| OLD | NEW |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #ifndef CONTENT_PUBLIC_COMMON_SANDBOX_INIT_H_ | 5 #ifndef CONTENT_PUBLIC_COMMON_SANDBOX_INIT_H_ |
| 6 #define CONTENT_PUBLIC_COMMON_SANDBOX_INIT_H_ | 6 #define CONTENT_PUBLIC_COMMON_SANDBOX_INIT_H_ |
| 7 | 7 |
| 8 #include "base/process.h" | 8 #include "base/process.h" |
| 9 #include "build/build_config.h" | 9 #include "build/build_config.h" |
| 10 #include "content/common/content_export.h" | 10 #include "content/common/content_export.h" |
| 11 #include "ipc/ipc_platform_file.h" | |
| 12 | 11 |
| 13 class CommandLine; | 12 class CommandLine; |
| 14 | 13 |
| 15 namespace base { | 14 namespace base { |
| 16 class FilePath; | 15 class FilePath; |
| 17 } | 16 } |
| 18 | 17 |
| 19 namespace sandbox { | 18 namespace sandbox { |
| 20 struct SandboxInterfaceInfo; | 19 struct SandboxInterfaceInfo; |
| 21 } | 20 } |
| 22 | 21 |
| 23 namespace content { | 22 namespace content { |
| 23 class SandboxedProcessLauncherDelegate; |
| 24 | 24 |
| 25 #if defined(OS_WIN) | 25 #if defined(OS_WIN) |
| 26 | 26 |
| 27 // Initialize the sandbox for renderer, gpu, utility, worker, nacl, and plug-in | 27 // Initialize the sandbox for renderer, gpu, utility, worker, nacl, and plug-in |
| 28 // processes, depending on the command line flags. Although The browser process | 28 // processes, depending on the command line flags. Although The browser process |
| 29 // is not sandboxed, this also needs to be called because it will initialize | 29 // is not sandboxed, this also needs to be called because it will initialize |
| 30 // the broker code. | 30 // the broker code. |
| 31 // Returns true if the sandbox was initialized succesfully, false if an error | 31 // Returns true if the sandbox was initialized succesfully, false if an error |
| 32 // occurred. If process_type isn't one that needs sandboxing true is always | 32 // occurred. If process_type isn't one that needs sandboxing true is always |
| 33 // returned. | 33 // returned. |
| (...skipping 12 matching lines...) Expand all Loading... |
| 46 | 46 |
| 47 // Inform the current process's sandbox broker (e.g. the broker for | 47 // Inform the current process's sandbox broker (e.g. the broker for |
| 48 // 32-bit processes) about a process created under a different sandbox | 48 // 32-bit processes) about a process created under a different sandbox |
| 49 // broker (e.g. the broker for 64-bit processes). This allows | 49 // broker (e.g. the broker for 64-bit processes). This allows |
| 50 // BrokerDuplicateHandle() to send handles to a process managed by | 50 // BrokerDuplicateHandle() to send handles to a process managed by |
| 51 // another broker. For example, it allows the 32-bit renderer to send | 51 // another broker. For example, it allows the 32-bit renderer to send |
| 52 // handles to 64-bit NaCl processes. This returns true on success, | 52 // handles to 64-bit NaCl processes. This returns true on success, |
| 53 // false otherwise. | 53 // false otherwise. |
| 54 CONTENT_EXPORT bool BrokerAddTargetPeer(HANDLE peer_process); | 54 CONTENT_EXPORT bool BrokerAddTargetPeer(HANDLE peer_process); |
| 55 | 55 |
| 56 // Starts a sandboxed process with the given directory unsandboxed | 56 // Launch a sandboxed process. |delegate| may be NULL. If |delegate| is non-NULL |
| 57 // and returns a handle to it. | 57 // then it just has to outlive this method call. |
| 58 CONTENT_EXPORT base::ProcessHandle StartProcessWithAccess( | 58 CONTENT_EXPORT base::ProcessHandle StartSandboxedProcess( |
| 59 CommandLine* cmd_line, | 59 SandboxedProcessLauncherDelegate* delegate, |
| 60 const base::FilePath& exposed_dir); | 60 CommandLine* cmd_line); |
| 61 | 61 |
| 62 #elif defined(OS_MACOSX) | 62 #elif defined(OS_MACOSX) |
| 63 | 63 |
| 64 // Initialize the sandbox of the given |sandbox_type|, optionally specifying a | 64 // Initialize the sandbox of the given |sandbox_type|, optionally specifying a |
| 65 // directory to allow access to. Note specifying a directory needs to be | 65 // directory to allow access to. Note specifying a directory needs to be |
| 66 // supported by the sandbox profile associated with the given |sandbox_type|. | 66 // supported by the sandbox profile associated with the given |sandbox_type|. |
| 67 // Valid values for |sandbox_type| are defined either by the enum SandboxType, | 67 // Valid values for |sandbox_type| are defined either by the enum SandboxType, |
| 68 // or by ContentClient::GetSandboxProfileForSandboxType(). | 68 // or by ContentClient::GetSandboxProfileForSandboxType(). |
| 69 // | 69 // |
| 70 // If the |sandbox_type| isn't one of the ones defined by content then the | 70 // If the |sandbox_type| isn't one of the ones defined by content then the |
| (...skipping 15 matching lines...) Expand all Loading... |
| 86 // switches. TODO(jln): switch to a model where the caller chooses a sandbox | 86 // switches. TODO(jln): switch to a model where the caller chooses a sandbox |
| 87 // type. | 87 // type. |
| 88 // This should be called before any additional thread has been created. | 88 // This should be called before any additional thread has been created. |
| 89 // | 89 // |
| 90 // Returns true if a sandbox has been initialized successfully, false | 90 // Returns true if a sandbox has been initialized successfully, false |
| 91 // otherwise. | 91 // otherwise. |
| 92 CONTENT_EXPORT bool InitializeSandbox(); | 92 CONTENT_EXPORT bool InitializeSandbox(); |
| 93 | 93 |
| 94 #endif | 94 #endif |
| 95 | 95 |
| 96 // Platform neutral wrapper for making an exact copy of a handle for use in | |
| 97 // the target process. On Windows this wraps BrokerDuplicateHandle() with the | |
| 98 // DUPLICATE_SAME_ACCESS flag. On posix it behaves essentially the same as | |
| 99 // IPC::GetFileHandleForProcess() | |
| 100 CONTENT_EXPORT IPC::PlatformFileForTransit BrokerGetFileHandleForProcess( | |
| 101 base::PlatformFile handle, | |
| 102 base::ProcessId target_process_id, | |
| 103 bool should_close_source); | |
| 104 | |
| 105 } // namespace content | 96 } // namespace content |
| 106 | 97 |
| 107 #endif // CONTENT_PUBLIC_COMMON_SANDBOX_INIT_H_ | 98 #endif // CONTENT_PUBLIC_COMMON_SANDBOX_INIT_H_ |
| OLD | NEW |