OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "content/common/sandbox_win.h" | 5 #include "content/common/sandbox_win.h" |
6 | 6 |
7 #include <string> | 7 #include <string> |
8 | 8 |
9 #include "base/base_switches.h" | 9 #include "base/base_switches.h" |
10 #include "base/command_line.h" | 10 #include "base/command_line.h" |
(...skipping 675 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
686 cmd_line->HasSwitch(switches::kNoSandbox)) { | 686 cmd_line->HasSwitch(switches::kNoSandbox)) { |
687 base::Process process = | 687 base::Process process = |
688 base::LaunchProcess(*cmd_line, base::LaunchOptions()); | 688 base::LaunchProcess(*cmd_line, base::LaunchOptions()); |
689 // TODO(rvargas) crbug.com/417532: Don't share a raw handle. | 689 // TODO(rvargas) crbug.com/417532: Don't share a raw handle. |
690 g_broker_services->AddTargetPeer(process.Handle()); | 690 g_broker_services->AddTargetPeer(process.Handle()); |
691 return process.Pass(); | 691 return process.Pass(); |
692 } | 692 } |
693 | 693 |
694 sandbox::TargetPolicy* policy = g_broker_services->CreatePolicy(); | 694 sandbox::TargetPolicy* policy = g_broker_services->CreatePolicy(); |
695 | 695 |
696 sandbox::MitigationFlags mitigations = sandbox::MITIGATION_HEAP_TERMINATE | | 696 sandbox::MitigationFlags mitigations = |
697 sandbox::MITIGATION_BOTTOM_UP_ASLR | | 697 sandbox::MITIGATION_HEAP_TERMINATE | |
698 sandbox::MITIGATION_DEP | | 698 sandbox::MITIGATION_BOTTOM_UP_ASLR | |
699 sandbox::MITIGATION_DEP_NO_ATL_THUNK | | 699 sandbox::MITIGATION_DEP | |
700 sandbox::MITIGATION_SEHOP; | 700 sandbox::MITIGATION_DEP_NO_ATL_THUNK | |
| 701 sandbox::MITIGATION_SEHOP | |
| 702 sandbox::MITIGATION_EXTENSION_DLL_DISABLE; |
701 | 703 |
702 if (policy->SetProcessMitigations(mitigations) != sandbox::SBOX_ALL_OK) | 704 if (policy->SetProcessMitigations(mitigations) != sandbox::SBOX_ALL_OK) |
703 return base::Process(); | 705 return base::Process(); |
704 | 706 |
705 #if !defined(NACL_WIN64) | 707 #if !defined(NACL_WIN64) |
706 if (type_str == switches::kRendererProcess && | 708 if (type_str == switches::kRendererProcess && |
707 IsWin32kRendererLockdownEnabled()) { | 709 IsWin32kRendererLockdownEnabled()) { |
708 if (!AddWin32kLockdownPolicy(policy)) | 710 if (!AddWin32kLockdownPolicy(policy)) |
709 return base::Process(); | 711 return base::Process(); |
710 } | 712 } |
(...skipping 140 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
851 } | 853 } |
852 | 854 |
853 return false; | 855 return false; |
854 } | 856 } |
855 | 857 |
856 bool BrokerAddTargetPeer(HANDLE peer_process) { | 858 bool BrokerAddTargetPeer(HANDLE peer_process) { |
857 return g_broker_services->AddTargetPeer(peer_process) == sandbox::SBOX_ALL_OK; | 859 return g_broker_services->AddTargetPeer(peer_process) == sandbox::SBOX_ALL_OK; |
858 } | 860 } |
859 | 861 |
860 } // namespace content | 862 } // namespace content |
OLD | NEW |