content/common/sandbox_linux/sandbox_seccomp_bpf_linux.h

   1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #ifndef CONTENT_COMMON_SANDBOX_LINUX_SANDBOX_SECCOMP_BPF_LINUX_H_
   6 #define CONTENT_COMMON_SANDBOX_LINUX_SANDBOX_SECCOMP_BPF_LINUX_H_
   7
   8 #include <string>
   9
  10 #include "base/basictypes.h"
  11 #include "base/files/scoped_file.h"
  12 #include "base/memory/scoped_ptr.h"
  13 #include "sandbox/linux/bpf_dsl/policy.h"
  14
  15 namespace content {
  16
  17 // This class has two main sets of APIs. One can be used to start the sandbox
  18 // for internal content process types, the other is indirectly exposed as
  19 // a public content/ API and uses a supplied policy.
  20 class SandboxSeccompBPF {
  21  public:
  22   // This is the API to enable a seccomp-bpf sandbox for content/
  23   // process-types:
  24   // Is the sandbox globally enabled, can anything use it at all ?
  25   // This looks at global command line flags to see if the sandbox
  26   // should be enabled at all.
  27   static bool IsSeccompBPFDesired();
  28   // Should the sandbox be enabled for process_type ?
  29   static bool ShouldEnableSeccompBPF(const std::string& process_type);
  30   // Check if the kernel supports seccomp-bpf.
  31   static bool SupportsSandbox();
  32   // Check if the kernel supports TSYNC (thread synchronization) with seccomp.
  33   static bool SupportsSandboxWithTsync();
  34   // Start the sandbox and apply the policy for process_type, depending on
  35   // command line switches.
  36   static bool StartSandbox(const std::string& process_type,
  37                            base::ScopedFD proc_fd);
  38
  39   // This is the API to enable a seccomp-bpf sandbox by using an
  40   // external policy.
  41   static bool StartSandboxWithExternalPolicy(
  42       scoped_ptr<sandbox::bpf_dsl::Policy> policy,
  43       base::ScopedFD proc_fd);
  44   // The "baseline" policy can be a useful base to build a sandbox policy.
  45   static scoped_ptr<sandbox::bpf_dsl::Policy> GetBaselinePolicy();
  46
  47  private:
  48   DISALLOW_IMPLICIT_CONSTRUCTORS(SandboxSeccompBPF);
  49 };
  50
  51 }  // namespace content
  52
  53 #endif  // CONTENT_COMMON_SANDBOX_LINUX_SANDBOX_SECCOMP_BPF_LINUX_H_