sandbox: Extend BrokerPolicy to support file creation

sandbox/linux/syscall_broker/broker_file_permission.h

+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef SANDBOX_LINUX_SYSCALL_BROKER_BROKER_FILE_PERMISSION_H_
+#define SANDBOX_LINUX_SYSCALL_BROKER_BROKER_FILE_PERMISSION_H_
+
+#include <string>
+
+#include "base/macros.h"
+
+class Pickle;
+
+namespace sandbox {
+
+namespace syscall_broker {
+
+class BrokerFilePermission {
+ public:
+  ~BrokerFilePermission() {}
+  BrokerFilePermission(const BrokerFilePermission&) = default;
+  BrokerFilePermission& operator=(const BrokerFilePermission&) = default;
+
+  static BrokerFilePermission ReadOnly(std::string path) {
+    return BrokerFilePermission(path, false, false, true, false, false);
+  }
+
+  static BrokerFilePermission ReadOnlyRecursive(std::string path) {
+    return BrokerFilePermission(path, true, false, true, false, false);
+  }
+
+  static BrokerFilePermission WriteOnly(std::string path) {
+    return BrokerFilePermission(path, false, false, false, true, false);
+  }
+
+  static BrokerFilePermission ReadWrite(std::string path) {
+    return BrokerFilePermission(path, false, false, true, true, false);
+  }
+
+  static BrokerFilePermission ReadWriteCreate(std::string path) {
+    return BrokerFilePermission(path, false, false, true, true, true);
+  }
+
+  static BrokerFilePermission ReadWriteCreateUnlink(std::string path) {
+    return BrokerFilePermission(path, false, true, true, true, true);
+  }
+
+  static BrokerFilePermission ReadWriteCreateUnlinkRecursive(std::string path) {
+    return BrokerFilePermission(path, true, true, true, true, true);
+  }
+
+  // Construct a permission from a serilized pickle buffer.

[Jorge Lucangeli Obes, 2014/11/19 00:36:55]

"serialized"

More generally though, I don't think we need serialization right now, but if
you've already done it I guess we can include it in this CL.

[jln (very slow on Chromium), 2014/11/19 00:44:24]

Please, let's remove it from this CL. We should discuss this separately, but
when we need serialization, it has to be done with Chrome IPC, not a new, ad-hoc
IPC mechanism.

The current ad-hoc IPC mechanism should be limited to what we need it for: async
signal safe IPCs.

+  // Caller takes ownership of perm and must delete.
+  static bool CreateFromPickleBuf(const char* buf,
+                                  size_t len,
+                                  BrokerFilePermission** perm);
+
+  // Serialize class to a Pickle that can be used with
+  // UnixDomainSocket::SendRecvMsgWithFlags for IPC.
+  Pickle Serialize();
+
+  // Returns true if |requested_filename| is allowed to be open
+  // by this permission.
+  // If |file_to_open| is not NULL it is set to point to either
+  // the |requested_filename| in the case of a recursive match,
+  // or a pointer the matched path in the whitelist if an absolute
+  // match.
+  // Async signal safe if |file_to_open| is NULL
+  bool CheckOpen(const char* requested_filename,
+                 int flags,
+                 const char** file_to_open,
+                 bool* unlink_after_open) const;
+  // Returns true if |requested_filename| is allowed to be accessed
+  // by this permission.
+  // If |file_to_open| is not NULL it is set to point to either
+  // the |requested_filename| in the case of a recursive match,
+  // or a pointer the matched path in the whitelist if an absolute
+  // match.
+  // Async signal safe if |file_to_open| is NULL
+  bool CheckAccess(const char* requested_filename,
+                   int mode,
+                   const char** file_to_access) const;
+
+ private:
+  BrokerFilePermission(std::string path,
+                       bool recursive,
+                       bool unlink,
+                       bool allow_read,
+                       bool allow_write,
+                       bool allow_create);
+  bool IsPathCoveredByThisPermission(const char* requested_filename) const;
+
+  const std::string path_;
+  const bool
+      recursive_;  // Allow everything under this path. |path| must be a dir.
+  const bool unlink_;  // unlink after openning.
+  const bool allow_read_;
+  const bool allow_write_;
+  const bool allow_create_;
+};
+
+}  // namespace syscall_broker
+
+}  // namespace sandbox
+
+#endif  //  SANDBOX_LINUX_SYSCALL_BROKER_BROKER_FILE_PERMISSION_H_