tree 15deb040c1cf81aac7d474ba3a63d1bbb23d93bb
parent 52f6adabb6f44761cc23a226cc396bd5c664641c
author Jorge Lucangeli Obes <jorgelo@google.com> 1563475563 -0400
committer Jorge Lucangeli Obes <jorgelo@google.com> 1563475563 -0400

Preserve namespace file descriptors.

The code in libminijail.c will attempt to close file descriptors (if
instructed to do so) before minijail_enter() attempts to enter the
required namespaces. This is problematic because minijail_enter() will
then fail to call nsenter(2) because the namespace file descriptor has
been closed.

We could move the call to close_open_fds() after minijail_enter() but
this would require every user of Minijail to include the syscalls made
by close_open_fds() in their seccomp policy. Instead, preserve the file
descriptors used to enter mount and network namespaces. It's not really
a problem for these to end up in the child, since
/proc/<pid>/ns/{mnt,net} in the child will give access to the same
resource.

Bug: https://crbug.com/985467
Test: Unit tests pass.
Test: With https://chromium-review.googlesource.com/c/chromiumos/platform2/+/1614745,
Test: Chrome OS can start a guest session.
Change-Id: I2ecf41c148deb5650ebb00f5f35d78f314865c6a