OLD | NEW |
---|---|
1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #ifndef SANDBOX_LINUX_SERVICES_CREDENTIALS_H_ | 5 #ifndef SANDBOX_LINUX_SERVICES_CREDENTIALS_H_ |
6 #define SANDBOX_LINUX_SERVICES_CREDENTIALS_H_ | 6 #define SANDBOX_LINUX_SERVICES_CREDENTIALS_H_ |
7 | 7 |
8 #include "build/build_config.h" | 8 #include "build/build_config.h" |
9 // Link errors are tedious to track, raise a compile-time error instead. | 9 // Link errors are tedious to track, raise a compile-time error instead. |
10 #if defined(OS_ANDROID) | 10 #if defined(OS_ANDROID) |
11 #error "Android is not supported." | 11 #error "Android is not supported." |
12 #endif // defined(OS_ANDROID). | 12 #endif // defined(OS_ANDROID). |
13 | 13 |
14 #include <string> | 14 #include <string> |
15 | 15 |
16 #include "base/basictypes.h" | 16 #include "base/basictypes.h" |
17 #include "base/compiler_specific.h" | |
17 #include "base/memory/scoped_ptr.h" | 18 #include "base/memory/scoped_ptr.h" |
18 #include "sandbox/sandbox_export.h" | 19 #include "sandbox/sandbox_export.h" |
19 | 20 |
20 namespace sandbox { | 21 namespace sandbox { |
21 | 22 |
22 // This class should be used to manipulate the current process' credentials. | 23 // This class should be used to manipulate the current process' credentials. |
23 // It is currently a stub used to manipulate POSIX.1e capabilities as | 24 // It is currently a stub used to manipulate POSIX.1e capabilities as |
24 // implemented by the Linux kernel. | 25 // implemented by the Linux kernel. |
25 class SANDBOX_EXPORT Credentials { | 26 class SANDBOX_EXPORT Credentials { |
26 public: | 27 public: |
27 Credentials(); | 28 Credentials(); |
28 ~Credentials(); | 29 ~Credentials(); |
29 | 30 |
30 // Drop all capabilities in the effective, inheritable and permitted sets for | 31 // Drop all capabilities in the effective, inheritable and permitted sets for |
31 // the current process. | 32 // the current process. |
32 bool DropAllCapabilities(); | 33 bool DropAllCapabilities() WARN_UNUSED_RESULT; |
33 // Return true iff there is any capability in any of the capabilities sets | 34 // Return true iff there is any capability in any of the capabilities sets |
34 // of the current process. | 35 // of the current process. |
35 bool HasAnyCapability() const; | 36 bool HasAnyCapability() const; |
36 // Returns the capabilities of the current process in textual form, as | 37 // Returns the capabilities of the current process in textual form, as |
37 // documented in libcap2's cap_to_text(3). This is mostly useful for | 38 // documented in libcap2's cap_to_text(3). This is mostly useful for |
38 // debugging and tests. | 39 // debugging and tests. |
39 scoped_ptr<std::string> GetCurrentCapString() const; | 40 scoped_ptr<std::string> GetCurrentCapString() const; |
40 | 41 |
41 // Returns whether the kernel supports CLONE_NEWUSER and whether it would be | 42 // Returns whether the kernel supports CLONE_NEWUSER and whether it would be |
42 // possible to immediately move to a new user namespace. There is no point | 43 // possible to immediately move to a new user namespace. There is no point |
43 // in using this method right before calling MoveToNewUserNS(), simply call | 44 // in using this method right before calling MoveToNewUserNS(), simply call |
44 // MoveToNewUserNS() immediately. This method is only useful to test kernel | 45 // MoveToNewUserNS() immediately. This method is only useful to test kernel |
45 // support ahead of time. | 46 // support ahead of time. |
46 static bool SupportsNewUserNS(); | 47 static bool SupportsNewUserNS(); |
47 | 48 |
48 // Move the current process to a new "user namespace" as supported by Linux | 49 // Move the current process to a new "user namespace" as supported by Linux |
49 // 3.8+ (CLONE_NEWUSER). | 50 // 3.8+ (CLONE_NEWUSER). |
50 // The uid map will be set-up so that the perceived uid and gid will not | 51 // The uid map will be set-up so that the perceived uid and gid will not |
51 // change. | 52 // change. |
52 // If this call succeeds, the current process will be granted a full set of | 53 // If this call succeeds, the current process will be granted a full set of |
53 // capabilities in the new namespace. | 54 // capabilities in the new namespace. |
54 bool MoveToNewUserNS(); | 55 bool MoveToNewUserNS() WARN_UNUSED_RESULT; |
55 | 56 |
56 // Remove the ability of the process to access the file system. File | 57 // Remove the ability of the process to access the file system. File |
57 // descriptors which are already open prior to calling this API remain | 58 // descriptors which are already open prior to calling this API remain |
58 // available. | 59 // available. |
59 // The implementation currently uses chroot(2) and requires CAP_SYS_CHROOT. | 60 // The implementation currently uses chroot(2) and requires CAP_SYS_CHROOT. |
60 // CAP_SYS_CHROOT can be acquired by using the MoveToNewUserNS() API. | 61 // CAP_SYS_CHROOT can be acquired by using the MoveToNewUserNS() API. |
61 // Make sure to call DropAllCapabilities() after this call to prevent | 62 // Make sure to call DropAllCapabilities() after this call to prevent |
62 // escapes. | 63 // escapes. |
63 // To be secure, it's very important for this API to not be called while the | 64 // To be secure, the caller must ensure that any directory file descriptors |
64 // process has any directory file descriptor open. | 65 // are closed. Otherwise it may be possible to escape the chroot. |
65 bool DropFileSystemAccess(); | 66 bool DropFileSystemAccess() WARN_UNUSED_RESULT; |
jln (very slow on Chromium)
2015/01/05 23:02:32
Could you point to ProcUtil::HasOpenDirectory() as
rickyz (no longer on Chrome)
2015/01/06 08:01:20
Done.
| |
66 | 67 |
67 private: | 68 private: |
68 DISALLOW_COPY_AND_ASSIGN(Credentials); | 69 DISALLOW_COPY_AND_ASSIGN(Credentials); |
69 }; | 70 }; |
70 | 71 |
71 } // namespace sandbox. | 72 } // namespace sandbox. |
72 | 73 |
73 #endif // SANDBOX_LINUX_SERVICES_CREDENTIALS_H_ | 74 #endif // SANDBOX_LINUX_SERVICES_CREDENTIALS_H_ |
OLD | NEW |