Index: sandbox/linux/services/namespace_sandbox.h |
diff --git a/sandbox/linux/services/namespace_sandbox.h b/sandbox/linux/services/namespace_sandbox.h |
new file mode 100644 |
index 0000000000000000000000000000000000000000..19d0970b2c6dbf1eae9c65b7bc3172516a46e92b |
--- /dev/null |
+++ b/sandbox/linux/services/namespace_sandbox.h |
@@ -0,0 +1,81 @@ |
+// Copyright 2015 The Chromium Authors. All rights reserved. |
+// Use of this source code is governed by a BSD-style license that can be |
+// found in the LICENSE file. |
+ |
+#ifndef SANDBOX_LINUX_SERVICES_NAMESPACE_SANDBOX_H_ |
+#define SANDBOX_LINUX_SERVICES_NAMESPACE_SANDBOX_H_ |
+ |
+#include <sys/types.h> |
+ |
+#include "base/command_line.h" |
+#include "base/files/scoped_file.h" |
+#include "base/process/launch.h" |
+#include "base/process/process_handle.h" |
+#include "sandbox/sandbox_export.h" |
+ |
+namespace sandbox { |
+ |
+// Helper class for starting a process inside a new user, PID, and network |
+// namespace. Before using a namespace sandbox, check for namespaces support |
+// using Credentials::CanCreateProcessInNewUserNS. |
+// |
+// A typical use for "A" launching a sandboxed process "B" would be: |
+// 1. A sets up a command line for process B. |
+// 2. A sets up launch options and fd mappings for B using AddFdMapping and |
+// mutable_launch_options. |
+// 3. A launches B with Launch. |
+// 4. B should be prepared to assume the role of init(1). In particular, apart |
+// from SIGKILL and SIGSTOP, B cannot receive any signal for which it does |
+// not have an explicit signal handler registered. |
+// If B dies, all the processes in the namespace will die. |
+// B can fork() and the parent can assume the role of init(1), by using |
+// CreateInitProcessReaper(). |
+// 5. B chroots using Credentials::MoveToNewUserNS() and |
+// Credentials::DropFileSystemAccess(). |
+// |
+// An instance of this class may only be used once. |
+class SANDBOX_EXPORT NamespaceSandbox { |
+ public: |
+ NamespaceSandbox(); |
+ ~NamespaceSandbox(); |
+ |
+ // Launch a new process inside its own user/PID/network namespaces (depending |
+ // on kernel support). Requires at a minimum that user namespaces are |
+ // supported (use Credentials::CanCreateProcessInNewUserNS to check this). |
+ base::Process Launch(const base::CommandLine& cmdline); |
+ |
+ // Adds an fd mapping in the new process. This should be used instead of |
+ // modifying fds_to_remap in the launch options. |
+ void AddFdMapping(int from_fd, int to_fd); |
+ |
+ // Returns a pointer to the launch options for the sandboxed process. The |
+ // following fields of LaunchOptions should not be modified: |
+ // pre_exec_delegate, fds_to_remap, clone_flags. Any pointers added to |
+ // launch_options must be valid at the time that Launch is called. |
+ base::LaunchOptions* mutable_launch_options() { return &launch_options_; } |
jln (very slow on Chromium)
2015/01/30 20:12:28
I don't have a good memory of what the future call
rickyz (no longer on Chrome)
2015/01/31 02:33:54
I wasn't crazy about the patching up part, because
|
+ |
+ // Returns whether the namespace sandbox created a new user, PID, and network |
+ // namespace. In particular, InNewUserNamespace should return true iff the |
+ // process was started via this class. |
+ static bool InNewUserNamespace(); |
+ static bool InNewPidNamespace(); |
+ static bool InNewNetNamespace(); |
+ |
+ private: |
+ void WriteUidGidMapAndUnblockProcess(pid_t pid); |
+ |
+ // Whether Launch has been called. |
+ bool launch_called_; |
+ |
+ // Pipe fds used to communicate with the child process. |
+ base::ScopedFD read_fd_; |
+ base::ScopedFD write_fd_; |
+ |
+ // FD mappings and launch options for the child process. |
+ base::FileHandleMappingVector fds_to_remap_; |
+ base::LaunchOptions launch_options_; |
+}; |
jln (very slow on Chromium)
2015/01/30 20:12:28
DISABLE_COPY_AND_ASSIGN
rickyz (no longer on Chrome)
2015/01/31 02:33:54
Done.
|
+ |
+} // namespace sandbox |
+ |
+#endif // SANDBOX_LINUX_SERVICES_NAMESPACE_SANDBOX_H_ |