| OLD | NEW |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #ifndef CONTENT_COMMON_SANDBOX_LINUX_SANDBOX_SECCOMP_BPF_LINUX_H_ | 5 #ifndef CONTENT_COMMON_SANDBOX_LINUX_SANDBOX_SECCOMP_BPF_LINUX_H_ |
| 6 #define CONTENT_COMMON_SANDBOX_LINUX_SANDBOX_SECCOMP_BPF_LINUX_H_ | 6 #define CONTENT_COMMON_SANDBOX_LINUX_SANDBOX_SECCOMP_BPF_LINUX_H_ |
| 7 | 7 |
| 8 #include <string> | 8 #include <string> |
| 9 | 9 |
| 10 #include "base/basictypes.h" | 10 #include "base/basictypes.h" |
| (...skipping 16 matching lines...) Expand all Loading... |
| 27 static bool IsSeccompBPFDesired(); | 27 static bool IsSeccompBPFDesired(); |
| 28 // Should the sandbox be enabled for process_type ? | 28 // Should the sandbox be enabled for process_type ? |
| 29 static bool ShouldEnableSeccompBPF(const std::string& process_type); | 29 static bool ShouldEnableSeccompBPF(const std::string& process_type); |
| 30 // Check if the kernel supports seccomp-bpf. | 30 // Check if the kernel supports seccomp-bpf. |
| 31 static bool SupportsSandbox(); | 31 static bool SupportsSandbox(); |
| 32 // Check if the kernel supports TSYNC (thread synchronization) with seccomp. | 32 // Check if the kernel supports TSYNC (thread synchronization) with seccomp. |
| 33 static bool SupportsSandboxWithTsync(); | 33 static bool SupportsSandboxWithTsync(); |
| 34 // Start the sandbox and apply the policy for process_type, depending on | 34 // Start the sandbox and apply the policy for process_type, depending on |
| 35 // command line switches. | 35 // command line switches. |
| 36 static bool StartSandbox(const std::string& process_type, | 36 static bool StartSandbox(const std::string& process_type, |
| 37 base::ScopedFD proc_task_fd); | 37 base::ScopedFD proc_fd); |
| 38 | 38 |
| 39 // This is the API to enable a seccomp-bpf sandbox by using an | 39 // This is the API to enable a seccomp-bpf sandbox by using an |
| 40 // external policy. | 40 // external policy. |
| 41 static bool StartSandboxWithExternalPolicy( | 41 static bool StartSandboxWithExternalPolicy( |
| 42 scoped_ptr<sandbox::bpf_dsl::Policy> policy, | 42 scoped_ptr<sandbox::bpf_dsl::Policy> policy, |
| 43 base::ScopedFD proc_task_fd); | 43 base::ScopedFD proc_fd); |
| 44 // The "baseline" policy can be a useful base to build a sandbox policy. | 44 // The "baseline" policy can be a useful base to build a sandbox policy. |
| 45 static scoped_ptr<sandbox::bpf_dsl::Policy> GetBaselinePolicy(); | 45 static scoped_ptr<sandbox::bpf_dsl::Policy> GetBaselinePolicy(); |
| 46 | 46 |
| 47 private: | 47 private: |
| 48 DISALLOW_IMPLICIT_CONSTRUCTORS(SandboxSeccompBPF); | 48 DISALLOW_IMPLICIT_CONSTRUCTORS(SandboxSeccompBPF); |
| 49 }; | 49 }; |
| 50 | 50 |
| 51 } // namespace content | 51 } // namespace content |
| 52 | 52 |
| 53 #endif // CONTENT_COMMON_SANDBOX_LINUX_SANDBOX_SECCOMP_BPF_LINUX_H_ | 53 #endif // CONTENT_COMMON_SANDBOX_LINUX_SANDBOX_SECCOMP_BPF_LINUX_H_ |
| OLD | NEW |