OLD | NEW |
---|---|
(Empty) | |
1 // Copyright 2015 The Chromium Authors. All rights reserved. | |
2 // Use of this source code is governed by a BSD-style license that can be | |
3 // found in the LICENSE file. | |
4 | |
5 #ifndef SANDBOX_LINUX_SERVICES_NAMESPACE_SANDBOX_H_ | |
6 #define SANDBOX_LINUX_SERVICES_NAMESPACE_SANDBOX_H_ | |
7 | |
8 #include "base/command_line.h" | |
9 #include "base/macros.h" | |
10 #include "base/process/launch.h" | |
11 #include "base/process/process.h" | |
12 #include "sandbox/sandbox_export.h" | |
13 | |
14 namespace sandbox { | |
15 | |
16 // Helper class for starting a process inside a new user, PID, and network | |
17 // namespace. Before using a namespace sandbox, check for namespaces support | |
18 // using Credentials::CanCreateProcessInNewUserNS. | |
19 // | |
20 // A typical use for "A" launching a sandboxed process "B" would be: | |
21 // 1. A sets up a command line and launch options for process B. | |
22 // 2. A launches B with Launch. | |
23 // 3. B should be prepared to assume the role of init(1). In particular, apart | |
24 // from SIGKILL and SIGSTOP, B cannot receive any signal for which it does | |
25 // not have an explicit signal handler registered. | |
26 // If B dies, all the processes in the namespace will die. | |
27 // B can fork() and the parent can assume the role of init(1), by using | |
28 // CreateInitProcessReaper(). | |
29 // 4. B chroots using Credentials::MoveToNewUserNS() and | |
30 // Credentials::DropFileSystemAccess(). | |
jln (very slow on Chromium)
2015/02/03 01:27:46
Add the call to DropAllCapabilities() as well.
rickyz (no longer on Chrome)
2015/02/03 01:35:39
Done.
| |
31 class SANDBOX_EXPORT NamespaceSandbox { | |
32 public: | |
33 // Launch a new process inside its own user/PID/network namespaces (depending | |
34 // on kernel support). Requires at a minimum that user namespaces are | |
35 // supported (use Credentials::CanCreateProcessInNewUserNS to check this). | |
36 // | |
37 // pre_exec_delegate and clone_flags fields of LaunchOptions should be nullptr | |
38 // and 0, respectively, since this class overrides them. | |
39 static base::Process Launch(const base::CommandLine& cmdline, | |
40 const base::LaunchOptions& options); | |
jln (very slow on Chromium)
2015/02/03 01:27:46
Nit: indent.
Could also be worth renaming to Laun
rickyz (no longer on Chrome)
2015/02/03 01:35:39
Done.
| |
41 | |
42 // Returns whether the namespace sandbox created a new user, PID, and network | |
43 // namespace. In particular, InNewUserNamespace should return true iff the | |
44 // process was started via this class. | |
45 static bool InNewUserNamespace(); | |
46 static bool InNewPidNamespace(); | |
47 static bool InNewNetNamespace(); | |
48 | |
49 private: | |
50 DISALLOW_IMPLICIT_CONSTRUCTORS(NamespaceSandbox); | |
51 }; | |
52 | |
53 } // namespace sandbox | |
54 | |
55 #endif // SANDBOX_LINUX_SERVICES_NAMESPACE_SANDBOX_H_ | |
OLD | NEW |