OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #ifndef CONTENT_COMMON_SANDBOX_SECCOMP_BPF_LINUX_H_ | 5 #ifndef CONTENT_COMMON_SANDBOX_SECCOMP_BPF_LINUX_H_ |
6 #define CONTENT_COMMON_SANDBOX_SECCOMP_BPF_LINUX_H_ | 6 #define CONTENT_COMMON_SANDBOX_SECCOMP_BPF_LINUX_H_ |
7 | 7 |
8 #include <string> | 8 #include <string> |
9 | 9 |
10 #include "base/basictypes.h" | 10 #include "base/basictypes.h" |
11 #include "base/memory/scoped_ptr.h" | 11 #include "base/memory/scoped_ptr.h" |
12 | 12 |
13 namespace playground2 { | 13 namespace sandbox { |
14 class SandboxBpfPolicy; | 14 class SandboxBPFPolicy; |
15 } | 15 } |
16 | 16 |
17 namespace content { | 17 namespace content { |
18 | 18 |
19 // This class has two main sets of APIs. One can be used to start the sandbox | 19 // This class has two main sets of APIs. One can be used to start the sandbox |
20 // for internal content process types, the other is indirectly exposed as | 20 // for internal content process types, the other is indirectly exposed as |
21 // a public content/ API and uses a supplied policy. | 21 // a public content/ API and uses a supplied policy. |
22 class SandboxSeccompBpf { | 22 class SandboxSeccompBPF { |
23 public: | 23 public: |
24 // This is the API to enable a seccomp-bpf sandbox for content/ | 24 // This is the API to enable a seccomp-bpf sandbox for content/ |
25 // process-types: | 25 // process-types: |
26 // Is the sandbox globally enabled, can anything use it at all ? | 26 // Is the sandbox globally enabled, can anything use it at all ? |
27 // This looks at global command line flags to see if the sandbox | 27 // This looks at global command line flags to see if the sandbox |
28 // should be enabled at all. | 28 // should be enabled at all. |
29 static bool IsSeccompBpfDesired(); | 29 static bool IsSeccompBPFDesired(); |
30 // Should the sandbox be enabled for process_type ? | 30 // Should the sandbox be enabled for process_type ? |
31 static bool ShouldEnableSeccompBpf(const std::string& process_type); | 31 static bool ShouldEnableSeccompBPF(const std::string& process_type); |
32 // Check if the kernel supports this sandbox. It's useful to "prewarm" | 32 // Check if the kernel supports this sandbox. It's useful to "prewarm" |
33 // this, part of the result will be cached. | 33 // this, part of the result will be cached. |
34 static bool SupportsSandbox(); | 34 static bool SupportsSandbox(); |
35 // Start the sandbox and apply the policy for process_type, depending on | 35 // Start the sandbox and apply the policy for process_type, depending on |
36 // command line switches. | 36 // command line switches. |
37 static bool StartSandbox(const std::string& process_type); | 37 static bool StartSandbox(const std::string& process_type); |
38 | 38 |
39 // This is the API to enable a seccomp-bpf sandbox by using an | 39 // This is the API to enable a seccomp-bpf sandbox by using an |
40 // external policy. | 40 // external policy. |
41 static bool StartSandboxWithExternalPolicy( | 41 static bool StartSandboxWithExternalPolicy( |
42 scoped_ptr<playground2::SandboxBpfPolicy> policy); | 42 scoped_ptr<sandbox::SandboxBPFPolicy> policy); |
43 // The "baseline" policy can be a useful base to build a sandbox policy. | 43 // The "baseline" policy can be a useful base to build a sandbox policy. |
44 static scoped_ptr<playground2::SandboxBpfPolicy> GetBaselinePolicy(); | 44 static scoped_ptr<sandbox::SandboxBPFPolicy> GetBaselinePolicy(); |
45 | 45 |
46 private: | 46 private: |
47 DISALLOW_IMPLICIT_CONSTRUCTORS(SandboxSeccompBpf); | 47 DISALLOW_IMPLICIT_CONSTRUCTORS(SandboxSeccompBPF); |
48 }; | 48 }; |
49 | 49 |
50 } // namespace content | 50 } // namespace content |
51 | 51 |
52 #endif // CONTENT_COMMON_SANDBOX_SECCOMP_BPF_LINUX_H_ | 52 #endif // CONTENT_COMMON_SANDBOX_SECCOMP_BPF_LINUX_H_ |
53 | 53 |
OLD | NEW |