OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #ifndef CONTENT_PUBLIC_COMMON_SANDBOX_INIT_H_ | 5 #ifndef CONTENT_PUBLIC_COMMON_SANDBOX_INIT_H_ |
6 #define CONTENT_PUBLIC_COMMON_SANDBOX_INIT_H_ | 6 #define CONTENT_PUBLIC_COMMON_SANDBOX_INIT_H_ |
7 | 7 |
8 #include <memory> | 8 #include <memory> |
9 | 9 |
10 #include "base/files/scoped_file.h" | 10 #include "base/files/scoped_file.h" |
11 #include "base/memory/shared_memory.h" | 11 #include "base/memory/shared_memory.h" |
12 #include "base/process/launch.h" | 12 #include "base/process/launch.h" |
13 #include "base/process/process.h" | 13 #include "base/process/process.h" |
14 #include "base/process/process_handle.h" | 14 #include "base/process/process_handle.h" |
15 #include "build/build_config.h" | 15 #include "build/build_config.h" |
16 #include "content/common/content_export.h" | 16 #include "content/common/content_export.h" |
17 | 17 |
18 namespace base { | 18 namespace base { |
19 class CommandLine; | 19 class CommandLine; |
20 class FilePath; | 20 class FilePath; |
21 } | 21 } |
22 | 22 |
23 namespace sandbox { | 23 namespace sandbox { |
24 namespace bpf_dsl { | 24 namespace bpf_dsl { |
25 class Policy; | 25 class Policy; |
26 } | 26 } |
27 struct SandboxInterfaceInfo; | 27 struct SandboxInterfaceInfo; |
| 28 enum ResultCode : int; |
28 } | 29 } |
29 | 30 |
30 namespace content { | 31 namespace content { |
31 class SandboxedProcessLauncherDelegate; | 32 class SandboxedProcessLauncherDelegate; |
32 | 33 |
33 #if defined(OS_WIN) | 34 #if defined(OS_WIN) |
34 | 35 |
35 // Initialize the sandbox for renderer, gpu, utility, worker, nacl, and plugin | 36 // Initialize the sandbox for renderer, gpu, utility, worker, nacl, and plugin |
36 // processes, depending on the command line flags. Although The browser process | 37 // processes, depending on the command line flags. Although The browser process |
37 // is not sandboxed, this also needs to be called because it will initialize | 38 // is not sandboxed, this also needs to be called because it will initialize |
38 // the broker code. | 39 // the broker code. |
39 // Returns true if the sandbox was initialized succesfully, false if an error | 40 // Returns true if the sandbox was initialized succesfully, false if an error |
40 // occurred. If process_type isn't one that needs sandboxing true is always | 41 // occurred. If process_type isn't one that needs sandboxing true is always |
41 // returned. | 42 // returned. |
42 CONTENT_EXPORT bool InitializeSandbox( | 43 CONTENT_EXPORT bool InitializeSandbox( |
43 sandbox::SandboxInterfaceInfo* sandbox_info); | 44 sandbox::SandboxInterfaceInfo* sandbox_info); |
44 | 45 |
45 // Launch a sandboxed process. |delegate| may be NULL. If |delegate| is non-NULL | 46 // Launch a sandboxed process. |delegate| may be NULL. If |delegate| is non-NULL |
46 // then it just has to outlive this method call. |handles_to_inherit| is a list | 47 // then it just has to outlive this method call. |handles_to_inherit| is a list |
47 // of handles for the child process to inherit. The caller retains ownership of | 48 // of handles for the child process to inherit. The caller retains ownership of |
48 // the handles. | 49 // the handles. |
49 CONTENT_EXPORT base::Process StartSandboxedProcess( | 50 CONTENT_EXPORT sandbox::ResultCode StartSandboxedProcess( |
50 SandboxedProcessLauncherDelegate* delegate, | 51 SandboxedProcessLauncherDelegate* delegate, |
51 base::CommandLine* cmd_line, | 52 base::CommandLine* cmd_line, |
52 const base::HandlesToInheritVector& handles_to_inherit); | 53 const base::HandlesToInheritVector& handles_to_inherit, |
| 54 base::Process* process); |
53 | 55 |
54 #elif defined(OS_MACOSX) | 56 #elif defined(OS_MACOSX) |
55 | 57 |
56 // Initialize the sandbox of the given |sandbox_type|, optionally specifying a | 58 // Initialize the sandbox of the given |sandbox_type|, optionally specifying a |
57 // directory to allow access to. Note specifying a directory needs to be | 59 // directory to allow access to. Note specifying a directory needs to be |
58 // supported by the sandbox profile associated with the given |sandbox_type|. | 60 // supported by the sandbox profile associated with the given |sandbox_type|. |
59 // Valid values for |sandbox_type| are defined either by the enum SandboxType, | 61 // Valid values for |sandbox_type| are defined either by the enum SandboxType, |
60 // or by ContentClient::GetSandboxProfileForSandboxType(). | 62 // or by ContentClient::GetSandboxProfileForSandboxType(). |
61 // | 63 // |
62 // If the |sandbox_type| isn't one of the ones defined by content then the | 64 // If the |sandbox_type| isn't one of the ones defined by content then the |
(...skipping 21 matching lines...) Expand all Loading... |
84 | 86 |
85 // Return a "baseline" policy. This is used by a SandboxInitializerDelegate to | 87 // Return a "baseline" policy. This is used by a SandboxInitializerDelegate to |
86 // implement a policy that is derived from the baseline. | 88 // implement a policy that is derived from the baseline. |
87 CONTENT_EXPORT std::unique_ptr<sandbox::bpf_dsl::Policy> | 89 CONTENT_EXPORT std::unique_ptr<sandbox::bpf_dsl::Policy> |
88 GetBPFSandboxBaselinePolicy(); | 90 GetBPFSandboxBaselinePolicy(); |
89 #endif // defined(OS_LINUX) || defined(OS_NACL_NONSFI) | 91 #endif // defined(OS_LINUX) || defined(OS_NACL_NONSFI) |
90 | 92 |
91 } // namespace content | 93 } // namespace content |
92 | 94 |
93 #endif // CONTENT_PUBLIC_COMMON_SANDBOX_INIT_H_ | 95 #endif // CONTENT_PUBLIC_COMMON_SANDBOX_INIT_H_ |
OLD | NEW |