Add sandbox support for process memory limits

sandbox/win/src/sandbox_policy_base.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sandbox/win/src/sandbox_policy_base.h"
 
 #include "base/basictypes.h"
 #include "base/callback.h"
 #include "base/logging.h"
 #include "base/win/windows_version.h"
@@ skipping 62 matching lines @@
 // Initializes static members.
 HWINSTA PolicyBase::alternate_winstation_handle_ = NULL;
 HDESK PolicyBase::alternate_desktop_handle_ = NULL;
 
 PolicyBase::PolicyBase()
     : ref_count(1),
       lockdown_level_(USER_LOCKDOWN),
       initial_level_(USER_LOCKDOWN),
       job_level_(JOB_LOCKDOWN),
       ui_exceptions_(0),
+      process_memory_limit_(0),

[cpu_(ooo_6.6-7.5), 2014/06/06 19:44:05]

maybe rename to memory_limit_ ? 

[jschuh, 2014/06/06 20:13:14]

Sure.

+      terminate_on_memory_limit_(false),
       use_alternate_desktop_(false),
       use_alternate_winstation_(false),
       file_system_init_(false),
       relaxed_interceptions_(true),
       stdout_handle_(INVALID_HANDLE_VALUE),
       stderr_handle_(INVALID_HANDLE_VALUE),
       integrity_level_(INTEGRITY_LEVEL_LAST),
       delayed_integrity_level_(INTEGRITY_LEVEL_LAST),
       mitigations_(0),
       delayed_mitigations_(0),
@@ skipping 67 matching lines @@
   lockdown_level_ = lockdown;
   return SBOX_ALL_OK;
 }
 
 ResultCode PolicyBase::SetJobLevel(JobLevel job_level, uint32 ui_exceptions) {
   job_level_ = job_level;
   ui_exceptions_ = ui_exceptions;
   return SBOX_ALL_OK;
 }
 
+ResultCode PolicyBase::SetJobMemoryLimit(size_t limit, bool terminate) {
+  if (limit && job_level_ == JOB_NONE) {
+    return SBOX_ERROR_BAD_PARAMS;
+  }
+  process_memory_limit_ = limit;
+  terminate_on_memory_limit_ = terminate;
+  return SBOX_ALL_OK;
+}
+
+bool PolicyBase::WillTerminateOnJobMemoryLimit() const {
+  return terminate_on_memory_limit_;
+}
+
 ResultCode PolicyBase::SetAlternateDesktop(bool alternate_winstation) {
   use_alternate_desktop_ = true;
   use_alternate_winstation_ = alternate_winstation;
   return CreateAlternateDesktop(alternate_winstation);
 }
 
 base::string16 PolicyBase::GetAlternateDesktop() const {
   // No alternate desktop or winstation. Return an empty string.
   if (!use_alternate_desktop_ && !use_alternate_winstation_) {
     return base::string16();
@@ skipping 272 matching lines @@
     NOTREACHED();
     return false;
   }
   return dispatch->SetupService(manager, service);
 }
 
 ResultCode PolicyBase::MakeJobObject(HANDLE* job) {
   if (job_level_ != JOB_NONE) {
     // Create the windows job object.
     Job job_obj;
+    job_obj.SetProcessMemoryLimit(process_memory_limit_);
     DWORD result = job_obj.Init(job_level_, NULL, ui_exceptions_);

[cpu_(ooo_6.6-7.5), 2014/06/06 19:44:05]

seems best to move to job_obj.Init(..., memory_limit); so we don't have to store
that number again inside the job.

[jschuh, 2014/06/06 20:13:14]

Sure.

     if (ERROR_SUCCESS != result) {
       return SBOX_ERROR_GENERIC;
     }
     *job = job_obj.Detach();
   } else {
     *job = NULL;
   }
   return SBOX_ALL_OK;
 }
 
@@ skipping 193 matching lines @@
 
   // Finally, setup imports on the target so the interceptions can work.
   return SetupNtdllImports(target);
 }
 
 bool PolicyBase::SetupHandleCloser(TargetProcess* target) {
   return handle_closer_.InitializeTargetHandles(target);
 }
 
 }  // namespace sandbox