content/common/sandbox_linux/sandbox_seccomp_bpf_linux.h

   1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #ifndef CONTENT_COMMON_SANDBOX_LINUX_SANDBOX_SECCOMP_BPF_LINUX_H_
   6 #define CONTENT_COMMON_SANDBOX_LINUX_SANDBOX_SECCOMP_BPF_LINUX_H_
   7
   8 #include <string>
   9
  10 #include "base/basictypes.h"
  11 #include "base/memory/scoped_ptr.h"
  12
  13 namespace sandbox {
  14 class SandboxBPFPolicy;
  15 }
  16
  17 namespace content {
  18
  19 // This class has two main sets of APIs. One can be used to start the sandbox
  20 // for internal content process types, the other is indirectly exposed as
  21 // a public content/ API and uses a supplied policy.
  22 class SandboxSeccompBPF {
  23  public:
  24   // This is the API to enable a seccomp-bpf sandbox for content/
  25   // process-types:
  26   // Is the sandbox globally enabled, can anything use it at all ?
  27   // This looks at global command line flags to see if the sandbox
  28   // should be enabled at all.
  29   static bool IsSeccompBPFDesired();
  30   // Should the sandbox be enabled for process_type ?
  31   static bool ShouldEnableSeccompBPF(const std::string& process_type);
  32   // Check if the kernel supports this sandbox. It's useful to "prewarm"
  33   // this, part of the result will be cached.
  34   static bool SupportsSandbox();
  35   // Start the sandbox and apply the policy for process_type, depending on
  36   // command line switches.
  37   static bool StartSandbox(const std::string& process_type);
  38
  39   // This is the API to enable a seccomp-bpf sandbox by using an
  40   // external policy.
  41   static bool StartSandboxWithExternalPolicy(
  42       scoped_ptr<sandbox::SandboxBPFPolicy> policy);
  43   // The "baseline" policy can be a useful base to build a sandbox policy.
  44   static scoped_ptr<sandbox::SandboxBPFPolicy> GetBaselinePolicy();
  45
  46  private:
  47   DISALLOW_IMPLICIT_CONSTRUCTORS(SandboxSeccompBPF);
  48 };
  49
  50 }  // namespace content
  51
  52 #endif  // CONTENT_COMMON_SANDBOX_LINUX_SANDBOX_SECCOMP_BPF_LINUX_H_
  53