| OLD | NEW |
| (Empty) |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | |
| 2 // Use of this source code is governed by a BSD-style license that can be | |
| 3 // found in the LICENSE file. | |
| 4 | |
| 5 #ifndef SANDBOX_WIN_SRC_BROKER_SERVICES_H_ | |
| 6 #define SANDBOX_WIN_SRC_BROKER_SERVICES_H_ | |
| 7 | |
| 8 #include <list> | |
| 9 #include <map> | |
| 10 #include <set> | |
| 11 #include <utility> | |
| 12 #include "base/compiler_specific.h" | |
| 13 #include "base/macros.h" | |
| 14 #include "base/win/scoped_handle.h" | |
| 15 #include "sandbox/win/src/crosscall_server.h" | |
| 16 #include "sandbox/win/src/job.h" | |
| 17 #include "sandbox/win/src/sandbox.h" | |
| 18 #include "sandbox/win/src/sharedmem_ipc_server.h" | |
| 19 #include "sandbox/win/src/win2k_threadpool.h" | |
| 20 #include "sandbox/win/src/win_utils.h" | |
| 21 | |
| 22 namespace { | |
| 23 | |
| 24 struct JobTracker; | |
| 25 struct PeerTracker; | |
| 26 | |
| 27 } // namespace | |
| 28 | |
| 29 namespace sandbox { | |
| 30 | |
| 31 class PolicyBase; | |
| 32 | |
| 33 // BrokerServicesBase --------------------------------------------------------- | |
| 34 // Broker implementation version 0 | |
| 35 // | |
| 36 // This is an implementation of the interface BrokerServices and | |
| 37 // of the associated TargetProcess interface. In this implementation | |
| 38 // TargetProcess is a friend of BrokerServices where the later manages a | |
| 39 // collection of the former. | |
| 40 class BrokerServicesBase final : public BrokerServices, | |
| 41 public SingletonBase<BrokerServicesBase> { | |
| 42 public: | |
| 43 BrokerServicesBase(); | |
| 44 | |
| 45 ~BrokerServicesBase(); | |
| 46 | |
| 47 // BrokerServices interface. | |
| 48 ResultCode Init() override; | |
| 49 TargetPolicy* CreatePolicy() override; | |
| 50 ResultCode SpawnTarget(const wchar_t* exe_path, | |
| 51 const wchar_t* command_line, | |
| 52 TargetPolicy* policy, | |
| 53 PROCESS_INFORMATION* target) override; | |
| 54 ResultCode WaitForAllTargets() override; | |
| 55 ResultCode AddTargetPeer(HANDLE peer_process) override; | |
| 56 ResultCode InstallAppContainer(const wchar_t* sid, | |
| 57 const wchar_t* name) override; | |
| 58 ResultCode UninstallAppContainer(const wchar_t* sid) override; | |
| 59 | |
| 60 // Checks if the supplied process ID matches one of the broker's active | |
| 61 // target processes | |
| 62 // Returns: | |
| 63 // true if there is an active target process for this ID, otherwise false. | |
| 64 bool IsActiveTarget(DWORD process_id); | |
| 65 | |
| 66 private: | |
| 67 typedef std::list<JobTracker*> JobTrackerList; | |
| 68 typedef std::map<DWORD, PeerTracker*> PeerTrackerMap; | |
| 69 | |
| 70 // The routine that the worker thread executes. It is in charge of | |
| 71 // notifications and cleanup-related tasks. | |
| 72 static DWORD WINAPI TargetEventsThread(PVOID param); | |
| 73 | |
| 74 // Removes a target peer from the process list if it expires. | |
| 75 static VOID CALLBACK RemovePeer(PVOID parameter, BOOLEAN timeout); | |
| 76 | |
| 77 // The completion port used by the job objects to communicate events to | |
| 78 // the worker thread. | |
| 79 base::win::ScopedHandle job_port_; | |
| 80 | |
| 81 // Handle to a manual-reset event that is signaled when the total target | |
| 82 // process count reaches zero. | |
| 83 base::win::ScopedHandle no_targets_; | |
| 84 | |
| 85 // Handle to the worker thread that reacts to job notifications. | |
| 86 base::win::ScopedHandle job_thread_; | |
| 87 | |
| 88 // Lock used to protect the list of targets from being modified by 2 | |
| 89 // threads at the same time. | |
| 90 CRITICAL_SECTION lock_; | |
| 91 | |
| 92 // provides a pool of threads that are used to wait on the IPC calls. | |
| 93 ThreadProvider* thread_pool_; | |
| 94 | |
| 95 // List of the trackers for closing and cleanup purposes. | |
| 96 JobTrackerList tracker_list_; | |
| 97 | |
| 98 // Maps peer process IDs to the saved handle and wait event. | |
| 99 // Prevents peer callbacks from accessing the broker after destruction. | |
| 100 PeerTrackerMap peer_map_; | |
| 101 | |
| 102 // Provides a fast lookup to identify sandboxed processes that belong to a | |
| 103 // job. Consult |jobless_process_handles_| for handles of pocess without job. | |
| 104 std::set<DWORD> child_process_ids_; | |
| 105 | |
| 106 DISALLOW_COPY_AND_ASSIGN(BrokerServicesBase); | |
| 107 }; | |
| 108 | |
| 109 } // namespace sandbox | |
| 110 | |
| 111 | |
| 112 #endif // SANDBOX_WIN_SRC_BROKER_SERVICES_H_ | |
| OLD | NEW |