content/common/sandbox_init_win.cc

   1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "content/public/common/sandbox_init.h"
   6
   7 #include "base/command_line.h"
   8 #include "base/logging.h"
   9 #include "content/common/sandbox_policy.h"
  10 #include "content/public/common/content_switches.h"
  11 #include "sandbox/win/src/sandbox.h"
  12 #include "sandbox/win/src/sandbox_types.h"
  13
  14 namespace content {
  15
  16 bool InitializeSandbox(sandbox::SandboxInterfaceInfo* sandbox_info) {
  17   const CommandLine& command_line = *CommandLine::ForCurrentProcess();
  18   std::string process_type =
  19       command_line.GetSwitchValueASCII(switches::kProcessType);
  20   sandbox::BrokerServices* broker_services = sandbox_info->broker_services;
  21   if (broker_services && (process_type.empty() ||
  22                           process_type == switches::kNaClBrokerProcess ||
  23                           process_type == switches::kServiceProcess)) {
  24     if (!InitBrokerServices(broker_services))
  25       return false;
  26   }
  27
  28   if (process_type.empty() || process_type == switches::kNaClBrokerProcess) {
  29     // IMPORTANT: This piece of code needs to run as early as possible in the
  30     // process because it will initialize the sandbox broker, which requires the
  31     // process to swap its window station. During this time all the UI will be
  32     // broken. This has to run before threads and windows are created.
  33     if (broker_services) {
  34       if (!command_line.HasSwitch(switches::kNoSandbox)) {
  35         bool use_winsta = !command_line.HasSwitch(
  36             switches::kDisableAltWinstation);
  37         // Precreate the desktop and window station used by the renderers.
  38         sandbox::TargetPolicy* policy = broker_services->CreatePolicy();
  39         sandbox::ResultCode result = policy->CreateAlternateDesktop(use_winsta);
  40         CHECK(sandbox::SBOX_ERROR_FAILED_TO_SWITCH_BACK_WINSTATION != result);
  41         policy->Release();
  42       }
  43     }
  44     return true;
  45   }
  46
  47   if (command_line.HasSwitch(switches::kNoSandbox))
  48     return true;
  49
  50   sandbox::TargetServices* target_services = sandbox_info->target_services;
  51   if ((process_type == switches::kRendererProcess) ||
  52       (process_type == switches::kWorkerProcess) ||
  53       (process_type == switches::kNaClLoaderProcess) ||
  54       (process_type == switches::kUtilityProcess)) {
  55     // The above five process types must be sandboxed unless --no-sandbox
  56     // is present in the command line.
  57     if (!target_services)
  58       return false;
  59   } else {
  60     // Other process types might or might not be sandboxed.
  61     // TODO(cpu): clean this mess.
  62     if (!target_services)
  63       return true;
  64   }
  65   return InitTargetServices(target_services);
  66 }
  67
  68 }  // namespace content