OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #ifndef SANDBOX_LINUX_SERVICES_BROKER_PROCESS_H_ | 5 #ifndef SANDBOX_LINUX_SERVICES_BROKER_PROCESS_H_ |
6 #define SANDBOX_LINUX_SERVICES_BROKER_PROCESS_H_ | 6 #define SANDBOX_LINUX_SERVICES_BROKER_PROCESS_H_ |
7 | 7 |
8 #include <string> | 8 #include <string> |
9 #include <vector> | 9 #include <vector> |
10 | 10 |
11 #include "base/basictypes.h" | 11 #include "base/basictypes.h" |
| 12 #include "base/callback_forward.h" |
12 #include "base/pickle.h" | 13 #include "base/pickle.h" |
13 #include "base/process/process.h" | 14 #include "base/process/process.h" |
14 | 15 |
15 namespace sandbox { | 16 namespace sandbox { |
16 | 17 |
17 // Create a new "broker" process to which we can send requests via an IPC | 18 // Create a new "broker" process to which we can send requests via an IPC |
18 // channel. | 19 // channel. |
19 // This is a low level IPC mechanism that is suitable to be called from a | 20 // This is a low level IPC mechanism that is suitable to be called from a |
20 // signal handler. | 21 // signal handler. |
21 // A process would typically create a broker process before entering | 22 // A process would typically create a broker process before entering |
(...skipping 13 matching lines...) Expand all Loading... |
35 // |fast_check_in_client| and |quiet_failures_for_tests| are reserved for | 36 // |fast_check_in_client| and |quiet_failures_for_tests| are reserved for |
36 // unit tests, don't use it. | 37 // unit tests, don't use it. |
37 explicit BrokerProcess(int denied_errno, | 38 explicit BrokerProcess(int denied_errno, |
38 const std::vector<std::string>& allowed_r_files, | 39 const std::vector<std::string>& allowed_r_files, |
39 const std::vector<std::string>& allowed_w_files, | 40 const std::vector<std::string>& allowed_w_files, |
40 bool fast_check_in_client = true, | 41 bool fast_check_in_client = true, |
41 bool quiet_failures_for_tests = false); | 42 bool quiet_failures_for_tests = false); |
42 ~BrokerProcess(); | 43 ~BrokerProcess(); |
43 // Will initialize the broker process. There should be no threads at this | 44 // Will initialize the broker process. There should be no threads at this |
44 // point, since we need to fork(). | 45 // point, since we need to fork(). |
45 // sandbox_callback is a function that should be called to enable the | 46 // broker_process_init_callback will be called in the new broker process, |
46 // sandbox in the broker. | 47 // after fork() returns. |
47 bool Init(bool (*sandbox_callback)(void)); | 48 bool Init(const base::Callback<bool(void)>& broker_process_init_callback); |
48 | 49 |
49 // Can be used in place of access(). Will be async signal safe. | 50 // Can be used in place of access(). Will be async signal safe. |
50 // X_OK will always return an error in practice since the broker process | 51 // X_OK will always return an error in practice since the broker process |
51 // doesn't support execute permissions. | 52 // doesn't support execute permissions. |
52 // It's similar to the access() system call and will return -errno on errors. | 53 // It's similar to the access() system call and will return -errno on errors. |
53 int Access(const char* pathname, int mode) const; | 54 int Access(const char* pathname, int mode) const; |
54 // Can be used in place of open(). Will be async signal safe. | 55 // Can be used in place of open(). Will be async signal safe. |
55 // The implementation only supports certain white listed flags and will | 56 // The implementation only supports certain white listed flags and will |
56 // return -EPERM on other flags. | 57 // return -EPERM on other flags. |
57 // It's similar to the open() system call and will return -errno on errors. | 58 // It's similar to the open() system call and will return -errno on errors. |
(...skipping 35 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
93 pid_t broker_pid_; // The PID of the broker (child). | 94 pid_t broker_pid_; // The PID of the broker (child). |
94 const std::vector<std::string> allowed_r_files_; // Files allowed for read. | 95 const std::vector<std::string> allowed_r_files_; // Files allowed for read. |
95 const std::vector<std::string> allowed_w_files_; // Files allowed for write. | 96 const std::vector<std::string> allowed_w_files_; // Files allowed for write. |
96 int ipc_socketpair_; // Our communication channel to parent or child. | 97 int ipc_socketpair_; // Our communication channel to parent or child. |
97 DISALLOW_IMPLICIT_CONSTRUCTORS(BrokerProcess); | 98 DISALLOW_IMPLICIT_CONSTRUCTORS(BrokerProcess); |
98 }; | 99 }; |
99 | 100 |
100 } // namespace sandbox | 101 } // namespace sandbox |
101 | 102 |
102 #endif // SANDBOX_LINUX_SERVICES_BROKER_PROCESS_H_ | 103 #endif // SANDBOX_LINUX_SERVICES_BROKER_PROCESS_H_ |
OLD | NEW |