| OLD | NEW |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #ifndef CONTENT_BROWSER_CHILD_PROCESS_SECURITY_POLICY_IMPL_H_ | 5 #ifndef CONTENT_BROWSER_CHILD_PROCESS_SECURITY_POLICY_IMPL_H_ |
| 6 #define CONTENT_BROWSER_CHILD_PROCESS_SECURITY_POLICY_IMPL_H_ | 6 #define CONTENT_BROWSER_CHILD_PROCESS_SECURITY_POLICY_IMPL_H_ |
| 7 | 7 |
| 8 | 8 |
| 9 #include <map> | 9 #include <map> |
| 10 #include <set> | 10 #include <set> |
| (...skipping 156 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 167 // --enable-strict-site-isolation or --site-per-process flags are used. | 167 // --enable-strict-site-isolation or --site-per-process flags are used. |
| 168 bool CanSendCookiesForOrigin(int child_id, const GURL& gurl); | 168 bool CanSendCookiesForOrigin(int child_id, const GURL& gurl); |
| 169 | 169 |
| 170 // Sets the process as only permitted to use and see the cookies for the | 170 // Sets the process as only permitted to use and see the cookies for the |
| 171 // given origin. | 171 // given origin. |
| 172 // Only used if the very experimental --enable-strict-site-isolation or | 172 // Only used if the very experimental --enable-strict-site-isolation or |
| 173 // --site-per-process flags are used. | 173 // --site-per-process flags are used. |
| 174 void LockToOrigin(int child_id, const GURL& gurl); | 174 void LockToOrigin(int child_id, const GURL& gurl); |
| 175 | 175 |
| 176 // Determines if certain permissions were granted for a file fystem. | 176 // Determines if certain permissions were granted for a file fystem. |
| 177 // |permissions| must be a bitwise-or'd value of base::PlatformFileFlags. | 177 // |permissions| must be a bitwise-or'd value of |
| 178 // ChildProcessSecurityPermissions. |
| 178 bool HasPermissionsForFileSystem( | 179 bool HasPermissionsForFileSystem( |
| 179 int child_id, | 180 int child_id, |
| 180 const std::string& filesystem_id, | 181 const std::string& filesystem_id, |
| 181 int permission); | 182 int permission); |
| 182 | 183 |
| 183 // Register FileSystem type and permission policy which should be used | 184 // Register FileSystem type and permission policy which should be used |
| 184 // for the type. The |policy| must be a bitwise-or'd value of | 185 // for the type. The |policy| must be a bitwise-or'd value of |
| 185 // fileapi::FilePermissionPolicy. | 186 // fileapi::FilePermissionPolicy. |
| 186 void RegisterFileSystemPermissionPolicy( | 187 void RegisterFileSystemPermissionPolicy( |
| 187 fileapi::FileSystemType type, | 188 fileapi::FileSystemType type, |
| (...skipping 18 matching lines...) Expand all Loading... |
| 206 | 207 |
| 207 // Obtain an instance of ChildProcessSecurityPolicyImpl via GetInstance(). | 208 // Obtain an instance of ChildProcessSecurityPolicyImpl via GetInstance(). |
| 208 ChildProcessSecurityPolicyImpl(); | 209 ChildProcessSecurityPolicyImpl(); |
| 209 friend struct DefaultSingletonTraits<ChildProcessSecurityPolicyImpl>; | 210 friend struct DefaultSingletonTraits<ChildProcessSecurityPolicyImpl>; |
| 210 | 211 |
| 211 // Adds child process during registration. | 212 // Adds child process during registration. |
| 212 void AddChild(int child_id); | 213 void AddChild(int child_id); |
| 213 | 214 |
| 214 // Determines if certain permissions were granted for a file to given child | 215 // Determines if certain permissions were granted for a file to given child |
| 215 // process. |permissions| must be a bitwise-or'd value of | 216 // process. |permissions| must be a bitwise-or'd value of |
| 216 // base::PlatformFileFlags. | 217 // ChildProcessSecurityPermissions. |
| 217 bool ChildProcessHasPermissionsForFile(int child_id, | 218 bool ChildProcessHasPermissionsForFile(int child_id, |
| 218 const base::FilePath& file, | 219 const base::FilePath& file, |
| 219 int permissions); | 220 int permissions); |
| 220 | 221 |
| 221 // Grant a particular permission set for a file. |permissions| is a bit-set | 222 // Grant a particular permission set for a file. |permissions| is a bit-set |
| 222 // of base::PlatformFileFlags. | 223 // of ChildProcessSecurityPermissions. |
| 223 void GrantPermissionsForFile(int child_id, | 224 void GrantPermissionsForFile(int child_id, |
| 224 const base::FilePath& file, | 225 const base::FilePath& file, |
| 225 int permissions); | 226 int permissions); |
| 226 | 227 |
| 227 // Grants access permission to the given isolated file system | 228 // Grants access permission to the given isolated file system |
| 228 // identified by |filesystem_id|. See comments for | 229 // identified by |filesystem_id|. See comments for |
| 229 // ChildProcessSecurityPolicy::GrantReadFileSystem() for more details. | 230 // ChildProcessSecurityPolicy::GrantReadFileSystem() for more details. |
| 230 void GrantPermissionsForFileSystem( | 231 void GrantPermissionsForFileSystem( |
| 231 int child_id, | 232 int child_id, |
| 232 const std::string& filesystem_id, | 233 const std::string& filesystem_id, |
| 233 int permission); | 234 int permission); |
| 234 | 235 |
| 235 // Deprecated: Use CanReadFile, etc. methods instead. | 236 // Deprecated: Use CanReadFile, etc. methods instead. |
| 236 // Determines if certain permissions were granted for a file. |permissions| | 237 // Determines if certain permissions were granted for a file. |permissions| |
| 237 // must be a bitwise-or'd value of base::PlatformFileFlags. | 238 // must be a bitwise-or'd value of ChildProcessSecurityPermissions. |
| 238 bool HasPermissionsForFile(int child_id, | 239 bool HasPermissionsForFile(int child_id, |
| 239 const base::FilePath& file, | 240 const base::FilePath& file, |
| 240 int permissions); | 241 int permissions); |
| 241 | 242 |
| 242 // Deprecated: Use CanReadFileSystemFile, etc. methods instead. | 243 // Deprecated: Use CanReadFileSystemFile, etc. methods instead. |
| 243 // Determines if certain permissions were granted for a file in FileSystem | 244 // Determines if certain permissions were granted for a file in FileSystem |
| 244 // API. |permissions| must be a bitwise-or'd value of base::PlatformFileFlags. | 245 // API. |permissions| must be a bitwise-or'd value of |
| 246 // ChildProcessSecurityPermissions. |
| 245 bool HasPermissionsForFileSystemFile(int child_id, | 247 bool HasPermissionsForFileSystemFile(int child_id, |
| 246 const fileapi::FileSystemURL& url, | 248 const fileapi::FileSystemURL& url, |
| 247 int permissions); | 249 int permissions); |
| 248 | 250 |
| 249 // You must acquire this lock before reading or writing any members of this | 251 // You must acquire this lock before reading or writing any members of this |
| 250 // class. You must not block while holding this lock. | 252 // class. You must not block while holding this lock. |
| 251 base::Lock lock_; | 253 base::Lock lock_; |
| 252 | 254 |
| 253 // These schemes are white-listed for all child processes. This set is | 255 // These schemes are white-listed for all child processes. This set is |
| 254 // protected by |lock_|. | 256 // protected by |lock_|. |
| (...skipping 15 matching lines...) Expand all Loading... |
| 270 WorkerToMainProcessMap worker_map_; | 272 WorkerToMainProcessMap worker_map_; |
| 271 | 273 |
| 272 FileSystemPermissionPolicyMap file_system_policy_map_; | 274 FileSystemPermissionPolicyMap file_system_policy_map_; |
| 273 | 275 |
| 274 DISALLOW_COPY_AND_ASSIGN(ChildProcessSecurityPolicyImpl); | 276 DISALLOW_COPY_AND_ASSIGN(ChildProcessSecurityPolicyImpl); |
| 275 }; | 277 }; |
| 276 | 278 |
| 277 } // namespace content | 279 } // namespace content |
| 278 | 280 |
| 279 #endif // CONTENT_BROWSER_CHILD_PROCESS_SECURITY_POLICY_IMPL_H_ | 281 #endif // CONTENT_BROWSER_CHILD_PROCESS_SECURITY_POLICY_IMPL_H_ |
| OLD | NEW |