +#endif +{ + // Content processes need access to application resources, so pass + // the full application directory path to the child process. + if (aAppDir) { +#if defined(XP_WIN) + nsString path; + MOZ_ALWAYS_SUCCEEDS(aAppDir->GetPath(path)); + aCmdLine.AppendLooseValue(UTF8ToWide(geckoargs::sAppDir.Name())); + std::wstring wpath(path.get()); + aCmdLine.AppendLooseValue(wpath); +#else + nsAutoCString path; + MOZ_ALWAYS_SUCCEEDS(aAppDir->GetNativePath(path)); + geckoargs::sAppDir.Put(path.get(), aCmdLine); +#endif + +#if defined(XP_MACOSX) && defined(MOZ_SANDBOX) + // Full path to the profile dir + if (aProfileDir) { + // If the profile doesn't exist, normalization will + // fail. But we don't return an error here because some + // tests require startup with a missing profile dir. + // For users, almost universally, the profile will be in + // the home directory and normalization isn't required. + mozilla::Unused << aProfileDir->Normalize(); + nsAutoCString path; + MOZ_ALWAYS_SUCCEEDS(aProfileDir->GetNativePath(path)); + geckoargs::sProfile.Put(path.get(), aCmdLine); + } +#endif + } +} + +#if defined(XP_WIN) && (defined(MOZ_SANDBOX) || defined(_ARM64_)) +static bool Contains(const std::vector<std::string>& aExtraOpts, + const char* aValue) { + return std::any_of(aExtraOpts.begin(), aExtraOpts.end(), + [&](const std::string arg) { + return arg.find(aValue) != std::string::npos; + }); +} +#endif // defined(XP_WIN) && (defined(MOZ_SANDBOX) || defined(_ARM64_)) + +RefPtr<ProcessLaunchPromise> BaseProcessLauncher::PerformAsyncLaunch() { + Result<Ok, LaunchError> aError = DoSetup(); + if (aError.isErr()) { + return ProcessLaunchPromise::CreateAndReject(aError.unwrapErr(), __func__); + } + RefPtr<BaseProcessLauncher> self = this; + return DoLaunch()->Then( + mLaunchThread, __func__, + [self](base::ProcessHandle aHandle) { + self->mResults.mHandle = aHandle; + return self->FinishLaunch(); + }, + [](LaunchError aError) { + return ProcessLaunchPromise::CreateAndReject(aError, __func__); + }); +} + +Result<Ok, LaunchError> BaseProcessLauncher::DoSetup() { + RefPtr<BaseProcessLauncher> self = this; + GetProfilerEnvVarsForChildProcess([self](const char* key, const char* value) { + self->mLaunchOptions->env_map[ENVIRONMENT_STRING(key)] = + ENVIRONMENT_STRING(value); + }); +#ifdef MOZ_MEMORY + if (mProcessType == GeckoProcessType_Content) { + nsAutoCString mallocOpts(PR_GetEnv("MALLOC_OPTIONS")); + // Disable randomization of small arenas in content. + mallocOpts.Append("r"); + self->mLaunchOptions->env_map[ENVIRONMENT_LITERAL("MALLOC_OPTIONS")] = + ENVIRONMENT_STRING(mallocOpts.get()); + } +#endif + + MapChildLogging(); + + PRStatus status = PR_CreatePipe(&mCrashAnnotationReadPipe.rwget(), + &mCrashAnnotationWritePipe.rwget()); + if (status != PR_SUCCESS) { + return Err(LaunchError("PR_CreatePipe", PR_GetError())); + } + return Ok(); +} + +void BaseProcessLauncher::MapChildLogging() { + const char* origNSPRLogName = PR_GetEnv("NSPR_LOG_FILE"); + const char* origMozLogName = PR_GetEnv("MOZ_LOG_FILE"); + + if (origNSPRLogName) { + nsAutoCString nsprLogName; + GetChildLogName(origNSPRLogName, nsprLogName); + mLaunchOptions->env_map[ENVIRONMENT_LITERAL("NSPR_LOG_FILE")] = + ENVIRONMENT_STRING(nsprLogName.get()); + } + if (origMozLogName) { + nsAutoCString mozLogName; + GetChildLogName(origMozLogName, mozLogName); + mLaunchOptions->env_map[ENVIRONMENT_LITERAL("MOZ_LOG_FILE")] = + ENVIRONMENT_STRING(mozLogName.get()); + } + + // `RUST_LOG_CHILD` is meant for logging child processes only. + nsAutoCString childRustLog(PR_GetEnv("RUST_LOG_CHILD")); + if (!childRustLog.IsEmpty()) { + mLaunchOptions->env_map[ENVIRONMENT_LITERAL("RUST_LOG")] = + ENVIRONMENT_STRING(childRustLog.get()); + } +} + +#if defined(MOZ_WIDGET_GTK) +Result<Ok, LaunchError> LinuxProcessLauncher::DoSetup() { + Result<Ok, LaunchError> aError = PosixProcessLauncher::DoSetup(); + if (aError.isErr()) { + return aError; + } + + if (mProcessType == GeckoProcessType_Content) { + // disable IM module to avoid sandbox violation + mLaunchOptions->env_map["GTK_IM_MODULE"] = "gtk-im-context-simple"; + + // Disable ATK accessibility code in content processes because it conflicts + // with the sandbox, and we proxy that information through the main process + // anyway. + mLaunchOptions->env_map["NO_AT_BRIDGE"] = "1"; + } + +# ifdef MOZ_SANDBOX + if (!mTmpDirName.IsEmpty()) { + // Point a bunch of things that might want to write from content to our + // shiny new content-process specific tmpdir + mLaunchOptions->env_map[ENVIRONMENT_LITERAL("TMPDIR")] = + ENVIRONMENT_STRING(mTmpDirName.get()); + // Partial fix for bug 1380051 (not persistent - should be) + mLaunchOptions->env_map[ENVIRONMENT_LITERAL("MESA_GLSL_CACHE_DIR")] = + ENVIRONMENT_STRING(mTmpDirName.get()); + } +# endif // MOZ_SANDBOX + + return Ok(); +} +#endif // MOZ_WIDGET_GTK + +#ifdef OS_POSIX +Result<Ok, LaunchError> PosixProcessLauncher::DoSetup() { + Result<Ok, LaunchError> aError = BaseProcessLauncher::DoSetup(); + if (aError.isErr()) { + return aError; + } + + // XPCOM may not be initialized in some subprocesses. We don't want + // to initialize XPCOM just for the directory service, especially + // since LD_LIBRARY_PATH is already set correctly in subprocesses + // (meaning that we don't need to set that up in the environment). + if (ShouldHaveDirectoryService()) { + MOZ_ASSERT(gGREBinPath); + nsCString path; + NS_CopyUnicodeToNative(nsDependentString(gGREBinPath), path); +# if defined(OS_LINUX) || defined(OS_BSD) + const char* ld_library_path = PR_GetEnv("LD_LIBRARY_PATH"); + nsCString new_ld_lib_path(path.get()); + + if (ld_library_path && *ld_library_path) { + new_ld_lib_path.Append(':'); + new_ld_lib_path.Append(ld_library_path); + } + mLaunchOptions->env_map["LD_LIBRARY_PATH"] = new_ld_lib_path.get(); + +# elif OS_MACOSX // defined(OS_LINUX) || defined(OS_BSD) + // With signed production Mac builds, the dynamic linker (dyld) will + // ignore dyld environment variables preventing the use of variables + // such as DYLD_LIBRARY_PATH and DYLD_INSERT_LIBRARIES. + + // If we're running with gtests, add the gtest XUL ahead of normal XUL on + // the DYLD_LIBRARY_PATH so that plugin-container.app loads it instead. + nsCString new_dyld_lib_path(path.get()); + if (PR_GetEnv("MOZ_RUN_GTEST")) { + new_dyld_lib_path = path + "/gtest:"_ns + new_dyld_lib_path; + mLaunchOptions->env_map["DYLD_LIBRARY_PATH"] = new_dyld_lib_path.get(); + } + + // DYLD_INSERT_LIBRARIES is currently unused by default but we allow + // it to be set by the external environment. + const char* interpose = PR_GetEnv("DYLD_INSERT_LIBRARIES"); + if (interpose && strlen(interpose) > 0) { + mLaunchOptions->env_map["DYLD_INSERT_LIBRARIES"] = interpose; + } + + // Prevent connection attempts to diagnosticd(8) to save cycles. Log + // messages can trigger these connection attempts, but access to + // diagnosticd is blocked in sandboxed child processes. +# ifdef MOZ_SANDBOX + if (mDisableOSActivityMode) { + mLaunchOptions->env_map["OS_ACTIVITY_MODE"] = "disable"; + } +# endif // defined(MOZ_SANDBOX) +# endif // defined(OS_LINUX) || defined(OS_BSD) + } + + FilePath exePath; + BinPathType pathType = GetPathToBinary(exePath, mProcessType); + + // remap the IPC socket fd to a well-known int, as the OS does for + // STDOUT_FILENO, for example + // The fork server doesn't use IPC::Channel, so can skip this step. + if (mProcessType != GeckoProcessType_ForkServer) { +# ifdef MOZ_WIDGET_ANDROID + // On Android mChannelDstFd is uninitialised and the launching code uses + // only the first of each pair. + mLaunchOptions->fds_to_remap.push_back( + std::pair<int, int>(mChannelSrcFd.get(), -1)); +# else + MOZ_ASSERT(mChannelDstFd >= 0); + mLaunchOptions->fds_to_remap.push_back( + std::pair<int, int>(mChannelSrcFd.get(), mChannelDstFd)); +# endif + } + + // no need for kProcessChannelID, the child process inherits the + // other end of the socketpair() from us + + mChildArgv.push_back(exePath.value()); + + if (pathType == BinPathType::Self) { + mChildArgv.push_back("-contentproc"); + } + + mChildArgv.insert(mChildArgv.end(), mExtraOpts.begin(), mExtraOpts.end()); + + if (mProcessType != GeckoProcessType_GMPlugin) { +# if defined(MOZ_WIDGET_ANDROID) + if (Omnijar::IsInitialized()) { + // Make sure that child processes can find the omnijar + // See XRE_InitCommandLine in nsAppRunner.cpp + nsAutoCString path; + nsCOMPtr<nsIFile> file = Omnijar::GetPath(Omnijar::GRE); + if (file && NS_SUCCEEDED(file->GetNativePath(path))) { + mChildArgv.push_back("-greomni"); + mChildArgv.push_back(path.get()); + } + } +# endif + // Add the application directory path (-appdir path) +# ifdef XP_MACOSX + AddAppDirToCommandLine(mChildArgv, mAppDir, mProfileDir); +# else + AddAppDirToCommandLine(mChildArgv, mAppDir, nullptr); +# endif + } + + mChildArgv.push_back(mInitialChannelIdString); + + mChildArgv.push_back(mPidString); + + if (!CrashReporter::IsDummy()) { +# if defined(OS_LINUX) || defined(OS_BSD) || defined(OS_SOLARIS) + int childCrashFd, childCrashRemapFd; + if (NS_WARN_IF(!CrashReporter::CreateNotificationPipeForChild( + &childCrashFd, &childCrashRemapFd))) { + return Err(LaunchError("CR::CreateNotificationPipeForChild")); + } + + if (0 <= childCrashFd) { + mLaunchOptions->fds_to_remap.push_back( + std::pair<int, int>(childCrashFd, childCrashRemapFd)); + // "true" == crash reporting enabled + mChildArgv.push_back("true"); + } else { + // "false" == crash reporting disabled + mChildArgv.push_back("false"); + } +# elif defined(MOZ_WIDGET_COCOA) /* defined(OS_LINUX) || defined(OS_BSD) || \ + defined(OS_SOLARIS) */ + mChildArgv.push_back(CrashReporter::GetChildNotificationPipe()); +# endif // defined(OS_LINUX) || defined(OS_BSD) || defined(OS_SOLARIS) + } + + int fd = PR_FileDesc2NativeHandle(mCrashAnnotationWritePipe); + mLaunchOptions->fds_to_remap.push_back( + std::make_pair(fd, CrashReporter::GetAnnotationTimeCrashFd())); + +# ifdef MOZ_WIDGET_COCOA + { + auto* thisMac = static_cast<MacProcessLauncher*>(this); + kern_return_t kr = + bootstrap_check_in(bootstrap_port, thisMac->mMachConnectionName.c_str(), + getter_Transfers(thisMac->mParentRecvPort)); + if (kr != KERN_SUCCESS) { + CHROMIUM_LOG(ERROR) << "parent bootstrap_check_in failed: " + << mach_error_string(kr); + return Err(LaunchError("bootstrap_check_in", kr)); + } + mChildArgv.push_back(thisMac->mMachConnectionName.c_str()); + } +# endif // MOZ_WIDGET_COCOA + + mChildArgv.push_back(ChildProcessType()); + return Ok(); +} +#endif // OS_POSIX + +#if defined(MOZ_WIDGET_ANDROID) +RefPtr<ProcessHandlePromise> AndroidProcessLauncher::DoLaunch() { + return LaunchAndroidService(mProcessType, mChildArgv, + mLaunchOptions->fds_to_remap); +} +#endif // MOZ_WIDGET_ANDROID + +#ifdef OS_POSIX +RefPtr<ProcessHandlePromise> PosixProcessLauncher::DoLaunch() { + ProcessHandle handle = 0; + Result<Ok, LaunchError> aError = + base::LaunchApp(mChildArgv, *mLaunchOptions, &handle); + if (aError.isErr()) { + return ProcessHandlePromise::CreateAndReject(aError.unwrapErr(), __func__); + } + return ProcessHandlePromise::CreateAndResolve(handle, __func__); +} + +Result<Ok, LaunchError> PosixProcessLauncher::DoFinishLaunch() { + Result<Ok, LaunchError> aError = BaseProcessLauncher::DoFinishLaunch(); + if (aError.isErr()) { + return aError; + } + + // We're in the parent and the child was launched. Close the child FD in the + // parent as soon as possible, which will allow the parent to detect when the + // child closes its FD (either due to normal exit or due to crash). + mChannelSrcFd = nullptr; + + return Ok(); +} +#endif // OS_POSIX + +#ifdef XP_MACOSX +Result<Ok, LaunchError> MacProcessLauncher::DoFinishLaunch() { + Result<Ok, LaunchError> aError = PosixProcessLauncher::DoFinishLaunch(); + if (aError.isErr()) { + return aError; + } + + MOZ_ASSERT(mParentRecvPort, "should have been configured during DoSetup()"); + + // Wait for the child process to send us its 'task_t' data. + const int kTimeoutMs = 10000; + + mozilla::UniqueMachSendRight child_task; + audit_token_t audit_token{}; + kern_return_t kr = MachReceivePortSendRight( + mParentRecvPort, mozilla::Some(kTimeoutMs), &child_task, &audit_token); + if (kr != KERN_SUCCESS) { + std::string errString = StringPrintf("0x%x %s", kr, mach_error_string(kr)); + CHROMIUM_LOG(ERROR) << "parent MachReceivePortSendRight failed: " + << errString; + return Err(LaunchError("MachReceivePortSendRight", kr)); + } + + // Ensure the message was sent by the newly spawned child process. + if (audit_token_to_pid(audit_token) != base::GetProcId(mResults.mHandle)) { + CHROMIUM_LOG(ERROR) << "task_t was not sent by child process"; + return Err(LaunchError("audit_token_to_pid")); + } + + // Ensure the task_t corresponds to the newly spawned child process. + pid_t task_pid = -1; + kr = pid_for_task(child_task.get(), &task_pid); + if (kr != KERN_SUCCESS) { + CHROMIUM_LOG(ERROR) << "pid_for_task failed: " << mach_error_string(kr); + return Err(LaunchError("pid_for_task", kr)); + } + if (task_pid != base::GetProcId(mResults.mHandle)) { + CHROMIUM_LOG(ERROR) << "task_t is not for child process"; + return Err(LaunchError("task_pid")); + } + + mResults.mChildTask = child_task.release(); + + return Ok(); +} +#endif // XP_MACOSX + +#ifdef XP_WIN +Result<Ok, LaunchError> WindowsProcessLauncher::DoSetup() { + Result<Ok, LaunchError> aError = BaseProcessLauncher::DoSetup(); + if (aError.isErr()) { + return aError; + } + + FilePath exePath; + BinPathType pathType = GetPathToBinary(exePath, mProcessType); + +# if defined(MOZ_SANDBOX) || defined(_ARM64_) + const bool isGMP = mProcessType == GeckoProcessType_GMPlugin; + const bool isWidevine = isGMP && Contains(mExtraOpts, "gmp-widevinecdm"); +# if defined(_ARM64_) + bool useRemoteSandboxBroker = false; + if (mLaunchArch & (base::PROCESS_ARCH_I386 | base::PROCESS_ARCH_X86_64)) { + // On Windows on ARM64 for ClearKey and Widevine, and for the sandbox + // launcher process, we want to run the x86 plugin-container.exe in + // the "i686" subdirectory, instead of the aarch64 plugin-container.exe. + // So insert "i686" into the exePath. + exePath = exePath.DirName().AppendASCII("i686").Append(exePath.BaseName()); + useRemoteSandboxBroker = + mProcessType != GeckoProcessType_RemoteSandboxBroker; + } +# endif // if defined(_ARM64_) +# endif // defined(MOZ_SANDBOX) || defined(_ARM64_) + + mCmdLine.emplace(exePath.ToWStringHack()); + + if (pathType == BinPathType::Self) { + mCmdLine->AppendLooseValue(UTF8ToWide("-contentproc")); + } + +# ifdef HAS_DLL_BLOCKLIST + if (IsDynamicBlocklistDisabled( + gSafeMode, + CommandLine::ForCurrentProcess()->HasSwitch(UTF8ToWide( + mozilla::geckoargs::sDisableDynamicDllBlocklist.sMatch)))) { + mCmdLine->AppendLooseValue( + UTF8ToWide(mozilla::geckoargs::sDisableDynamicDllBlocklist.sMatch)); + } +# endif // HAS_DLL_BLOCKLIST + + mCmdLine->AppendSwitchWithValue(switches::kProcessChannelID, mChannelId); + + for (std::vector<std::string>::iterator it = mExtraOpts.begin(); + it != mExtraOpts.end(); ++it) { + mCmdLine->AppendLooseValue(UTF8ToWide(*it)); + } + +# if defined(MOZ_SANDBOX) +# if defined(_ARM64_) + if (useRemoteSandboxBroker) + mResults.mSandboxBroker = new RemoteSandboxBroker(mLaunchArch); + else +# endif // if defined(_ARM64_) + mResults.mSandboxBroker = new SandboxBroker(); + + // XXX: Bug 1124167: We should get rid of the process specific logic for + // sandboxing in this class at some point. Unfortunately it will take a bit + // of reorganizing so I don't think this patch is the right time. + switch (mProcessType) { + case GeckoProcessType_Content: + if (mSandboxLevel > 0) { + // For now we treat every failure as fatal in + // SetSecurityLevelForContentProcess and just crash there right away. + // Should this change in the future then we should also handle the error + // here. + mResults.mSandboxBroker->SetSecurityLevelForContentProcess( + mSandboxLevel, mIsFileContent); + mUseSandbox = true; + } + break; + case GeckoProcessType_IPDLUnitTest: + // XXX: We don't sandbox this process type yet + break; + case GeckoProcessType_GMPlugin: + if (!PR_GetEnv("MOZ_DISABLE_GMP_SANDBOX")) { + // The Widevine CDM on Windows can only load at USER_RESTRICTED, + // not at USER_LOCKDOWN. So look in the command line arguments + // to see if we're loading the path to the Widevine CDM, and if + // so use sandbox level USER_RESTRICTED instead of USER_LOCKDOWN. + auto level = + isWidevine ? SandboxBroker::Restricted : SandboxBroker::LockDown; + if (NS_WARN_IF( + !mResults.mSandboxBroker->SetSecurityLevelForGMPlugin(level))) { + return Err(LaunchError("SetSecurityLevelForGMPlugin")); + } + mUseSandbox = true; + } + break; + case GeckoProcessType_GPU: + if (mSandboxLevel > 0 && !PR_GetEnv("MOZ_DISABLE_GPU_SANDBOX")) { + // For now we treat every failure as fatal in + // SetSecurityLevelForGPUProcess and just crash there right away. Should + // this change in the future then we should also handle the error here. + mResults.mSandboxBroker->SetSecurityLevelForGPUProcess(mSandboxLevel); + mUseSandbox = true; + } + break; + case GeckoProcessType_VR: + if (mSandboxLevel > 0 && !PR_GetEnv("MOZ_DISABLE_VR_SANDBOX")) { + // TODO: Implement sandbox for VR process, Bug 1430043. + } + break; + case GeckoProcessType_RDD: + if (!PR_GetEnv("MOZ_DISABLE_RDD_SANDBOX")) { + if (NS_WARN_IF( + !mResults.mSandboxBroker->SetSecurityLevelForRDDProcess())) { + return Err(LaunchError("SetSecurityLevelForRDDProcess")); + } + mUseSandbox = true; + } + break; + case GeckoProcessType_Socket: + if (!PR_GetEnv("MOZ_DISABLE_SOCKET_PROCESS_SANDBOX")) { + if (NS_WARN_IF( + !mResults.mSandboxBroker->SetSecurityLevelForSocketProcess())) { + return Err(LaunchError("SetSecurityLevelForSocketProcess")); + } + mUseSandbox = true; + } + break; + case GeckoProcessType_Utility: + if (!PR_GetEnv("MOZ_DISABLE_UTILITY_SANDBOX")) { + if (!mResults.mSandboxBroker->SetSecurityLevelForUtilityProcess( + mSandbox)) { + return Err(LaunchError("SetSecurityLevelForUtilityProcess")); + } + mUseSandbox = true; + } + break; + case GeckoProcessType_RemoteSandboxBroker: + // We don't sandbox the sandbox launcher... + break; + case GeckoProcessType_Default: + default: + MOZ_CRASH("Bad process type in GeckoChildProcessHost"); + break; + }; + + if (mUseSandbox) { + for (auto it = mAllowedFilesRead.begin(); it != mAllowedFilesRead.end(); + ++it) { + mResults.mSandboxBroker->AllowReadFile(it->c_str()); + } + + if (mResults.mSandboxBroker->IsWin32kLockedDown()) { + mCmdLine->AppendLooseValue( + UTF8ToWide(geckoargs::sWin32kLockedDown.Name())); + } + } +# endif // defined(MOZ_SANDBOX) + + // Add the application directory path (-appdir path) + AddAppDirToCommandLine(mCmdLine.ref(), mAppDir); + + // XXX Command line params past this point are expected to be at + // the end of the command line string, and in a specific order. + // See XRE_InitChildProcess in nsEmbedFunction. + + // Win app model id + mCmdLine->AppendLooseValue(mGroupId.get()); + + // Initial MessageChannel id + mCmdLine->AppendLooseValue(UTF8ToWide(mInitialChannelIdString)); + + // Process id + mCmdLine->AppendLooseValue(UTF8ToWide(mPidString)); + + mCmdLine->AppendLooseValue( + UTF8ToWide(CrashReporter::GetChildNotificationPipe())); + + if (!CrashReporter::IsDummy()) { + PROsfd h = PR_FileDesc2NativeHandle(mCrashAnnotationWritePipe); + mLaunchOptions->handles_to_inherit.push_back(reinterpret_cast<HANDLE>(h)); + std::string hStr = std::to_string(h); + mCmdLine->AppendLooseValue(UTF8ToWide(hStr)); + + char werDataAddress[17] = {}; + SprintfLiteral(werDataAddress, "%p", mWerDataPointer); + mCmdLine->AppendLooseValue(UTF8ToWide(werDataAddress)); + } + + // Process type + mCmdLine->AppendLooseValue(UTF8ToWide(ChildProcessType())); + +# ifdef MOZ_SANDBOX + if (mUseSandbox) { + // Mark the handles to inherit as inheritable. + for (HANDLE h : mLaunchOptions->handles_to_inherit) { + mResults.mSandboxBroker->AddHandleToShare(h); + } + } +# endif // MOZ_SANDBOX + + return Ok(); +} + +RefPtr<ProcessHandlePromise> WindowsProcessLauncher::DoLaunch() { + ProcessHandle handle = 0; +# ifdef MOZ_SANDBOX + if (mUseSandbox) { + const IMAGE_THUNK_DATA* cachedNtdllThunk = + mCachedNtdllThunk ? mCachedNtdllThunk->begin() : nullptr; + Result<Ok, LaunchError> err = mResults.mSandboxBroker->LaunchApp( + mCmdLine->program().c_str(), mCmdLine->command_line_string().c_str(), + mLaunchOptions->env_map, mProcessType, mEnableSandboxLogging, + cachedNtdllThunk, &handle); + if (err.isOk()) { + EnvironmentLog("MOZ_PROCESS_LOG") + .print("==> process %d launched child process %d (%S)\n", + base::GetCurrentProcId(), base::GetProcId(handle), + mCmdLine->command_line_string().c_str()); + return ProcessHandlePromise::CreateAndResolve(handle, __func__); + } + return ProcessHandlePromise::CreateAndReject(err.unwrapErr(), __func__); + } +# endif // defined(MOZ_SANDBOX) + + Result<Ok, LaunchError> launchErr = + base::LaunchApp(mCmdLine.ref(), *mLaunchOptions, &handle); + if (launchErr.isErr()) { + return ProcessHandlePromise::CreateAndReject(launchErr.unwrapErr(), + __func__); + } + return ProcessHandlePromise::CreateAndResolve(handle, __func__); +} + +Result<Ok, LaunchError> WindowsProcessLauncher::DoFinishLaunch() { + Result<Ok, LaunchError> err = BaseProcessLauncher::DoFinishLaunch(); + if (err.isErr()) { + return err; + } + +# ifdef MOZ_SANDBOX + if (!mUseSandbox) { + // We need to be able to duplicate handles to some types of non-sandboxed + // child processes. + switch (mProcessType) { + case GeckoProcessType_Default: + MOZ_CRASH("shouldn't be launching a parent process"); + case GeckoProcessType_IPDLUnitTest: + // No handle duplication necessary. + break; + default: + if (!SandboxBroker::AddTargetPeer(mResults.mHandle)) { + NS_WARNING("Failed to add child process as target peer."); + } + break; + } + } +# endif // MOZ_SANDBOX + + return Ok(); +} +#endif // XP_WIN + +RefPtr<ProcessLaunchPromise> BaseProcessLauncher::FinishLaunch() { + Result<Ok, LaunchError> aError = DoFinishLaunch(); + if (aError.isErr()) { + return ProcessLaunchPromise::CreateAndReject(aError.unwrapErr(), __func__); + } + + MOZ_DIAGNOSTIC_ASSERT(mResults.mHandle); + + CrashReporter::RegisterChildCrashAnnotationFileDescriptor( + base::GetProcId(mResults.mHandle), mCrashAnnotationReadPipe.forget()); + + Telemetry::AccumulateTimeDelta(Telemetry::CHILD_PROCESS_LAUNCH_MS, + mStartTimeStamp); + + return ProcessLaunchPromise::CreateAndResolve(mResults, __func__); +} + +bool GeckoChildProcessHost::OpenPrivilegedHandle(base::ProcessId aPid) { + if (mChildProcessHandle) { + MOZ_ASSERT(aPid == base::GetProcId(mChildProcessHandle)); + return true; + } + + return base::OpenPrivilegedProcessHandle(aPid, &mChildProcessHandle); +} + +void GeckoChildProcessHost::OnChannelConnected(base::ProcessId peer_pid) { + { + mozilla::AutoWriteLock hLock(mHandleLock); + if (!OpenPrivilegedHandle(peer_pid)) { + MOZ_CRASH("can't open handle to child process"); + } + } + MonitorAutoLock lock(mMonitor); + mProcessState = PROCESS_CONNECTED; + lock.Notify(); +} + +void GeckoChildProcessHost::OnMessageReceived(UniquePtr<IPC::Message> aMsg) { + // We never process messages ourself, just save them up for the next + // listener. + mQueue.push(std::move(aMsg)); +} + +void GeckoChildProcessHost::OnChannelError() { + // Update the process state to an error state if we have a channel + // error before we're connected. This fixes certain failures, + // but does not address the full range of possible issues described + // in the FIXME comment below. + MonitorAutoLock lock(mMonitor); + if (mProcessState < PROCESS_CONNECTED) { + mProcessState = PROCESS_ERROR; + lock.Notify(); + } + // FIXME/bug 773925: save up this error for the next listener. +} + +RefPtr<ProcessHandlePromise> GeckoChildProcessHost::WhenProcessHandleReady() { + MOZ_ASSERT(mHandlePromise != nullptr); + return mHandlePromise; +} + +void GeckoChildProcessHost::GetQueuedMessages( + std::queue<UniquePtr<IPC::Message>>& queue) { + // If this is called off the IO thread, bad things will happen. + DCHECK(MessageLoopForIO::current()); + swap(queue, mQueue); + // We expect the next listener to take over processing of our queue. +} + +#ifdef MOZ_WIDGET_ANDROID +RefPtr<ProcessHandlePromise> AndroidProcessLauncher::LaunchAndroidService( + const GeckoProcessType aType, const std::vector<std::string>& argv, + const base::file_handle_mapping_vector& fds_to_remap) { + MOZ_RELEASE_ASSERT((2 <= fds_to_remap.size()) && (fds_to_remap.size() <= 5)); + JNIEnv* const env = mozilla::jni::GetEnvForThread(); + MOZ_ASSERT(env); + + const int argvSize = argv.size(); + jni::ObjectArray::LocalRef jargs = + jni::ObjectArray::New<jni::String>(argvSize); + for (int ix = 0; ix < argvSize; ix++) { + jargs->SetElement(ix, jni::StringParam(argv[ix].c_str(), env)); + } + + // XXX: this processing depends entirely on the internals of + // ContentParent::LaunchSubprocess() + // GeckoChildProcessHost::PerformAsyncLaunch(), and the order in + // which they append to fds_to_remap. There must be a better way to do it. + // See bug 1440207. + int32_t prefsFd = fds_to_remap[0].first; + int32_t prefMapFd = fds_to_remap[1].first; + int32_t ipcFd = fds_to_remap[2].first; + int32_t crashFd = -1; + int32_t crashAnnotationFd = -1; + if (fds_to_remap.size() == 4) { + crashAnnotationFd = fds_to_remap[3].first; + } + if (fds_to_remap.size() == 5) { + crashFd = fds_to_remap[3].first; + crashAnnotationFd = fds_to_remap[4].first; + } + + auto type = java::GeckoProcessType::FromInt(aType); + auto genericResult = java::GeckoProcessManager::Start( + type, jargs, prefsFd, prefMapFd, ipcFd, crashFd, crashAnnotationFd); + auto typedResult = java::GeckoResult::LocalRef(std::move(genericResult)); + return ProcessHandlePromise::FromGeckoResult(typedResult); +} +#endif + +#if defined(XP_MACOSX) && defined(MOZ_SANDBOX) +bool GeckoChildProcessHost::AppendMacSandboxParams(StringVector& aArgs) { + MacSandboxInfo info; + if (NS_WARN_IF(!FillMacSandboxInfo(info))) { + return false; + } + info.AppendAsParams(aArgs); + return true; +} + +// Fill |aInfo| with the flags needed to launch the utility sandbox +bool GeckoChildProcessHost::FillMacSandboxInfo(MacSandboxInfo& aInfo) { + aInfo.type = GetDefaultMacSandboxType(); + aInfo.shouldLog = Preferences::GetBool("security.sandbox.logging.enabled") || + PR_GetEnv("MOZ_SANDBOX_LOGGING"); + + nsAutoCString appPath; + if (!nsMacUtilsImpl::GetAppPath(appPath)) { + MOZ_CRASH("Failed to get app path"); + } + aInfo.appPath.assign(appPath.get()); + return true; +} + +void GeckoChildProcessHost::DisableOSActivityMode() { + mDisableOSActivityMode = true; +} + +// +// If early sandbox startup is enabled for this process type, map the +// process type to the sandbox type and enable the sandbox. Returns true +// if no errors were encountered or if early sandbox startup is not +// enabled for this process. Returns false if an error was encountered. +// +/* static */ +bool GeckoChildProcessHost::StartMacSandbox(int aArgc, char** aArgv, + std::string& aErrorMessage) { + MacSandboxType sandboxType = MacSandboxType_Invalid; + switch (XRE_GetProcessType()) { + // For now, only support early sandbox startup for content, + // RDD, and GMP processes. Add case statements for the additional + // process types once early sandbox startup is implemented for them. + case GeckoProcessType_Content: + // Content processes don't use GeckoChildProcessHost + // to configure sandboxing so hard code the sandbox type. + sandboxType = MacSandboxType_Content; + break; + case GeckoProcessType_RDD: + sandboxType = RDDProcessHost::GetMacSandboxType(); + break; + case GeckoProcessType_Socket: + sandboxType = net::SocketProcessHost::GetMacSandboxType(); + break; + case GeckoProcessType_GMPlugin: + sandboxType = gmp::GMPProcessParent::GetMacSandboxType(); + break; + case GeckoProcessType_Utility: + sandboxType = ipc::UtilityProcessHost::GetMacSandboxType(); + break; + default: + return true; + } + + return mozilla::StartMacSandboxIfEnabled(sandboxType, aArgc, aArgv, + aErrorMessage); +} + +#endif /* XP_MACOSX && MOZ_SANDBOX */ + +/* static */ +void GeckoChildProcessHost::GetAll(const GeckoProcessCallback& aCallback) { + StaticMutexAutoLock lock(sMutex); + if (!sGeckoChildProcessHosts) { + return; + } + for (GeckoChildProcessHost* gp = sGeckoChildProcessHosts->getFirst(); gp; + gp = static_cast<mozilla::LinkedListElement<GeckoChildProcessHost>*>(gp) + ->getNext()) { + aCallback(gp); + } +} + +RefPtr<ProcessLaunchPromise> BaseProcessLauncher::Launch( + GeckoChildProcessHost* aHost) { + AssertIOThread(); + + // The ForkServer doesn't use IPC::Channel for communication, so we can skip + // initializing it. + if (mProcessType != GeckoProcessType_ForkServer) { + // Initializing the channel needs to happen on the I/O thread, but + // everything else can run on the launcher thread (or pool), to avoid + // blocking IPC messages. + // + // We avoid passing the host to the launcher thread to reduce the chances of + // data races with the IO thread (where e.g. OnChannelConnected may run + // concurrently). The pool currently needs access to the channel, which is + // not great. + bool failed = false; + aHost->InitializeChannel([&](IPC::Channel* channel) { + if (NS_WARN_IF(!channel || !SetChannel(channel))) { + failed = true; + } + }); + if (failed) { + return ProcessLaunchPromise::CreateAndReject(LaunchError("SetChannel"), + __func__); + } + mChannelId = aHost->GetChannelId(); + } + + return InvokeAsync(mLaunchThread, this, __func__, + &BaseProcessLauncher::PerformAsyncLaunch); +} + +} // namespace ipc +} // namespace mozilla |