Linux sandbox: refactor BrokerProcess class

sandbox/linux/syscall_broker/broker_policy.h

Index: sandbox/linux/syscall_broker/broker_policy.h
diff --git a/sandbox/linux/syscall_broker/broker_policy.h b/sandbox/linux/syscall_broker/broker_policy.h
new file mode 100644
index 0000000000000000000000000000000000000000..206aab0052220453d174e29f735a469fcce4c5d3
--- /dev/null
+++ b/sandbox/linux/syscall_broker/broker_policy.h
@@ -0,0 +1,59 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef SANDBOX_LINUX_SYSCALL_BROKER_BROKER_POLICY_H_
+#define SANDBOX_LINUX_SYSCALL_BROKER_BROKER_POLICY_H_
+
+#include <string>
+#include <vector>
+
+namespace sandbox {
+namespace syscall_broker {
+
+class BrokerPolicy {
+ public:
+  BrokerPolicy(int denied_errno,
+               const std::vector<std::string>& allowed_r_files,
+               const std::vector<std::string>& allowed_w_files_);
+  ~BrokerPolicy();
+
+  // Check if calling access() should be allowed on |requested_filename| with
+  // mode |requested_mode|.
+  // Note: access() being a system call to check permissions, this can get a bit
+  // confusing. We're checking if calling access() should even be allowed with
+  // the same policy we would use for open().
+  // If |file_to_access| is not NULL, we will return the matching pointer from
+  // the whitelist. For paranoia a caller should then use |file_to_access|. See
+  // GetFileNameIfAllowedToOpen() fore more explanation.

[leecam, 2014/10/31 21:06:25]

for

[jln (very slow on Chromium), 2014/10/31 21:43:19]

Done.

+  // return true if calling access() on this file should be allowed, false
+  // otherwise.
+  // Async signal safe if and only if |file_to_access| is NULL.
+  bool GetFileNameIfAllowedToAccess(const char* requested_filename,
+                                    int requested_mode,
+                                    const char** file_to_access) const;
+
+  // Check if |requested_filename| can be opened with flags |requested_flags|.
+  // If |file_to_open| is not NULL, we will return the matching pointer from the
+  // whitelist. For paranoia, a caller should then use |file_to_open| rather
+  // than |requested_filename|, so that it never attempts to open an
+  // attacker-controlled file name, even if an attacker managed to fool the
+  // string comparison mechanism.
+  // Return true if opening should be allowed, false otherwise.
+  // Async signal safe if and only if |file_to_open| is NULL.
+  bool GetFileNameIfAllowedToOpen(const char* requested_filename,
+                                  int requested_flags,
+                                  const char** file_to_open) const;
+  int denied_errno() const { return denied_errno_; }
+
+ private:
+  const int denied_errno_;
+  const std::vector<std::string> allowed_r_files_;
+  const std::vector<std::string> allowed_w_files_;
+};
+
+}  // namespace syscall_broker
+
+}  // namespace sandbox
+
+#endif  // SANDBOX_LINUX_SYSCALL_BROKER_BROKER_POLICY_H_