OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #ifndef CONTENT_COMMON_SANDBOX_LINUX_SANDBOX_SECCOMP_BPF_LINUX_H_ | 5 #ifndef CONTENT_COMMON_SANDBOX_LINUX_SANDBOX_SECCOMP_BPF_LINUX_H_ |
6 #define CONTENT_COMMON_SANDBOX_LINUX_SANDBOX_SECCOMP_BPF_LINUX_H_ | 6 #define CONTENT_COMMON_SANDBOX_LINUX_SANDBOX_SECCOMP_BPF_LINUX_H_ |
7 | 7 |
8 #include <string> | 8 #include <string> |
9 | 9 |
10 #include "base/basictypes.h" | 10 #include "base/basictypes.h" |
11 #include "base/memory/scoped_ptr.h" | 11 #include "base/memory/scoped_ptr.h" |
12 | 12 |
13 namespace sandbox { | 13 namespace sandbox { |
14 class SandboxBPFPolicy; | 14 namespace bpf_dsl { |
| 15 class SandboxBPFDSLPolicy; |
| 16 } |
15 } | 17 } |
16 | 18 |
17 namespace content { | 19 namespace content { |
18 | 20 |
19 // This class has two main sets of APIs. One can be used to start the sandbox | 21 // This class has two main sets of APIs. One can be used to start the sandbox |
20 // for internal content process types, the other is indirectly exposed as | 22 // for internal content process types, the other is indirectly exposed as |
21 // a public content/ API and uses a supplied policy. | 23 // a public content/ API and uses a supplied policy. |
22 class SandboxSeccompBPF { | 24 class SandboxSeccompBPF { |
23 public: | 25 public: |
24 // This is the API to enable a seccomp-bpf sandbox for content/ | 26 // This is the API to enable a seccomp-bpf sandbox for content/ |
25 // process-types: | 27 // process-types: |
26 // Is the sandbox globally enabled, can anything use it at all ? | 28 // Is the sandbox globally enabled, can anything use it at all ? |
27 // This looks at global command line flags to see if the sandbox | 29 // This looks at global command line flags to see if the sandbox |
28 // should be enabled at all. | 30 // should be enabled at all. |
29 static bool IsSeccompBPFDesired(); | 31 static bool IsSeccompBPFDesired(); |
30 // Should the sandbox be enabled for process_type ? | 32 // Should the sandbox be enabled for process_type ? |
31 static bool ShouldEnableSeccompBPF(const std::string& process_type); | 33 static bool ShouldEnableSeccompBPF(const std::string& process_type); |
32 // Check if the kernel supports this sandbox. It's useful to "prewarm" | 34 // Check if the kernel supports this sandbox. It's useful to "prewarm" |
33 // this, part of the result will be cached. | 35 // this, part of the result will be cached. |
34 static bool SupportsSandbox(); | 36 static bool SupportsSandbox(); |
35 // Start the sandbox and apply the policy for process_type, depending on | 37 // Start the sandbox and apply the policy for process_type, depending on |
36 // command line switches. | 38 // command line switches. |
37 static bool StartSandbox(const std::string& process_type); | 39 static bool StartSandbox(const std::string& process_type); |
38 | 40 |
39 // This is the API to enable a seccomp-bpf sandbox by using an | 41 // This is the API to enable a seccomp-bpf sandbox by using an |
40 // external policy. | 42 // external policy. |
41 static bool StartSandboxWithExternalPolicy( | 43 static bool StartSandboxWithExternalPolicy( |
42 scoped_ptr<sandbox::SandboxBPFPolicy> policy); | 44 scoped_ptr<sandbox::bpf_dsl::SandboxBPFDSLPolicy> policy); |
43 // The "baseline" policy can be a useful base to build a sandbox policy. | 45 // The "baseline" policy can be a useful base to build a sandbox policy. |
44 static scoped_ptr<sandbox::SandboxBPFPolicy> GetBaselinePolicy(); | 46 static scoped_ptr<sandbox::bpf_dsl::SandboxBPFDSLPolicy> GetBaselinePolicy(); |
45 | 47 |
46 private: | 48 private: |
47 DISALLOW_IMPLICIT_CONSTRUCTORS(SandboxSeccompBPF); | 49 DISALLOW_IMPLICIT_CONSTRUCTORS(SandboxSeccompBPF); |
48 }; | 50 }; |
49 | 51 |
50 } // namespace content | 52 } // namespace content |
51 | 53 |
52 #endif // CONTENT_COMMON_SANDBOX_LINUX_SANDBOX_SECCOMP_BPF_LINUX_H_ | 54 #endif // CONTENT_COMMON_SANDBOX_LINUX_SANDBOX_SECCOMP_BPF_LINUX_H_ |
53 | |
OLD | NEW |