Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(44)

Unified Diff: chrome/common/sandbox_mac.mm

Issue 341033: Sandbox Worker process on the Mac. (Closed)
Patch Set: Fix latest round of comments Created 11 years, 1 month ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
« no previous file with comments | « chrome/common/sandbox_mac.h ('k') | chrome/renderer/renderer_main_platform_delegate_mac.mm » ('j') | no next file with comments »
Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
Index: chrome/common/sandbox_mac.mm
diff --git a/chrome/common/sandbox_mac.mm b/chrome/common/sandbox_mac.mm
index ae55b529494fdbabe124f541bebef92ff9f54926..6eac34c3ae5c7460f9b7ca95d6e17d510dfee334 100644
--- a/chrome/common/sandbox_mac.mm
+++ b/chrome/common/sandbox_mac.mm
@@ -84,11 +84,42 @@ void SandboxWarmup() {
}
// Turns on the OS X sandbox for this process.
-bool EnableSandbox() {
- // For the renderer, we give it a custom sandbox to lock things down as
- // tightly as possible, while still enabling drawing.
+bool EnableSandbox(SandboxProcessType sandbox_type,
+ const FilePath& allowed_dir) {
+ // Sanity - currently only SANDBOX_TYPE_UTILITY supports a directory being
+ // passed in.
+ if (sandbox_type != SANDBOX_TYPE_UTILITY) {
+ DCHECK(allowed_dir.empty())
+ << "Only SANDBOX_TYPE_UTILITY allows a custom directory parameter.";
+ } else {
+ DCHECK(!allowed_dir.empty())
+ << "SANDBOX_TYPE_UTILITY "
+ << "needs a custom directory parameter, but an empty one was provided.";
+ }
+
+ // We use a custom sandbox definition file to lock things down as
+ // tightly as possible.
+ // TODO(jeremy): Look at using include syntax to unify common parts of sandbox
+ // definition files.
+ NSString* sandbox_config_filename = nil;
+ switch (sandbox_type) {
+ case SANDBOX_TYPE_RENDERER:
+ sandbox_config_filename = @"renderer";
+ break;
+ case SANDBOX_TYPE_WORKER:
+ sandbox_config_filename = @"worker";
+ break;
+ case SANDBOX_TYPE_UTILITY:
+ sandbox_config_filename = @"utility";
+ break;
+ default:
+ NOTREACHED();
+ return false;
+ }
+
NSString* sandbox_profile_path =
- [mac_util::MainAppBundle() pathForResource:@"renderer" ofType:@"sb"];
+ [mac_util::MainAppBundle() pathForResource:sandbox_config_filename
+ ofType:@"sb"];
NSString* sandbox_data = [NSString
stringWithContentsOfFile:sandbox_profile_path
encoding:NSUTF8StringEncoding
@@ -108,6 +139,13 @@ bool EnableSandbox() {
withString:@""];
}
+ if (!allowed_dir.empty()) {
+ NSString* allowed_dir_ns = base::SysUTF8ToNSString(allowed_dir.value());
+ sandbox_data = [sandbox_data
+ stringByReplacingOccurrencesOfString:@"DIR_TO_ALLOW_ACCESS"
+ withString:allowed_dir_ns];
+ }
+
int32 major_version, minor_version, bugfix_version;
base::SysInfo::OperatingSystemVersionNumbers(&major_version,
&minor_version, &bugfix_version);
« no previous file with comments | « chrome/common/sandbox_mac.h ('k') | chrome/renderer/renderer_main_platform_delegate_mac.mm » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698