| OLD | NEW |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #ifndef CONTENT_COMMON_SANDBOX_LINUX_SANDBOX_SECCOMP_BPF_LINUX_H_ | 5 #ifndef CONTENT_COMMON_SANDBOX_LINUX_SANDBOX_SECCOMP_BPF_LINUX_H_ |
| 6 #define CONTENT_COMMON_SANDBOX_LINUX_SANDBOX_SECCOMP_BPF_LINUX_H_ | 6 #define CONTENT_COMMON_SANDBOX_LINUX_SANDBOX_SECCOMP_BPF_LINUX_H_ |
| 7 | 7 |
| 8 #include <string> | 8 #include <string> |
| 9 | 9 |
| 10 #include "base/basictypes.h" | 10 #include "base/basictypes.h" |
| 11 #include "base/memory/scoped_ptr.h" | 11 #include "base/memory/scoped_ptr.h" |
| 12 | 12 |
| 13 namespace sandbox { | 13 namespace sandbox { |
| 14 class SandboxBPFPolicy; | 14 namespace bpf_dsl { |
| 15 class SandboxBPFDSLPolicy; |
| 16 } |
| 15 } | 17 } |
| 16 | 18 |
| 17 namespace content { | 19 namespace content { |
| 18 | 20 |
| 19 // This class has two main sets of APIs. One can be used to start the sandbox | 21 // This class has two main sets of APIs. One can be used to start the sandbox |
| 20 // for internal content process types, the other is indirectly exposed as | 22 // for internal content process types, the other is indirectly exposed as |
| 21 // a public content/ API and uses a supplied policy. | 23 // a public content/ API and uses a supplied policy. |
| 22 class SandboxSeccompBPF { | 24 class SandboxSeccompBPF { |
| 23 public: | 25 public: |
| 24 // This is the API to enable a seccomp-bpf sandbox for content/ | 26 // This is the API to enable a seccomp-bpf sandbox for content/ |
| 25 // process-types: | 27 // process-types: |
| 26 // Is the sandbox globally enabled, can anything use it at all ? | 28 // Is the sandbox globally enabled, can anything use it at all ? |
| 27 // This looks at global command line flags to see if the sandbox | 29 // This looks at global command line flags to see if the sandbox |
| 28 // should be enabled at all. | 30 // should be enabled at all. |
| 29 static bool IsSeccompBPFDesired(); | 31 static bool IsSeccompBPFDesired(); |
| 30 // Should the sandbox be enabled for process_type ? | 32 // Should the sandbox be enabled for process_type ? |
| 31 static bool ShouldEnableSeccompBPF(const std::string& process_type); | 33 static bool ShouldEnableSeccompBPF(const std::string& process_type); |
| 32 // Check if the kernel supports this sandbox. It's useful to "prewarm" | 34 // Check if the kernel supports this sandbox. It's useful to "prewarm" |
| 33 // this, part of the result will be cached. | 35 // this, part of the result will be cached. |
| 34 static bool SupportsSandbox(); | 36 static bool SupportsSandbox(); |
| 35 // Start the sandbox and apply the policy for process_type, depending on | 37 // Start the sandbox and apply the policy for process_type, depending on |
| 36 // command line switches. | 38 // command line switches. |
| 37 static bool StartSandbox(const std::string& process_type); | 39 static bool StartSandbox(const std::string& process_type); |
| 38 | 40 |
| 39 // This is the API to enable a seccomp-bpf sandbox by using an | 41 // This is the API to enable a seccomp-bpf sandbox by using an |
| 40 // external policy. | 42 // external policy. |
| 41 static bool StartSandboxWithExternalPolicy( | 43 static bool StartSandboxWithExternalPolicy( |
| 42 scoped_ptr<sandbox::SandboxBPFPolicy> policy); | 44 scoped_ptr<sandbox::bpf_dsl::SandboxBPFDSLPolicy> policy); |
| 43 // The "baseline" policy can be a useful base to build a sandbox policy. | 45 // The "baseline" policy can be a useful base to build a sandbox policy. |
| 44 static scoped_ptr<sandbox::SandboxBPFPolicy> GetBaselinePolicy(); | 46 static scoped_ptr<sandbox::bpf_dsl::SandboxBPFDSLPolicy> GetBaselinePolicy(); |
| 45 | 47 |
| 46 private: | 48 private: |
| 47 DISALLOW_IMPLICIT_CONSTRUCTORS(SandboxSeccompBPF); | 49 DISALLOW_IMPLICIT_CONSTRUCTORS(SandboxSeccompBPF); |
| 48 }; | 50 }; |
| 49 | 51 |
| 50 } // namespace content | 52 } // namespace content |
| 51 | 53 |
| 52 #endif // CONTENT_COMMON_SANDBOX_LINUX_SANDBOX_SECCOMP_BPF_LINUX_H_ | 54 #endif // CONTENT_COMMON_SANDBOX_LINUX_SANDBOX_SECCOMP_BPF_LINUX_H_ |
| 53 | |
| OLD | NEW |