OLD | NEW |
---|---|
(Empty) | |
1 // Copyright 2015 The Chromium Authors. All rights reserved. | |
2 // Use of this source code is governed by a BSD-style license that can be | |
3 // found in the LICENSE file. | |
4 | |
5 #ifndef SANDBOX_LINUX_SERVICES_NAMESPACE_SANDBOX_H_ | |
6 #define SANDBOX_LINUX_SERVICES_NAMESPACE_SANDBOX_H_ | |
7 | |
8 #include <sys/types.h> | |
9 | |
10 #include "base/command_line.h" | |
11 #include "base/files/scoped_file.h" | |
12 #include "base/process/launch.h" | |
13 #include "base/process/process_handle.h" | |
14 #include "sandbox/sandbox_export.h" | |
15 | |
16 namespace sandbox { | |
17 | |
18 // Helper class for starting a process inside a new user, PID, and network | |
19 // namespace. Before using a namespace sandbox, check for namespaces support | |
20 // using Credentials::CanCreateProcessInNewUserNS. | |
21 // | |
22 // A typical use for "A" launching a sandboxed process "B" would be: | |
23 // 1. A sets up a command line for process B. | |
24 // 2. A sets up launch options and fd mappings for B using AddFdMapping and | |
25 // mutable_launch_options. | |
26 // 3. A launches B with Launch. | |
27 // 4. B should be prepared to assume the role of init(1). In particular, apart | |
28 // from SIGKILL and SIGSTOP, B cannot receive any signal for which it does | |
29 // not have an explicit signal handler registered. | |
30 // If B dies, all the processes in the namespace will die. | |
31 // B can fork() and the parent can assume the role of init(1), by using | |
32 // CreateInitProcessReaper(). | |
33 // 5. B chroots using Credentials::MoveToNewUserNS() and | |
34 // Credentials::DropFileSystemAccess(). | |
35 // | |
36 // An instance of this class may only be used once. | |
37 class SANDBOX_EXPORT NamespaceSandbox { | |
38 public: | |
39 NamespaceSandbox(); | |
40 ~NamespaceSandbox(); | |
41 | |
42 // Launch a new process inside its own user/PID/network namespaces (depending | |
43 // on kernel support). Requires at a minimum that user namespaces are | |
44 // supported (use Credentials::CanCreateProcessInNewUserNS to check this). | |
45 base::Process Launch(const base::CommandLine& cmdline); | |
46 | |
47 // Adds an fd mapping in the new process. This should be used instead of | |
48 // modifying fds_to_remap in the launch options. | |
49 void AddFdMapping(int from_fd, int to_fd); | |
50 | |
51 // Returns a pointer to the launch options for the sandboxed process. The | |
52 // following fields of LaunchOptions should not be modified: | |
53 // pre_exec_delegate, fds_to_remap, clone_flags. Any pointers added to | |
54 // launch_options must be valid at the time that Launch is called. | |
55 base::LaunchOptions* mutable_launch_options() { return &launch_options_; } | |
jln (very slow on Chromium)
2015/01/30 20:12:28
I don't have a good memory of what the future call
rickyz (no longer on Chrome)
2015/01/31 02:33:54
I wasn't crazy about the patching up part, because
| |
56 | |
57 // Returns whether the namespace sandbox created a new user, PID, and network | |
58 // namespace. In particular, InNewUserNamespace should return true iff the | |
59 // process was started via this class. | |
60 static bool InNewUserNamespace(); | |
61 static bool InNewPidNamespace(); | |
62 static bool InNewNetNamespace(); | |
63 | |
64 private: | |
65 void WriteUidGidMapAndUnblockProcess(pid_t pid); | |
66 | |
67 // Whether Launch has been called. | |
68 bool launch_called_; | |
69 | |
70 // Pipe fds used to communicate with the child process. | |
71 base::ScopedFD read_fd_; | |
72 base::ScopedFD write_fd_; | |
73 | |
74 // FD mappings and launch options for the child process. | |
75 base::FileHandleMappingVector fds_to_remap_; | |
76 base::LaunchOptions launch_options_; | |
77 }; | |
jln (very slow on Chromium)
2015/01/30 20:12:28
DISABLE_COPY_AND_ASSIGN
rickyz (no longer on Chrome)
2015/01/31 02:33:54
Done.
| |
78 | |
79 } // namespace sandbox | |
80 | |
81 #endif // SANDBOX_LINUX_SERVICES_NAMESPACE_SANDBOX_H_ | |
OLD | NEW |