OLD | NEW |
| (Empty) |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | |
2 // Use of this source code is governed by a BSD-style license that can be | |
3 // found in the LICENSE file. | |
4 | |
5 #ifndef SANDBOX_WIN_SRC_BROKER_SERVICES_H_ | |
6 #define SANDBOX_WIN_SRC_BROKER_SERVICES_H_ | |
7 | |
8 #include <list> | |
9 #include <map> | |
10 #include <set> | |
11 #include <utility> | |
12 #include "base/compiler_specific.h" | |
13 #include "base/macros.h" | |
14 #include "base/win/scoped_handle.h" | |
15 #include "sandbox/win/src/crosscall_server.h" | |
16 #include "sandbox/win/src/job.h" | |
17 #include "sandbox/win/src/sandbox.h" | |
18 #include "sandbox/win/src/sharedmem_ipc_server.h" | |
19 #include "sandbox/win/src/win2k_threadpool.h" | |
20 #include "sandbox/win/src/win_utils.h" | |
21 | |
22 namespace { | |
23 | |
24 struct JobTracker; | |
25 struct PeerTracker; | |
26 | |
27 } // namespace | |
28 | |
29 namespace sandbox { | |
30 | |
31 class PolicyBase; | |
32 | |
33 // BrokerServicesBase --------------------------------------------------------- | |
34 // Broker implementation version 0 | |
35 // | |
36 // This is an implementation of the interface BrokerServices and | |
37 // of the associated TargetProcess interface. In this implementation | |
38 // TargetProcess is a friend of BrokerServices where the later manages a | |
39 // collection of the former. | |
40 class BrokerServicesBase final : public BrokerServices, | |
41 public SingletonBase<BrokerServicesBase> { | |
42 public: | |
43 BrokerServicesBase(); | |
44 | |
45 ~BrokerServicesBase(); | |
46 | |
47 // BrokerServices interface. | |
48 ResultCode Init() override; | |
49 TargetPolicy* CreatePolicy() override; | |
50 ResultCode SpawnTarget(const wchar_t* exe_path, | |
51 const wchar_t* command_line, | |
52 TargetPolicy* policy, | |
53 PROCESS_INFORMATION* target) override; | |
54 ResultCode WaitForAllTargets() override; | |
55 ResultCode AddTargetPeer(HANDLE peer_process) override; | |
56 ResultCode InstallAppContainer(const wchar_t* sid, | |
57 const wchar_t* name) override; | |
58 ResultCode UninstallAppContainer(const wchar_t* sid) override; | |
59 | |
60 // Checks if the supplied process ID matches one of the broker's active | |
61 // target processes | |
62 // Returns: | |
63 // true if there is an active target process for this ID, otherwise false. | |
64 bool IsActiveTarget(DWORD process_id); | |
65 | |
66 private: | |
67 typedef std::list<JobTracker*> JobTrackerList; | |
68 typedef std::map<DWORD, PeerTracker*> PeerTrackerMap; | |
69 | |
70 // The routine that the worker thread executes. It is in charge of | |
71 // notifications and cleanup-related tasks. | |
72 static DWORD WINAPI TargetEventsThread(PVOID param); | |
73 | |
74 // Removes a target peer from the process list if it expires. | |
75 static VOID CALLBACK RemovePeer(PVOID parameter, BOOLEAN timeout); | |
76 | |
77 // The completion port used by the job objects to communicate events to | |
78 // the worker thread. | |
79 base::win::ScopedHandle job_port_; | |
80 | |
81 // Handle to a manual-reset event that is signaled when the total target | |
82 // process count reaches zero. | |
83 base::win::ScopedHandle no_targets_; | |
84 | |
85 // Handle to the worker thread that reacts to job notifications. | |
86 base::win::ScopedHandle job_thread_; | |
87 | |
88 // Lock used to protect the list of targets from being modified by 2 | |
89 // threads at the same time. | |
90 CRITICAL_SECTION lock_; | |
91 | |
92 // provides a pool of threads that are used to wait on the IPC calls. | |
93 ThreadProvider* thread_pool_; | |
94 | |
95 // List of the trackers for closing and cleanup purposes. | |
96 JobTrackerList tracker_list_; | |
97 | |
98 // Maps peer process IDs to the saved handle and wait event. | |
99 // Prevents peer callbacks from accessing the broker after destruction. | |
100 PeerTrackerMap peer_map_; | |
101 | |
102 // Provides a fast lookup to identify sandboxed processes that belong to a | |
103 // job. Consult |jobless_process_handles_| for handles of pocess without job. | |
104 std::set<DWORD> child_process_ids_; | |
105 | |
106 DISALLOW_COPY_AND_ASSIGN(BrokerServicesBase); | |
107 }; | |
108 | |
109 } // namespace sandbox | |
110 | |
111 | |
112 #endif // SANDBOX_WIN_SRC_BROKER_SERVICES_H_ | |
OLD | NEW |