Index: sandbox/win/src/sandbox_policy_base.h |
diff --git a/sandbox/win/src/sandbox_policy_base.h b/sandbox/win/src/sandbox_policy_base.h |
deleted file mode 100644 |
index 31f0d9c58ef1eed0018840603665bc6745d7a8fb..0000000000000000000000000000000000000000 |
--- a/sandbox/win/src/sandbox_policy_base.h |
+++ /dev/null |
@@ -1,178 +0,0 @@ |
-// Copyright (c) 2011 The Chromium Authors. All rights reserved. |
-// Use of this source code is governed by a BSD-style license that can be |
-// found in the LICENSE file. |
- |
-#ifndef SANDBOX_WIN_SRC_SANDBOX_POLICY_BASE_H_ |
-#define SANDBOX_WIN_SRC_SANDBOX_POLICY_BASE_H_ |
- |
-#include <windows.h> |
-#include <stddef.h> |
-#include <stdint.h> |
- |
-#include <list> |
-#include <vector> |
- |
-#include "base/compiler_specific.h" |
-#include "base/macros.h" |
-#include "base/memory/scoped_ptr.h" |
-#include "base/process/launch.h" |
-#include "base/strings/string16.h" |
-#include "base/win/scoped_handle.h" |
-#include "sandbox/win/src/crosscall_server.h" |
-#include "sandbox/win/src/handle_closer.h" |
-#include "sandbox/win/src/ipc_tags.h" |
-#include "sandbox/win/src/policy_engine_opcodes.h" |
-#include "sandbox/win/src/policy_engine_params.h" |
-#include "sandbox/win/src/sandbox_policy.h" |
-#include "sandbox/win/src/win_utils.h" |
- |
-namespace sandbox { |
- |
-class AppContainerAttributes; |
-class LowLevelPolicy; |
-class TargetProcess; |
-struct PolicyGlobal; |
- |
-class PolicyBase final : public TargetPolicy { |
- public: |
- PolicyBase(); |
- |
- // TargetPolicy: |
- void AddRef() override; |
- void Release() override; |
- ResultCode SetTokenLevel(TokenLevel initial, TokenLevel lockdown) override; |
- TokenLevel GetInitialTokenLevel() const override; |
- TokenLevel GetLockdownTokenLevel() const override; |
- ResultCode SetJobLevel(JobLevel job_level, uint32_t ui_exceptions) override; |
- JobLevel GetJobLevel() const override; |
- ResultCode SetJobMemoryLimit(size_t memory_limit) override; |
- ResultCode SetAlternateDesktop(bool alternate_winstation) override; |
- base::string16 GetAlternateDesktop() const override; |
- ResultCode CreateAlternateDesktop(bool alternate_winstation) override; |
- void DestroyAlternateDesktop() override; |
- ResultCode SetIntegrityLevel(IntegrityLevel integrity_level) override; |
- IntegrityLevel GetIntegrityLevel() const override; |
- ResultCode SetDelayedIntegrityLevel(IntegrityLevel integrity_level) override; |
- ResultCode SetAppContainer(const wchar_t* sid) override; |
- ResultCode SetCapability(const wchar_t* sid) override; |
- ResultCode SetLowBox(const wchar_t* sid) override; |
- ResultCode SetProcessMitigations(MitigationFlags flags) override; |
- MitigationFlags GetProcessMitigations() override; |
- ResultCode SetDelayedProcessMitigations(MitigationFlags flags) override; |
- MitigationFlags GetDelayedProcessMitigations() const override; |
- void SetDisconnectCsrss() override; |
- void SetStrictInterceptions() override; |
- ResultCode SetStdoutHandle(HANDLE handle) override; |
- ResultCode SetStderrHandle(HANDLE handle) override; |
- ResultCode AddRule(SubSystem subsystem, |
- Semantics semantics, |
- const wchar_t* pattern) override; |
- ResultCode AddDllToUnload(const wchar_t* dll_name) override; |
- ResultCode AddKernelObjectToClose(const base::char16* handle_type, |
- const base::char16* handle_name) override; |
- void AddHandleToShare(HANDLE handle) override; |
- void SetLockdownDefaultDacl() override; |
- |
- // Creates a Job object with the level specified in a previous call to |
- // SetJobLevel(). |
- ResultCode MakeJobObject(base::win::ScopedHandle* job); |
- |
- // Creates the two tokens with the levels specified in a previous call to |
- // SetTokenLevel(). Also creates a lowbox token if specified based on the |
- // lowbox SID. |
- ResultCode MakeTokens(base::win::ScopedHandle* initial, |
- base::win::ScopedHandle* lockdown, |
- base::win::ScopedHandle* lowbox); |
- |
- const AppContainerAttributes* GetAppContainer() const; |
- |
- PSID GetLowBoxSid() const; |
- |
- // Adds a target process to the internal list of targets. Internally a |
- // call to TargetProcess::Init() is issued. |
- bool AddTarget(TargetProcess* target); |
- |
- // Called when there are no more active processes in a Job. |
- // Removes a Job object associated with this policy and the target associated |
- // with the job. |
- bool OnJobEmpty(HANDLE job); |
- |
- EvalResult EvalPolicy(int service, CountedParameterSetBase* params); |
- |
- HANDLE GetStdoutHandle(); |
- HANDLE GetStderrHandle(); |
- |
- // Returns the list of handles being shared with the target process. |
- const base::HandlesToInheritVector& GetHandlesBeingShared(); |
- |
- private: |
- ~PolicyBase(); |
- |
- // Sets up interceptions for a new target. |
- bool SetupAllInterceptions(TargetProcess* target); |
- |
- // Sets up the handle closer for a new target. |
- bool SetupHandleCloser(TargetProcess* target); |
- |
- ResultCode AddRuleInternal(SubSystem subsystem, |
- Semantics semantics, |
- const wchar_t* pattern); |
- |
- // This lock synchronizes operations on the targets_ collection. |
- CRITICAL_SECTION lock_; |
- // Maintains the list of target process associated with this policy. |
- // The policy takes ownership of them. |
- typedef std::list<TargetProcess*> TargetSet; |
- TargetSet targets_; |
- // Standard object-lifetime reference counter. |
- volatile LONG ref_count; |
- // The user-defined global policy settings. |
- TokenLevel lockdown_level_; |
- TokenLevel initial_level_; |
- JobLevel job_level_; |
- uint32_t ui_exceptions_; |
- size_t memory_limit_; |
- bool use_alternate_desktop_; |
- bool use_alternate_winstation_; |
- // Helps the file system policy initialization. |
- bool file_system_init_; |
- bool relaxed_interceptions_; |
- HANDLE stdout_handle_; |
- HANDLE stderr_handle_; |
- IntegrityLevel integrity_level_; |
- IntegrityLevel delayed_integrity_level_; |
- MitigationFlags mitigations_; |
- MitigationFlags delayed_mitigations_; |
- bool is_csrss_connected_; |
- // Object in charge of generating the low level policy. |
- LowLevelPolicy* policy_maker_; |
- // Memory structure that stores the low level policy. |
- PolicyGlobal* policy_; |
- // The list of dlls to unload in the target process. |
- std::vector<base::string16> blacklisted_dlls_; |
- // This is a map of handle-types to names that we need to close in the |
- // target process. A null set means we need to close all handles of the |
- // given type. |
- HandleCloser handle_closer_; |
- std::vector<base::string16> capabilities_; |
- scoped_ptr<AppContainerAttributes> appcontainer_list_; |
- PSID lowbox_sid_; |
- base::win::ScopedHandle lowbox_directory_; |
- scoped_ptr<Dispatcher> dispatcher_; |
- bool lockdown_default_dacl_; |
- |
- static HDESK alternate_desktop_handle_; |
- static HWINSTA alternate_winstation_handle_; |
- static IntegrityLevel alternate_desktop_integrity_level_label_; |
- |
- // Contains the list of handles being shared with the target process. |
- // This list contains handles other than the stderr/stdout handles which are |
- // shared with the target at times. |
- base::HandlesToInheritVector handles_to_share_; |
- |
- DISALLOW_COPY_AND_ASSIGN(PolicyBase); |
-}; |
- |
-} // namespace sandbox |
- |
-#endif // SANDBOX_WIN_SRC_SANDBOX_POLICY_BASE_H_ |