Don't preload rarely seen large images
[chromium-blink-merge.git] / sandbox / linux / services / namespace_sandbox.h
blob977650e51f360d59c854723e5bfe72d6b2c898e5
1 // Copyright 2015 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
5 #ifndef SANDBOX_LINUX_SERVICES_NAMESPACE_SANDBOX_H_
6 #define SANDBOX_LINUX_SERVICES_NAMESPACE_SANDBOX_H_
8 #include <sys/types.h>
10 #include <string>
11 #include <vector>
13 #include "base/command_line.h"
14 #include "base/macros.h"
15 #include "base/process/launch.h"
16 #include "base/process/process.h"
17 #include "sandbox/sandbox_export.h"
19 namespace sandbox {
21 // Helper class for starting a process inside a new user, PID, and network
22 // namespace. Before using a namespace sandbox, check for namespaces support
23 // using Credentials::CanCreateProcessInNewUserNS.
25 // A typical use for "A" launching a sandboxed process "B" would be:
26 // 1. A sets up a command line and launch options for process B.
27 // 2. A launches B with LaunchProcess.
28 // 3. B should be prepared to assume the role of init(1). In particular, apart
29 // from SIGKILL and SIGSTOP, B cannot receive any signal for which it does
30 // not have an explicit signal handler registered.
31 // If B dies, all the processes in the namespace will die.
32 // B can fork() and the parent can assume the role of init(1), by using
33 // CreateInitProcessReaper().
34 // 4. B chroots using Credentials::MoveToNewUserNS() and
35 // Credentials::DropFileSystemAccess()
36 // 5. B drops capabilities gained by entering the new user namespace with
37 // Credentials::DropAllCapabilities().
38 class SANDBOX_EXPORT NamespaceSandbox {
39 public:
40 #if !defined(OS_NACL_NONSFI)
41 // Launch a new process inside its own user/PID/network namespaces (depending
42 // on kernel support). Requires at a minimum that user namespaces are
43 // supported (use Credentials::CanCreateProcessInNewUserNS to check this).
45 // pre_exec_delegate and clone_flags fields of LaunchOptions should be nullptr
46 // and 0, respectively, since this function makes a copy of options and
47 // overrides them.
48 static base::Process LaunchProcess(const base::CommandLine& cmdline,
49 const base::LaunchOptions& options);
50 static base::Process LaunchProcess(const std::vector<std::string>& argv,
51 const base::LaunchOptions& options);
52 #endif // !defined(OS_NACL_NONSFI)
54 // Forks a process in its own PID namespace. The child process is the init
55 // process inside of the PID namespace, so if the child needs to fork further,
56 // it should call CreateInitProcessReaper, which turns the init process into a
57 // reaper process.
59 // Otherwise, the child should setup handlers for signals which should
60 // terminate the process using InstallDefaultTerminationSignalHandlers or
61 // InstallTerminationSignalHandler. This works around the fact that init
62 // processes ignore such signals unless they have an explicit handler set.
64 // This function requries CAP_SYS_ADMIN. If |drop_capabilities_in_child| is
65 // true, then capabilities are dropped in the child.
66 static pid_t ForkInNewPidNamespace(bool drop_capabilities_in_child);
68 // Installs a signal handler for:
70 // SIGHUP, SIGINT, SIGABRT, SIGQUIT, SIGPIPE, SIGTERM, SIGUSR1, SIGUSR2
72 // that exits with SignalExitCode(sig). These are signals whose default action
73 // is to terminate the program (apart from SIGILL, SIGFPE, and SIGSEGV, which
74 // will still terminate the process if e.g. an illegal instruction is
75 // encountered, etc.).
77 // If any of these already had a signal handler installed, this function will
78 // not override them.
79 static void InstallDefaultTerminationSignalHandlers();
81 // Installs a signal handler for |sig| which exits with |exit_code|. If a
82 // signal handler was already present for |sig|, does nothing and returns
83 // false.
84 static bool InstallTerminationSignalHandler(int sig, int exit_code);
86 // Returns an exit code corresponding to the process being killed by sig. This
87 // is the same as exit code that NaCl's default signal handler uses.
88 static int SignalExitCode(int sig) { return -sig & 0xff; }
90 // Returns whether the namespace sandbox created a new user, PID, and network
91 // namespace. In particular, InNewUserNamespace should return true iff the
92 // process was started via this class.
93 static bool InNewUserNamespace();
94 static bool InNewPidNamespace();
95 static bool InNewNetNamespace();
97 private:
98 DISALLOW_IMPLICIT_CONSTRUCTORS(NamespaceSandbox);
101 } // namespace sandbox
103 #endif // SANDBOX_LINUX_SERVICES_NAMESPACE_SANDBOX_H_