Initial implementation of the Mac Bootstrap Sandbox.

sandbox/mac/policy.h

Index: sandbox/mac/policy.h
diff --git a/sandbox/mac/policy.h b/sandbox/mac/policy.h
new file mode 100644
index 0000000000000000000000000000000000000000..56825bc7c77f86814aa1cfcaef5123c0a7744ccf
--- /dev/null
+++ b/sandbox/mac/policy.h
@@ -0,0 +1,55 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef SANDBOX_MAC_POLICY_H_
+#define SANDBOX_MAC_POLICY_H_
+
+#include <mach/mach.h>
+
+#include <map>
+#include <string>
+
+namespace sandbox {
+
+enum PolicyDecision {
+  POLICY_DECISION_INVALID,
+  // Explicitly allows the real service to be looked up from launchd.
+  POLICY_ALLOW,
+  // Deny the look up request by replying with a MIG error. This is the
+  // default behavior for servers not given an explicit rule.
+  POLICY_DENY_ERROR,
+  // Deny the look up request with a well-formed reply containing a
+  // Mach port with a send right, messages to which will be ignored.
+  POLICY_DENY_DUMMY_PORT,
+  // Reply to the look up request with a send right to the substitute_port
+  // specified in the Rule.
+  POLICY_SUBSTITUE_PORT,
+  POLICY_DECISION_LAST,
+};
+
+// A Rule expresses the action to take when a service port is requested via
+// bootstrap_look_up. If |result| is not POLICY_SUBSTITUE_PORT, then
+// |substitute_port| must be NULL. If result is POLICY_SUBSTITUE_PORT, then
+// |substitute_port| must not be NULL.
+struct Rule {
+  Rule();

[Mark Mentovai, 2014/05/06 20:51:50]

Do you need this? I don’t consider the only use being in a test to be a “need.”

[Robert Sesek, 2014/05/08 20:58:12]

For STL containers, yes.

+  explicit Rule(PolicyDecision result);
+  explicit Rule(mach_port_t override_port);
+
+  Rule(const Rule& other);
+  void operator=(const Rule& other);
+
+  PolicyDecision result;
+  mach_port_t substitute_port;

[Mark Mentovai, 2014/05/06 20:51:50]

Comment on the ownership of this port, or it’s unclear whether the Rule assumes
responsibility for deallocating it or something else.

[Robert Sesek, 2014/05/08 20:58:12]

Done.

+};
+
+// A SandboxPolicy maps bootstrap server names to policy Rules.
+typedef std::map<std::string, Rule> BootstrapSandboxPolicy;
+
+// Checks that a policy is well-formed.
+bool IsPolicyValid(const BootstrapSandboxPolicy& policy);
+
+}  // namespace sandbox
+
+#endif  // SANDBOX_MAC_POLICY_H_