OLD | NEW |
---|---|
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #ifndef SANDBOX_WIN_SRC_SANDBOX_POLICY_H_ | 5 #ifndef SANDBOX_WIN_SRC_SANDBOX_POLICY_H_ |
6 #define SANDBOX_WIN_SRC_SANDBOX_POLICY_H_ | 6 #define SANDBOX_WIN_SRC_SANDBOX_POLICY_H_ |
7 | 7 |
8 #include <stddef.h> | 8 #include <stddef.h> |
9 #include <stdint.h> | 9 #include <stdint.h> |
10 | 10 |
(...skipping 30 matching lines...) Expand all Loading... | |
41 FILES_ALLOW_DIR_ANY, // Allows open or create with directory semantics | 41 FILES_ALLOW_DIR_ANY, // Allows open or create with directory semantics |
42 // only. | 42 // only. |
43 HANDLES_DUP_ANY, // Allows duplicating handles opened with any | 43 HANDLES_DUP_ANY, // Allows duplicating handles opened with any |
44 // access permissions. | 44 // access permissions. |
45 HANDLES_DUP_BROKER, // Allows duplicating handles to the broker process. | 45 HANDLES_DUP_BROKER, // Allows duplicating handles to the broker process. |
46 NAMEDPIPES_ALLOW_ANY, // Allows creation of a named pipe. | 46 NAMEDPIPES_ALLOW_ANY, // Allows creation of a named pipe. |
47 PROCESS_MIN_EXEC, // Allows to create a process with minimal rights | 47 PROCESS_MIN_EXEC, // Allows to create a process with minimal rights |
48 // over the resulting process and thread handles. | 48 // over the resulting process and thread handles. |
49 // No other parameters besides the command line are | 49 // No other parameters besides the command line are |
50 // passed to the child process. | 50 // passed to the child process. |
51 PROCESS_ALL_EXEC, // Allows the creation of a process and return fill | 51 PROCESS_ALL_EXEC, // Allows the creation of a process and return full |
Will Harris
2016/02/02 05:45:33
add comment that PROCESS_MIN_EXEC and PROCESS_ALL_
liamjm (20p)
2016/02/02 20:43:45
Done.
| |
52 // access on the returned handles. | 52 // access on the returned handles. |
53 // This flag can be used only when the main token of | 53 // This flag can be used only when the main token of |
54 // the sandboxed application is at least INTERACTIVE. | 54 // the sandboxed application is at least INTERACTIVE. |
55 EVENTS_ALLOW_ANY, // Allows the creation of an event with full access. | 55 EVENTS_ALLOW_ANY, // Allows the creation of an event with full access. |
56 EVENTS_ALLOW_READONLY, // Allows opening an even with synchronize access. | 56 EVENTS_ALLOW_READONLY, // Allows opening an even with synchronize access. |
57 REG_ALLOW_READONLY, // Allows readonly access to a registry key. | 57 REG_ALLOW_READONLY, // Allows readonly access to a registry key. |
58 REG_ALLOW_ANY, // Allows read and write access to a registry key. | 58 REG_ALLOW_ANY, // Allows read and write access to a registry key. |
59 FAKE_USER_GDI_INIT // Fakes user32 and gdi32 initialization. This can | 59 FAKE_USER_GDI_INIT // Fakes user32 and gdi32 initialization. This can |
60 // be used to allow the DLLs to load and initialize | 60 // be used to allow the DLLs to load and initialize |
61 // even if the process cannot access that subsystem. | 61 // even if the process cannot access that subsystem. |
62 }; | 62 }; |
63 | 63 |
64 // Increments the reference count of this object. The reference count must | 64 // Increments the reference count of this object. The reference count must |
65 // be incremented if this interface is given to another component. | 65 // be incremented if this interface is given to another component. |
66 virtual void AddRef() = 0; | 66 virtual void AddRef() = 0; |
67 | 67 |
68 // Decrements the reference count of this object. When the reference count | 68 // Decrements the reference count of this object. When the reference count |
69 // is zero the object is automatically destroyed. | 69 // is zero the object is automatically destroyed. |
70 // Indicates that the caller is done with this interface. After calling | 70 // Indicates that the caller is done with this interface. After calling |
71 // release no other method should be called. | 71 // release no other method should be called. |
(...skipping 178 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
250 // Returns the handle which was actually shared with the target. This is | 250 // Returns the handle which was actually shared with the target. This is |
251 // achieved by duplicating the handle to ensure that it is inheritable by | 251 // achieved by duplicating the handle to ensure that it is inheritable by |
252 // the target. The caller should treat this as an opaque value. | 252 // the target. The caller should treat this as an opaque value. |
253 virtual void* AddHandleToShare(HANDLE handle) = 0; | 253 virtual void* AddHandleToShare(HANDLE handle) = 0; |
254 }; | 254 }; |
255 | 255 |
256 } // namespace sandbox | 256 } // namespace sandbox |
257 | 257 |
258 | 258 |
259 #endif // SANDBOX_WIN_SRC_SANDBOX_POLICY_H_ | 259 #endif // SANDBOX_WIN_SRC_SANDBOX_POLICY_H_ |
OLD | NEW |