Refactor configuration of sandboxes - first steps

content/public/common/sandboxed_process_launcher_delegate.h

Index: content/public/common/sandboxed_process_launcher_delegate.h
diff --git a/content/public/common/sandboxed_process_launcher_delegate.h b/content/public/common/sandboxed_process_launcher_delegate.h
index 6357211ee29bb536d3fdc63121e7fd03c909172b..1c60d1393e2edf375ed835c04bc2add9b3a392b1 100644
--- a/content/public/common/sandboxed_process_launcher_delegate.h
+++ b/content/public/common/sandboxed_process_launcher_delegate.h
@@ -5,8 +5,11 @@
 #ifndef CONTENT_PUBLIC_COMMON_SANDBOXED_PROCESS_LAUNCHER_DELEGATE_H_
 #define CONTENT_PUBLIC_COMMON_SANDBOXED_PROCESS_LAUNCHER_DELEGATE_H_
 
+#include "base/environment.h"
 #include "base/process/process.h"
 
+#include "content/common/content_export.h"
+
 namespace base {
 class FilePath;
 }
@@ -21,14 +24,19 @@ namespace content {
 // BrowserChildProcessHost/ChildProcessLauncher to control the sandbox policy,
 // i.e. to loosen it if needed.
 // The methods below will be called on the PROCESS_LAUNCHER thread.
-class SandboxedProcessLauncherDelegate {
+class CONTENT_EXPORT SandboxedProcessLauncherDelegate {
  public:
   virtual ~SandboxedProcessLauncherDelegate() {}
 
-  // By default, the process is launched sandboxed. Override this method and set
-  // |in_sandbox| to false if this process should be launched without a sandbox
+#if defined(OS_WIN)
+  // Override to return true if the process should be launched as an elevated
+  // process (which implies no sandbox).
+  virtual bool ShouldLaunchElevated();
+
+  // By default, the process is launched sandboxed. Override this method to
+  // return false if the process should be launched without a sandbox
   // (i.e. through base::LaunchProcess directly).
-  virtual void ShouldSandbox(bool* in_sandbox) {}
+  virtual bool ShouldSandbox();
 
   // Called before the default sandbox is applied. If the default policy is too
   // restrictive, the caller should set |disable_default_policy| to true and
@@ -43,6 +51,18 @@ class SandboxedProcessLauncherDelegate {
 
   // Called right after the process is launched, but before its thread is run.
   virtual void PostSpawnTarget(base::ProcessHandle process) {}
+
+#elif defined(OS_POSIX)
+  // Override this to return true to use the setuid sandbox.
+  virtual bool ShouldUseZygote();
+
+  // Override this if the process needs a non-empty environment map.
+  virtual base::EnvironmentMap GetEnvironment();
+
+  // Return the File descriptor for the IPC channel.

[Mark Seaborn, 2014/02/28 22:12:24]

Nit: lower case "file"?

[aberent, 2014/03/12 21:58:58]

Done.

+  virtual int GetIpcFd() = 0;
+
+#endif
 };
 
 }  // namespace content