OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #ifndef SANDBOX_WIN_SRC_SANDBOX_POLICY_H_ | 5 #ifndef SANDBOX_WIN_SRC_SANDBOX_POLICY_H_ |
6 #define SANDBOX_WIN_SRC_SANDBOX_POLICY_H_ | 6 #define SANDBOX_WIN_SRC_SANDBOX_POLICY_H_ |
7 | 7 |
8 #include <stddef.h> | 8 #include <stddef.h> |
9 #include <stdint.h> | 9 #include <stdint.h> |
10 | 10 |
(...skipping 30 matching lines...) Expand all Loading... |
41 FILES_ALLOW_DIR_ANY, // Allows open or create with directory semantics | 41 FILES_ALLOW_DIR_ANY, // Allows open or create with directory semantics |
42 // only. | 42 // only. |
43 HANDLES_DUP_ANY, // Allows duplicating handles opened with any | 43 HANDLES_DUP_ANY, // Allows duplicating handles opened with any |
44 // access permissions. | 44 // access permissions. |
45 HANDLES_DUP_BROKER, // Allows duplicating handles to the broker process. | 45 HANDLES_DUP_BROKER, // Allows duplicating handles to the broker process. |
46 NAMEDPIPES_ALLOW_ANY, // Allows creation of a named pipe. | 46 NAMEDPIPES_ALLOW_ANY, // Allows creation of a named pipe. |
47 PROCESS_MIN_EXEC, // Allows to create a process with minimal rights | 47 PROCESS_MIN_EXEC, // Allows to create a process with minimal rights |
48 // over the resulting process and thread handles. | 48 // over the resulting process and thread handles. |
49 // No other parameters besides the command line are | 49 // No other parameters besides the command line are |
50 // passed to the child process. | 50 // passed to the child process. |
51 PROCESS_ALL_EXEC, // Allows the creation of a process and return fill | 51 // Also allows the creation of a thread and return |
| 52 // full access on the returned handles. |
| 53 PROCESS_ALL_EXEC, // Allows the creation of a process and return full |
52 // access on the returned handles. | 54 // access on the returned handles. |
53 // This flag can be used only when the main token of | 55 // This flag can be used only when the main token of |
54 // the sandboxed application is at least INTERACTIVE. | 56 // the sandboxed application is at least INTERACTIVE. |
| 57 // Also allows the creation of a thread and return |
| 58 // full access on the returned handles. |
55 EVENTS_ALLOW_ANY, // Allows the creation of an event with full access. | 59 EVENTS_ALLOW_ANY, // Allows the creation of an event with full access. |
56 EVENTS_ALLOW_READONLY, // Allows opening an even with synchronize access. | 60 EVENTS_ALLOW_READONLY, // Allows opening an even with synchronize access. |
57 REG_ALLOW_READONLY, // Allows readonly access to a registry key. | 61 REG_ALLOW_READONLY, // Allows readonly access to a registry key. |
58 REG_ALLOW_ANY, // Allows read and write access to a registry key. | 62 REG_ALLOW_ANY, // Allows read and write access to a registry key. |
59 FAKE_USER_GDI_INIT // Fakes user32 and gdi32 initialization. This can | 63 FAKE_USER_GDI_INIT // Fakes user32 and gdi32 initialization. This can |
60 // be used to allow the DLLs to load and initialize | 64 // be used to allow the DLLs to load and initialize |
61 // even if the process cannot access that subsystem. | 65 // even if the process cannot access that subsystem. |
62 }; | 66 }; |
63 | 67 |
64 // Increments the reference count of this object. The reference count must | 68 // Increments the reference count of this object. The reference count must |
65 // be incremented if this interface is given to another component. | 69 // be incremented if this interface is given to another component. |
66 virtual void AddRef() = 0; | 70 virtual void AddRef() = 0; |
67 | 71 |
68 // Decrements the reference count of this object. When the reference count | 72 // Decrements the reference count of this object. When the reference count |
69 // is zero the object is automatically destroyed. | 73 // is zero the object is automatically destroyed. |
70 // Indicates that the caller is done with this interface. After calling | 74 // Indicates that the caller is done with this interface. After calling |
71 // release no other method should be called. | 75 // release no other method should be called. |
(...skipping 178 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
250 // Returns the handle which was actually shared with the target. This is | 254 // Returns the handle which was actually shared with the target. This is |
251 // achieved by duplicating the handle to ensure that it is inheritable by | 255 // achieved by duplicating the handle to ensure that it is inheritable by |
252 // the target. The caller should treat this as an opaque value. | 256 // the target. The caller should treat this as an opaque value. |
253 virtual void* AddHandleToShare(HANDLE handle) = 0; | 257 virtual void* AddHandleToShare(HANDLE handle) = 0; |
254 }; | 258 }; |
255 | 259 |
256 } // namespace sandbox | 260 } // namespace sandbox |
257 | 261 |
258 | 262 |
259 #endif // SANDBOX_WIN_SRC_SANDBOX_POLICY_H_ | 263 #endif // SANDBOX_WIN_SRC_SANDBOX_POLICY_H_ |
OLD | NEW |