| OLD | NEW |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #ifndef SANDBOX_LINUX_SERVICES_BROKER_PROCESS_H_ | 5 #ifndef SANDBOX_LINUX_SERVICES_BROKER_PROCESS_H_ |
| 6 #define SANDBOX_LINUX_SERVICES_BROKER_PROCESS_H_ | 6 #define SANDBOX_LINUX_SERVICES_BROKER_PROCESS_H_ |
| 7 | 7 |
| 8 #include <string> | 8 #include <string> |
| 9 #include <vector> | 9 #include <vector> |
| 10 | 10 |
| 11 #include "base/basictypes.h" | 11 #include "base/basictypes.h" |
| 12 #include "base/callback_forward.h" |
| 12 #include "base/pickle.h" | 13 #include "base/pickle.h" |
| 13 #include "base/process/process.h" | 14 #include "base/process/process.h" |
| 14 | 15 |
| 15 namespace sandbox { | 16 namespace sandbox { |
| 16 | 17 |
| 17 // Create a new "broker" process to which we can send requests via an IPC | 18 // Create a new "broker" process to which we can send requests via an IPC |
| 18 // channel. | 19 // channel. |
| 19 // This is a low level IPC mechanism that is suitable to be called from a | 20 // This is a low level IPC mechanism that is suitable to be called from a |
| 20 // signal handler. | 21 // signal handler. |
| 21 // A process would typically create a broker process before entering | 22 // A process would typically create a broker process before entering |
| (...skipping 13 matching lines...) Expand all Loading... |
| 35 // |fast_check_in_client| and |quiet_failures_for_tests| are reserved for | 36 // |fast_check_in_client| and |quiet_failures_for_tests| are reserved for |
| 36 // unit tests, don't use it. | 37 // unit tests, don't use it. |
| 37 explicit BrokerProcess(int denied_errno, | 38 explicit BrokerProcess(int denied_errno, |
| 38 const std::vector<std::string>& allowed_r_files, | 39 const std::vector<std::string>& allowed_r_files, |
| 39 const std::vector<std::string>& allowed_w_files, | 40 const std::vector<std::string>& allowed_w_files, |
| 40 bool fast_check_in_client = true, | 41 bool fast_check_in_client = true, |
| 41 bool quiet_failures_for_tests = false); | 42 bool quiet_failures_for_tests = false); |
| 42 ~BrokerProcess(); | 43 ~BrokerProcess(); |
| 43 // Will initialize the broker process. There should be no threads at this | 44 // Will initialize the broker process. There should be no threads at this |
| 44 // point, since we need to fork(). | 45 // point, since we need to fork(). |
| 45 // sandbox_callback is a function that should be called to enable the | 46 // broker_process_init_callback will be called in the new broker process, |
| 46 // sandbox in the broker. | 47 // after fork() returns. |
| 47 bool Init(bool (*sandbox_callback)(void)); | 48 bool Init(const base::Callback<bool(void)>& broker_process_init_callback); |
| 48 | 49 |
| 49 // Can be used in place of access(). Will be async signal safe. | 50 // Can be used in place of access(). Will be async signal safe. |
| 50 // X_OK will always return an error in practice since the broker process | 51 // X_OK will always return an error in practice since the broker process |
| 51 // doesn't support execute permissions. | 52 // doesn't support execute permissions. |
| 52 // It's similar to the access() system call and will return -errno on errors. | 53 // It's similar to the access() system call and will return -errno on errors. |
| 53 int Access(const char* pathname, int mode) const; | 54 int Access(const char* pathname, int mode) const; |
| 54 // Can be used in place of open(). Will be async signal safe. | 55 // Can be used in place of open(). Will be async signal safe. |
| 55 // The implementation only supports certain white listed flags and will | 56 // The implementation only supports certain white listed flags and will |
| 56 // return -EPERM on other flags. | 57 // return -EPERM on other flags. |
| 57 // It's similar to the open() system call and will return -errno on errors. | 58 // It's similar to the open() system call and will return -errno on errors. |
| (...skipping 35 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 93 pid_t broker_pid_; // The PID of the broker (child). | 94 pid_t broker_pid_; // The PID of the broker (child). |
| 94 const std::vector<std::string> allowed_r_files_; // Files allowed for read. | 95 const std::vector<std::string> allowed_r_files_; // Files allowed for read. |
| 95 const std::vector<std::string> allowed_w_files_; // Files allowed for write. | 96 const std::vector<std::string> allowed_w_files_; // Files allowed for write. |
| 96 int ipc_socketpair_; // Our communication channel to parent or child. | 97 int ipc_socketpair_; // Our communication channel to parent or child. |
| 97 DISALLOW_IMPLICIT_CONSTRUCTORS(BrokerProcess); | 98 DISALLOW_IMPLICIT_CONSTRUCTORS(BrokerProcess); |
| 98 }; | 99 }; |
| 99 | 100 |
| 100 } // namespace sandbox | 101 } // namespace sandbox |
| 101 | 102 |
| 102 #endif // SANDBOX_LINUX_SERVICES_BROKER_PROCESS_H_ | 103 #endif // SANDBOX_LINUX_SERVICES_BROKER_PROCESS_H_ |
| OLD | NEW |