OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #ifndef SANDBOX_LINUX_SERVICES_BROKER_PROCESS_H_ | 5 #ifndef SANDBOX_LINUX_SERVICES_BROKER_PROCESS_H_ |
6 #define SANDBOX_LINUX_SERVICES_BROKER_PROCESS_H_ | 6 #define SANDBOX_LINUX_SERVICES_BROKER_PROCESS_H_ |
7 | 7 |
8 #include <string> | 8 #include <string> |
9 #include <vector> | 9 #include <vector> |
10 | 10 |
11 #include "base/basictypes.h" | 11 #include "base/basictypes.h" |
12 #include "base/callback_forward.h" | 12 #include "base/callback_forward.h" |
13 #include "base/memory/scoped_ptr.h" | 13 #include "base/memory/scoped_ptr.h" |
14 #include "base/pickle.h" | 14 #include "base/pickle.h" |
15 #include "base/process/process.h" | 15 #include "base/process/process.h" |
16 #include "sandbox/linux/syscall_broker/broker_policy.h" | 16 #include "sandbox/linux/syscall_broker/broker_policy.h" |
17 #include "sandbox/sandbox_export.h" | 17 #include "sandbox/sandbox_export.h" |
18 | 18 |
19 namespace sandbox { | 19 namespace sandbox { |
20 | 20 |
21 namespace syscall_broker { | 21 namespace syscall_broker { |
| 22 |
22 class BrokerClient; | 23 class BrokerClient; |
23 } | |
24 | 24 |
25 // Create a new "broker" process to which we can send requests via an IPC | 25 // Create a new "broker" process to which we can send requests via an IPC |
26 // channel by forking the current process. | 26 // channel by forking the current process. |
27 // This is a low level IPC mechanism that is suitable to be called from a | 27 // This is a low level IPC mechanism that is suitable to be called from a |
28 // signal handler. | 28 // signal handler. |
29 // A process would typically create a broker process before entering | 29 // A process would typically create a broker process before entering |
30 // sandboxing. | 30 // sandboxing. |
31 // 1. BrokerProcess open_broker(read_whitelist, write_whitelist); | 31 // 1. BrokerProcess open_broker(read_whitelist, write_whitelist); |
32 // 2. CHECK(open_broker.Init(NULL)); | 32 // 2. CHECK(open_broker.Init(NULL)); |
33 // 3. Enable sandbox. | 33 // 3. Enable sandbox. |
(...skipping 27 matching lines...) Expand all Loading... |
61 int Access(const char* pathname, int mode) const; | 61 int Access(const char* pathname, int mode) const; |
62 // Can be used in place of open(). Will be async signal safe. | 62 // Can be used in place of open(). Will be async signal safe. |
63 // The implementation only supports certain white listed flags and will | 63 // The implementation only supports certain white listed flags and will |
64 // return -EPERM on other flags. | 64 // return -EPERM on other flags. |
65 // It's similar to the open() system call and will return -errno on errors. | 65 // It's similar to the open() system call and will return -errno on errors. |
66 int Open(const char* pathname, int flags) const; | 66 int Open(const char* pathname, int flags) const; |
67 | 67 |
68 int broker_pid() const { return broker_pid_; } | 68 int broker_pid() const { return broker_pid_; } |
69 | 69 |
70 private: | 70 private: |
| 71 friend class BrokerProcessTestHelper; |
| 72 |
| 73 // Close the IPC channel with the other party. This should only be used |
| 74 // by tests an none of the class methods should be used afterwards. |
| 75 void CloseChannel(); |
| 76 |
71 bool initialized_; // Whether we've been through Init() yet. | 77 bool initialized_; // Whether we've been through Init() yet. |
72 bool is_child_; // Whether we're the child (broker process). | 78 const bool fast_check_in_client_; |
73 bool fast_check_in_client_; | 79 const bool quiet_failures_for_tests_; |
74 bool quiet_failures_for_tests_; | |
75 pid_t broker_pid_; // The PID of the broker (child). | 80 pid_t broker_pid_; // The PID of the broker (child). |
76 syscall_broker::BrokerPolicy policy_; // The sandboxing policy. | 81 syscall_broker::BrokerPolicy policy_; // The sandboxing policy. |
77 scoped_ptr<syscall_broker::BrokerClient> | 82 scoped_ptr<syscall_broker::BrokerClient> broker_client_; |
78 broker_client_; // Can only exist if is_child_ is true. | |
79 | 83 |
80 int ipc_socketpair_; // Our communication channel to parent or child. | |
81 DISALLOW_COPY_AND_ASSIGN(BrokerProcess); | 84 DISALLOW_COPY_AND_ASSIGN(BrokerProcess); |
| 85 }; |
82 | 86 |
83 friend class BrokerProcessTestHelper; | 87 } // namespace syscall_broker |
84 }; | |
85 | 88 |
86 } // namespace sandbox | 89 } // namespace sandbox |
87 | 90 |
88 #endif // SANDBOX_LINUX_SERVICES_BROKER_PROCESS_H_ | 91 #endif // SANDBOX_LINUX_SERVICES_BROKER_PROCESS_H_ |
OLD | NEW |