OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #ifndef SANDBOX_WIN_SRC_SANDBOX_POLICY_H_ | 5 #ifndef SANDBOX_WIN_SRC_SANDBOX_POLICY_H_ |
6 #define SANDBOX_WIN_SRC_SANDBOX_POLICY_H_ | 6 #define SANDBOX_WIN_SRC_SANDBOX_POLICY_H_ |
7 | 7 |
| 8 #include <stddef.h> |
| 9 #include <stdint.h> |
| 10 |
8 #include <string> | 11 #include <string> |
9 | 12 |
10 #include "base/basictypes.h" | |
11 #include "base/strings/string16.h" | 13 #include "base/strings/string16.h" |
12 #include "sandbox/win/src/sandbox_types.h" | 14 #include "sandbox/win/src/sandbox_types.h" |
13 #include "sandbox/win/src/security_level.h" | 15 #include "sandbox/win/src/security_level.h" |
14 | 16 |
15 namespace sandbox { | 17 namespace sandbox { |
16 | 18 |
17 class TargetPolicy { | 19 class TargetPolicy { |
18 public: | 20 public: |
19 // Windows subsystems that can have specific rules. | 21 // Windows subsystems that can have specific rules. |
20 // Note: The process subsystem(SUBSY_PROCESS) does not evaluate the request | 22 // Note: The process subsystem(SUBSY_PROCESS) does not evaluate the request |
(...skipping 102 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
123 // JOB_OBJECT_UILIMIT_DESKTOP : allow the creation of new desktops. | 125 // JOB_OBJECT_UILIMIT_DESKTOP : allow the creation of new desktops. |
124 // JOB_OBJECT_UILIMIT_EXITWINDOWS : allow the call to ExitWindows(). | 126 // JOB_OBJECT_UILIMIT_EXITWINDOWS : allow the call to ExitWindows(). |
125 // | 127 // |
126 // Return value: SBOX_ALL_OK if the setting succeeds and false otherwise. | 128 // Return value: SBOX_ALL_OK if the setting succeeds and false otherwise. |
127 // | 129 // |
128 // Note: JOB_OBJECT_XXXX constants are defined in winnt.h and documented at | 130 // Note: JOB_OBJECT_XXXX constants are defined in winnt.h and documented at |
129 // length in: | 131 // length in: |
130 // http://msdn2.microsoft.com/en-us/library/ms684152.aspx | 132 // http://msdn2.microsoft.com/en-us/library/ms684152.aspx |
131 // | 133 // |
132 // Note: the recommended level is JOB_RESTRICTED or JOB_LOCKDOWN. | 134 // Note: the recommended level is JOB_RESTRICTED or JOB_LOCKDOWN. |
133 virtual ResultCode SetJobLevel(JobLevel job_level, uint32 ui_exceptions) = 0; | 135 virtual ResultCode SetJobLevel(JobLevel job_level, |
| 136 uint32_t ui_exceptions) = 0; |
134 | 137 |
135 // Sets a hard limit on the size of the commit set for the sandboxed process. | 138 // Sets a hard limit on the size of the commit set for the sandboxed process. |
136 // If the limit is reached, the process will be terminated with | 139 // If the limit is reached, the process will be terminated with |
137 // SBOX_FATAL_MEMORY_EXCEEDED (7012). | 140 // SBOX_FATAL_MEMORY_EXCEEDED (7012). |
138 virtual ResultCode SetJobMemoryLimit(size_t memory_limit) = 0; | 141 virtual ResultCode SetJobMemoryLimit(size_t memory_limit) = 0; |
139 | 142 |
140 // Specifies the desktop on which the application is going to run. If the | 143 // Specifies the desktop on which the application is going to run. If the |
141 // desktop does not exist, it will be created. If alternate_winstation is | 144 // desktop does not exist, it will be created. If alternate_winstation is |
142 // set to true, the desktop will be created on an alternate window station. | 145 // set to true, the desktop will be created on an alternate window station. |
143 virtual ResultCode SetAlternateDesktop(bool alternate_winstation) = 0; | 146 virtual ResultCode SetAlternateDesktop(bool alternate_winstation) = 0; |
(...skipping 103 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
247 // Returns the handle which was actually shared with the target. This is | 250 // Returns the handle which was actually shared with the target. This is |
248 // achieved by duplicating the handle to ensure that it is inheritable by | 251 // achieved by duplicating the handle to ensure that it is inheritable by |
249 // the target. The caller should treat this as an opaque value. | 252 // the target. The caller should treat this as an opaque value. |
250 virtual void* AddHandleToShare(HANDLE handle) = 0; | 253 virtual void* AddHandleToShare(HANDLE handle) = 0; |
251 }; | 254 }; |
252 | 255 |
253 } // namespace sandbox | 256 } // namespace sandbox |
254 | 257 |
255 | 258 |
256 #endif // SANDBOX_WIN_SRC_SANDBOX_POLICY_H_ | 259 #endif // SANDBOX_WIN_SRC_SANDBOX_POLICY_H_ |
OLD | NEW |