OLD | NEW |
1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #ifndef SANDBOX_LINUX_SERVICES_CREDENTIALS_H_ | 5 #ifndef SANDBOX_LINUX_SERVICES_CREDENTIALS_H_ |
6 #define SANDBOX_LINUX_SERVICES_CREDENTIALS_H_ | 6 #define SANDBOX_LINUX_SERVICES_CREDENTIALS_H_ |
7 | 7 |
8 #include "build/build_config.h" | 8 #include "build/build_config.h" |
9 // Link errors are tedious to track, raise a compile-time error instead. | 9 // Link errors are tedious to track, raise a compile-time error instead. |
10 #if defined(OS_ANDROID) | 10 #if defined(OS_ANDROID) |
(...skipping 31 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
42 // the caller. | 42 // the caller. |
43 static bool DropAllCapabilities(int proc_fd) WARN_UNUSED_RESULT; | 43 static bool DropAllCapabilities(int proc_fd) WARN_UNUSED_RESULT; |
44 // A similar API which assumes that it can open /proc/self/ by itself. | 44 // A similar API which assumes that it can open /proc/self/ by itself. |
45 static bool DropAllCapabilities() WARN_UNUSED_RESULT; | 45 static bool DropAllCapabilities() WARN_UNUSED_RESULT; |
46 // Sets the effective and permitted capability sets for the current thread to | 46 // Sets the effective and permitted capability sets for the current thread to |
47 // the list of capabiltiies in |caps|. All other capability flags are cleared. | 47 // the list of capabiltiies in |caps|. All other capability flags are cleared. |
48 static bool SetCapabilities(int proc_fd, | 48 static bool SetCapabilities(int proc_fd, |
49 const std::vector<LinuxCapability>& caps) | 49 const std::vector<LinuxCapability>& caps) |
50 WARN_UNUSED_RESULT; | 50 WARN_UNUSED_RESULT; |
51 | 51 |
| 52 // Versions of the above functions which do not check that the process is |
| 53 // single-threaded. After calling these functions, capabilities of other |
| 54 // threads will not be changed. |
| 55 static bool DropAllCapabilitiesOnCurrentThread() WARN_UNUSED_RESULT; |
| 56 static bool SetCapabilitiesOnCurrentThread( |
| 57 const std::vector<LinuxCapability>& caps) WARN_UNUSED_RESULT; |
| 58 |
52 // Returns true if the current thread has either the effective, permitted, or | 59 // Returns true if the current thread has either the effective, permitted, or |
53 // inheritable flag set for the given capability. | 60 // inheritable flag set for the given capability. |
54 static bool HasCapability(LinuxCapability cap); | 61 static bool HasCapability(LinuxCapability cap); |
55 | 62 |
56 // Return true iff there is any capability in any of the capabilities sets | 63 // Return true iff there is any capability in any of the capabilities sets |
57 // of the current thread. | 64 // of the current thread. |
58 static bool HasAnyCapability(); | 65 static bool HasAnyCapability(); |
59 | 66 |
60 // Returns whether the kernel supports CLONE_NEWUSER and whether it would be | 67 // Returns whether the kernel supports CLONE_NEWUSER and whether it would be |
61 // possible to immediately move to a new user namespace. There is no point | 68 // possible to immediately move to a new user namespace. There is no point |
(...skipping 25 matching lines...) Expand all Loading... |
87 // - DropAllCapabilities() must be called to prevent escapes. | 94 // - DropAllCapabilities() must be called to prevent escapes. |
88 static bool DropFileSystemAccess(int proc_fd) WARN_UNUSED_RESULT; | 95 static bool DropFileSystemAccess(int proc_fd) WARN_UNUSED_RESULT; |
89 | 96 |
90 private: | 97 private: |
91 DISALLOW_IMPLICIT_CONSTRUCTORS(Credentials); | 98 DISALLOW_IMPLICIT_CONSTRUCTORS(Credentials); |
92 }; | 99 }; |
93 | 100 |
94 } // namespace sandbox. | 101 } // namespace sandbox. |
95 | 102 |
96 #endif // SANDBOX_LINUX_SERVICES_CREDENTIALS_H_ | 103 #endif // SANDBOX_LINUX_SERVICES_CREDENTIALS_H_ |
OLD | NEW |