minijail: Support writing child pid to file
BUG=chromium:519154
TEST=security_Minijail0 passes
Change-Id: Icedff5d86ef0c3dbf2933e763b0858cb79e5b08f
Reviewed-on: https://chromium-review.googlesource.com/292342
Reviewed-by: Jorge Lucangeli Obes <jorgelo@chromium.org>
Commit-Queue: Nicolas Boichat <drinkcat@chromium.org>
Trybot-Ready: Nicolas Boichat <drinkcat@chromium.org>
Tested-by: Yu-hsi Chiang <yuhsi@google.com>
diff --git a/libminijail.c b/libminijail.c
index b170db0..0a429c9 100644
--- a/libminijail.c
+++ b/libminijail.c
@@ -97,6 +97,7 @@
int chroot:1;
int mount_tmp:1;
int do_init:1;
+ int pid_file:1;
} flags;
uid_t uid;
gid_t gid;
@@ -108,6 +109,7 @@
int filter_len;
int binding_count;
char *chrootdir;
+ char *pid_file_path;
char *uidmap;
char *gidmap;
struct sock_fprog *filter_prog;
@@ -127,6 +129,7 @@
j->flags.readonly = 0;
j->flags.pids = 0;
j->flags.do_init = 0;
+ j->flags.pid_file = 0;
}
/*
@@ -354,6 +357,15 @@
j->flags.mount_tmp = 1;
}
+int API minijail_write_pid_file(struct minijail *j, const char *path)
+{
+ j->pid_file_path = strdup(path);
+ if (!j->pid_file_path)
+ return -ENOMEM;
+ j->flags.pid_file = 1;
+ return 0;
+}
+
int API minijail_bind(struct minijail *j, const char *src, const char *dest,
int writeable)
{
@@ -732,6 +744,18 @@
return 0;
}
+static void write_pid_file(const struct minijail *j)
+{
+ FILE *fp = fopen(j->pid_file_path, "w");
+
+ if (!fp)
+ pdie("failed to open '%s'", j->pid_file_path);
+ if (fprintf(fp, "%d\n", (int)j->initpid) < 0)
+ pdie("fprintf(%s)", j->pid_file_path);
+ if (fclose(fp))
+ pdie("fclose(%s)", j->pid_file_path);
+}
+
void drop_ugid(const struct minijail *j)
{
if (j->flags.usergroups) {
@@ -1264,6 +1288,9 @@
j->initpid = child_pid;
+ if (j->flags.pid_file)
+ write_pid_file(j);
+
if (j->flags.userns)
write_ugid_mappings(j, userns_pipe_fds);
@@ -1411,6 +1438,9 @@
if (child_pid > 0 ) {
j->initpid = child_pid;
+ if (j->flags.pid_file)
+ write_pid_file(j);
+
if (j->flags.userns)
write_ugid_mappings(j, userns_pipe_fds);