OLD | NEW |
| (Empty) |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | |
2 // Use of this source code is governed by a BSD-style license that can be | |
3 // found in the LICENSE file. | |
4 | |
5 #ifndef CONTENT_COMMON_SANDBOX_LINUX_SANDBOX_SECCOMP_BPF_LINUX_H_ | |
6 #define CONTENT_COMMON_SANDBOX_LINUX_SANDBOX_SECCOMP_BPF_LINUX_H_ | |
7 | |
8 #include <string> | |
9 | |
10 #include "base/basictypes.h" | |
11 #include "base/memory/scoped_ptr.h" | |
12 | |
13 namespace sandbox { | |
14 class SandboxBPFPolicy; | |
15 } | |
16 | |
17 namespace content { | |
18 | |
19 // This class has two main sets of APIs. One can be used to start the sandbox | |
20 // for internal content process types, the other is indirectly exposed as | |
21 // a public content/ API and uses a supplied policy. | |
22 class SandboxSeccompBPF { | |
23 public: | |
24 // This is the API to enable a seccomp-bpf sandbox for content/ | |
25 // process-types: | |
26 // Is the sandbox globally enabled, can anything use it at all ? | |
27 // This looks at global command line flags to see if the sandbox | |
28 // should be enabled at all. | |
29 static bool IsSeccompBPFDesired(); | |
30 // Should the sandbox be enabled for process_type ? | |
31 static bool ShouldEnableSeccompBPF(const std::string& process_type); | |
32 // Check if the kernel supports this sandbox. It's useful to "prewarm" | |
33 // this, part of the result will be cached. | |
34 static bool SupportsSandbox(); | |
35 // Start the sandbox and apply the policy for process_type, depending on | |
36 // command line switches. | |
37 static bool StartSandbox(const std::string& process_type); | |
38 | |
39 // This is the API to enable a seccomp-bpf sandbox by using an | |
40 // external policy. | |
41 static bool StartSandboxWithExternalPolicy( | |
42 scoped_ptr<sandbox::SandboxBPFPolicy> policy); | |
43 // The "baseline" policy can be a useful base to build a sandbox policy. | |
44 static scoped_ptr<sandbox::SandboxBPFPolicy> GetBaselinePolicy(); | |
45 | |
46 private: | |
47 DISALLOW_IMPLICIT_CONSTRUCTORS(SandboxSeccompBPF); | |
48 }; | |
49 | |
50 } // namespace content | |
51 | |
52 #endif // CONTENT_COMMON_SANDBOX_LINUX_SANDBOX_SECCOMP_BPF_LINUX_H_ | |
53 | |
OLD | NEW |