sandbox/mac/launchd_interception_server.h

   1 // Copyright 2014 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #ifndef SANDBOX_MAC_LAUNCHD_INTERCEPTION_SERVER_H_
   6 #define SANDBOX_MAC_LAUNCHD_INTERCEPTION_SERVER_H_
   7
   8 #include <dispatch/dispatch.h>
   9
  10 #include "base/mac/scoped_mach_port.h"
  11 #include "base/memory/scoped_ptr.h"
  12 #include "sandbox/mac/message_server.h"
  13
  14 namespace sandbox {
  15
  16 class BootstrapSandbox;
  17 struct BootstrapSandboxPolicy;
  18 class OSCompatibility;
  19
  20 // This class is used to run a Mach IPC message server. This server can
  21 // hold the receive right for a bootstrap_port of a process, and it filters
  22 // a subset of the launchd/bootstrap IPC call set for sandboxing. It permits
  23 // or rejects requests based on the per-process policy specified in the
  24 // BootstrapSandbox.
  25 class LaunchdInterceptionServer : public MessageDemuxer {
  26  public:
  27   explicit LaunchdInterceptionServer(const BootstrapSandbox* sandbox);
  28   ~LaunchdInterceptionServer() override;
  29
  30   // Initializes the class and starts running the message server. If the
  31   // |server_receive_right| is non-NULL, this class will take ownership of
  32   // the receive right and intercept messages sent to that port.
  33   bool Initialize(mach_port_t server_receive_right);
  34
  35   // MessageDemuxer:
  36   void DemuxMessage(IPCMessage request) override;
  37
  38   mach_port_t server_port() const { return message_server_->GetServerPort(); }
  39
  40  private:
  41   // Given a look_up2 request message, this looks up the appropriate sandbox
  42   // policy for the service name then formulates and sends the reply message.
  43   void HandleLookUp(IPCMessage request, const BootstrapSandboxPolicy* policy);
  44
  45   // Given a swap_integer request message, this verifies that it is safe, and
  46   // if so, forwards it on to launchd for servicing. If the request is unsafe,
  47   // it replies with an error.
  48   void HandleSwapInteger(IPCMessage request);
  49
  50   // Forwards the original |request| on to real bootstrap server for handling.
  51   void ForwardMessage(IPCMessage request);
  52
  53   // The sandbox for which this message server is running.
  54   const BootstrapSandbox* sandbox_;
  55
  56   // The Mach IPC server.
  57   scoped_ptr<MessageServer> message_server_;
  58
  59   // Whether or not the system is using an XPC-based launchd.
  60   bool xpc_launchd_;
  61
  62   // The Mach port handed out in reply to denied look up requests. All denied
  63   // requests share the same port, though nothing reads messages from it.
  64   base::mac::ScopedMachReceiveRight sandbox_port_;
  65   // The send right for the above |sandbox_port_|, used with
  66   // MACH_MSG_TYPE_COPY_SEND when handing out references to the dummy port.
  67   base::mac::ScopedMachSendRight sandbox_send_port_;
  68
  69   // The compatibility shim that handles differences in message header IDs and
  70   // request/reply structures between different OS X versions.
  71   scoped_ptr<OSCompatibility> compat_shim_;
  72 };
  73
  74 }  // namespace sandbox
  75
  76 #endif  // SANDBOX_MAC_LAUNCHD_INTERCEPTION_SERVER_H_