OLD | NEW |
---|---|
(Empty) | |
1 // Copyright 2015 The Chromium Authors. All rights reserved. | |
2 // Use of this source code is governed by a BSD-style license that can be | |
3 // found in the LICENSE file. | |
4 | |
5 #ifndef SANDBOX_LINUX_SERVICES_NAMESPACE_SANDBOX_H_ | |
6 #define SANDBOX_LINUX_SERVICES_NAMESPACE_SANDBOX_H_ | |
7 | |
8 #include <sys/types.h> | |
9 | |
10 #include "base/command_line.h" | |
11 #include "base/files/scoped_file.h" | |
12 #include "base/macros.h" | |
13 #include "base/process/launch.h" | |
14 #include "base/process/process_handle.h" | |
15 #include "sandbox/sandbox_export.h" | |
16 | |
17 namespace sandbox { | |
18 | |
19 // Helper class for starting a process inside a new user, PID, and network | |
20 // namespace. Before using a namespace sandbox, check for namespaces support | |
21 // using Credentials::CanCreateProcessInNewUserNS. | |
22 // | |
23 // A typical use for "A" launching a sandboxed process "B" would be: | |
24 // 1. A sets up a command line for process B. | |
25 // 2. A sets up launch options for B using mutable_launch_options. | |
26 // 3. A launches B with Launch. | |
27 // 4. B should be prepared to assume the role of init(1). In particular, apart | |
28 // from SIGKILL and SIGSTOP, B cannot receive any signal for which it does | |
29 // not have an explicit signal handler registered. | |
30 // If B dies, all the processes in the namespace will die. | |
31 // B can fork() and the parent can assume the role of init(1), by using | |
32 // CreateInitProcessReaper(). | |
33 // 5. B chroots using Credentials::MoveToNewUserNS() and | |
34 // Credentials::DropFileSystemAccess(). | |
35 // | |
36 // An instance of this class may only be used once. | |
37 class SANDBOX_EXPORT NamespaceSandbox { | |
38 public: | |
39 NamespaceSandbox(); | |
40 ~NamespaceSandbox(); | |
41 | |
42 // Launch a new process inside its own user/PID/network namespaces (depending | |
43 // on kernel support). Requires at a minimum that user namespaces are | |
44 // supported (use Credentials::CanCreateProcessInNewUserNS to check this). | |
45 base::Process Launch(const base::CommandLine& cmdline); | |
46 | |
47 // Returns a pointer to the launch options for the sandboxed process. The | |
48 // pre_exec_delegate and clone_flags fields of LaunchOptions should not be | |
49 // modified. Any pointers added to launch_options must be valid at the time | |
50 // that Launch is called. | |
51 base::LaunchOptions* mutable_launch_options() { return &launch_options_; } | |
jln (very slow on Chromium)
2015/02/03 01:14:30
Get rid of that and take LaunchOptions as a Launch
rickyz (no longer on Chrome)
2015/02/03 01:27:22
Done.
| |
52 | |
53 // Returns whether the namespace sandbox created a new user, PID, and network | |
54 // namespace. In particular, InNewUserNamespace should return true iff the | |
55 // process was started via this class. | |
56 static bool InNewUserNamespace(); | |
57 static bool InNewPidNamespace(); | |
58 static bool InNewNetNamespace(); | |
59 | |
60 private: | |
61 // Writes an mappings for the process's uid/gid to /proc/|pid|/{uid,gid}_map, | |
62 // then unblocks the process by writing to |fd|. | |
63 void WriteUidGidMapAndUnblockProcess(pid_t pid, base::ScopedFD fd); | |
64 | |
65 // Whether Launch has been called. | |
66 bool launch_called_; | |
67 | |
68 // Launch options for the child process. | |
69 base::LaunchOptions launch_options_; | |
70 | |
71 DISALLOW_COPY_AND_ASSIGN(NamespaceSandbox); | |
72 }; | |
73 | |
74 } // namespace sandbox | |
75 | |
76 #endif // SANDBOX_LINUX_SERVICES_NAMESPACE_SANDBOX_H_ | |
OLD | NEW |