OLD | NEW |
1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #ifndef SANDBOX_LINUX_SERVICES_CREDENTIALS_H_ | 5 #ifndef SANDBOX_LINUX_SERVICES_CREDENTIALS_H_ |
6 #define SANDBOX_LINUX_SERVICES_CREDENTIALS_H_ | 6 #define SANDBOX_LINUX_SERVICES_CREDENTIALS_H_ |
7 | 7 |
8 #include "build/build_config.h" | 8 #include "build/build_config.h" |
9 // Link errors are tedious to track, raise a compile-time error instead. | 9 // Link errors are tedious to track, raise a compile-time error instead. |
10 #if defined(OS_ANDROID) | 10 #if defined(OS_ANDROID) |
11 #error "Android is not supported." | 11 #error "Android is not supported." |
12 #endif // defined(OS_ANDROID). | 12 #endif // defined(OS_ANDROID). |
13 | 13 |
14 #include <string> | 14 #include <string> |
15 | 15 |
16 #include "base/basictypes.h" | 16 #include "base/basictypes.h" |
17 #include "base/compiler_specific.h" | 17 #include "base/compiler_specific.h" |
18 #include "base/memory/scoped_ptr.h" | 18 #include "base/memory/scoped_ptr.h" |
19 #include "sandbox/sandbox_export.h" | 19 #include "sandbox/sandbox_export.h" |
20 | 20 |
21 namespace sandbox { | 21 namespace sandbox { |
22 | 22 |
23 // This class should be used to manipulate the current process' credentials. | 23 // This class should be used to manipulate the current process' credentials. |
24 // It is currently a stub used to manipulate POSIX.1e capabilities as | 24 // It is currently a stub used to manipulate POSIX.1e capabilities as |
25 // implemented by the Linux kernel. | 25 // implemented by the Linux kernel. |
26 class SANDBOX_EXPORT Credentials { | 26 class SANDBOX_EXPORT Credentials { |
27 public: | 27 public: |
28 // Drop all capabilities in the effective, inheritable and permitted sets for | 28 // Drop all capabilities in the effective, inheritable and permitted sets for |
29 // the current process. | 29 // the current process. For security reasons, since capabilities are |
| 30 // per-thread, the caller is responsible for ensuring it is single-threaded |
| 31 // when calling this API. |
30 static bool DropAllCapabilities() WARN_UNUSED_RESULT; | 32 static bool DropAllCapabilities() WARN_UNUSED_RESULT; |
31 // Return true iff there is any capability in any of the capabilities sets | 33 // Return true iff there is any capability in any of the capabilities sets |
32 // of the current process. | 34 // of the current process. |
33 static bool HasAnyCapability(); | 35 static bool HasAnyCapability(); |
34 // Returns the capabilities of the current process in textual form, as | 36 // Returns the capabilities of the current process in textual form, as |
35 // documented in libcap2's cap_to_text(3). This is mostly useful for | 37 // documented in libcap2's cap_to_text(3). This is mostly useful for |
36 // debugging and tests. | 38 // debugging and tests. |
37 static scoped_ptr<std::string> GetCurrentCapString(); | 39 static scoped_ptr<std::string> GetCurrentCapString(); |
38 | 40 |
39 // Returns whether the kernel supports CLONE_NEWUSER and whether it would be | 41 // Returns whether the kernel supports CLONE_NEWUSER and whether it would be |
(...skipping 24 matching lines...) Expand all Loading... |
64 // that file descriptor). Otherwise it may be possible to escape the chroot. | 66 // that file descriptor). Otherwise it may be possible to escape the chroot. |
65 static bool DropFileSystemAccess() WARN_UNUSED_RESULT; | 67 static bool DropFileSystemAccess() WARN_UNUSED_RESULT; |
66 | 68 |
67 private: | 69 private: |
68 DISALLOW_IMPLICIT_CONSTRUCTORS(Credentials); | 70 DISALLOW_IMPLICIT_CONSTRUCTORS(Credentials); |
69 }; | 71 }; |
70 | 72 |
71 } // namespace sandbox. | 73 } // namespace sandbox. |
72 | 74 |
73 #endif // SANDBOX_LINUX_SERVICES_CREDENTIALS_H_ | 75 #endif // SANDBOX_LINUX_SERVICES_CREDENTIALS_H_ |
OLD | NEW |