| OLD | NEW |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #ifndef SANDBOX_WIN_SRC_SANDBOX_POLICY_H_ | 5 #ifndef SANDBOX_WIN_SRC_SANDBOX_POLICY_H_ |
| 6 #define SANDBOX_WIN_SRC_SANDBOX_POLICY_H_ | 6 #define SANDBOX_WIN_SRC_SANDBOX_POLICY_H_ |
| 7 | 7 |
| 8 #include <stddef.h> | |
| 9 #include <stdint.h> | |
| 10 | |
| 11 #include <string> | 8 #include <string> |
| 12 | 9 |
| 10 #include "base/basictypes.h" |
| 13 #include "base/strings/string16.h" | 11 #include "base/strings/string16.h" |
| 14 #include "sandbox/win/src/sandbox_types.h" | 12 #include "sandbox/win/src/sandbox_types.h" |
| 15 #include "sandbox/win/src/security_level.h" | 13 #include "sandbox/win/src/security_level.h" |
| 16 | 14 |
| 17 namespace sandbox { | 15 namespace sandbox { |
| 18 | 16 |
| 19 class TargetPolicy { | 17 class TargetPolicy { |
| 20 public: | 18 public: |
| 21 // Windows subsystems that can have specific rules. | 19 // Windows subsystems that can have specific rules. |
| 22 // Note: The process subsystem(SUBSY_PROCESS) does not evaluate the request | 20 // Note: The process subsystem(SUBSY_PROCESS) does not evaluate the request |
| (...skipping 102 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 125 // JOB_OBJECT_UILIMIT_DESKTOP : allow the creation of new desktops. | 123 // JOB_OBJECT_UILIMIT_DESKTOP : allow the creation of new desktops. |
| 126 // JOB_OBJECT_UILIMIT_EXITWINDOWS : allow the call to ExitWindows(). | 124 // JOB_OBJECT_UILIMIT_EXITWINDOWS : allow the call to ExitWindows(). |
| 127 // | 125 // |
| 128 // Return value: SBOX_ALL_OK if the setting succeeds and false otherwise. | 126 // Return value: SBOX_ALL_OK if the setting succeeds and false otherwise. |
| 129 // | 127 // |
| 130 // Note: JOB_OBJECT_XXXX constants are defined in winnt.h and documented at | 128 // Note: JOB_OBJECT_XXXX constants are defined in winnt.h and documented at |
| 131 // length in: | 129 // length in: |
| 132 // http://msdn2.microsoft.com/en-us/library/ms684152.aspx | 130 // http://msdn2.microsoft.com/en-us/library/ms684152.aspx |
| 133 // | 131 // |
| 134 // Note: the recommended level is JOB_RESTRICTED or JOB_LOCKDOWN. | 132 // Note: the recommended level is JOB_RESTRICTED or JOB_LOCKDOWN. |
| 135 virtual ResultCode SetJobLevel(JobLevel job_level, | 133 virtual ResultCode SetJobLevel(JobLevel job_level, uint32 ui_exceptions) = 0; |
| 136 uint32_t ui_exceptions) = 0; | |
| 137 | 134 |
| 138 // Sets a hard limit on the size of the commit set for the sandboxed process. | 135 // Sets a hard limit on the size of the commit set for the sandboxed process. |
| 139 // If the limit is reached, the process will be terminated with | 136 // If the limit is reached, the process will be terminated with |
| 140 // SBOX_FATAL_MEMORY_EXCEEDED (7012). | 137 // SBOX_FATAL_MEMORY_EXCEEDED (7012). |
| 141 virtual ResultCode SetJobMemoryLimit(size_t memory_limit) = 0; | 138 virtual ResultCode SetJobMemoryLimit(size_t memory_limit) = 0; |
| 142 | 139 |
| 143 // Specifies the desktop on which the application is going to run. If the | 140 // Specifies the desktop on which the application is going to run. If the |
| 144 // desktop does not exist, it will be created. If alternate_winstation is | 141 // desktop does not exist, it will be created. If alternate_winstation is |
| 145 // set to true, the desktop will be created on an alternate window station. | 142 // set to true, the desktop will be created on an alternate window station. |
| 146 virtual ResultCode SetAlternateDesktop(bool alternate_winstation) = 0; | 143 virtual ResultCode SetAlternateDesktop(bool alternate_winstation) = 0; |
| (...skipping 103 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 250 // Returns the handle which was actually shared with the target. This is | 247 // Returns the handle which was actually shared with the target. This is |
| 251 // achieved by duplicating the handle to ensure that it is inheritable by | 248 // achieved by duplicating the handle to ensure that it is inheritable by |
| 252 // the target. The caller should treat this as an opaque value. | 249 // the target. The caller should treat this as an opaque value. |
| 253 virtual void* AddHandleToShare(HANDLE handle) = 0; | 250 virtual void* AddHandleToShare(HANDLE handle) = 0; |
| 254 }; | 251 }; |
| 255 | 252 |
| 256 } // namespace sandbox | 253 } // namespace sandbox |
| 257 | 254 |
| 258 | 255 |
| 259 #endif // SANDBOX_WIN_SRC_SANDBOX_POLICY_H_ | 256 #endif // SANDBOX_WIN_SRC_SANDBOX_POLICY_H_ |
| OLD | NEW |