sandbox/mac/launchd_interception_server.h

   1 // Copyright 2014 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #ifndef SANDBOX_MAC_LAUNCHD_INTERCEPTION_SERVER_H_
   6 #define SANDBOX_MAC_LAUNCHD_INTERCEPTION_SERVER_H_
   7
   8 #include <dispatch/dispatch.h>
   9 #include <mach/mach.h>
  10
  11 #include "base/mac/scoped_mach_port.h"
  12 #include "base/mac/scoped_mach_vm.h"
  13 #include "sandbox/mac/os_compatibility.h"
  14
  15 namespace sandbox {
  16
  17 class BootstrapSandbox;
  18
  19 // This class is used to run a Mach IPC message server. This server can
  20 // hold the receive right for a bootstrap_port of a process, and it filters
  21 // a subset of the launchd/bootstrap IPC call set for sandboxing. It permits
  22 // or rejects requests based on the per-process policy specified in the
  23 // BootstrapSandbox.
  24 class LaunchdInterceptionServer {
  25  public:
  26   explicit LaunchdInterceptionServer(const BootstrapSandbox* sandbox);
  27   ~LaunchdInterceptionServer();
  28
  29   // Initializes the class and starts running the message server.
  30   bool Initialize();
  31
  32   mach_port_t server_port() const { return server_port_.get(); }
  33
  34  private:
  35   // Event handler for the |server_source_| that reads a message from the queue
  36   // and processes it.
  37   void ReceiveMessage();
  38
  39   // Decodes a message header and handles it by either servicing the request
  40   // itself, forwarding the message on to the real launchd, or rejecting the
  41   // message with an error.
  42   void DemuxMessage(mach_msg_header_t* request, mach_msg_header_t* reply);
  43
  44   // Given a look_up2 request message, this looks up the appropriate sandbox
  45   // policy for the service name then formulates and sends the reply message.
  46   void HandleLookUp(mach_msg_header_t* request,
  47                     mach_msg_header_t* reply,
  48                     pid_t sender_pid);
  49
  50   // Given a swap_integer request message, this verifies that it is safe, and
  51   // if so, forwards it on to launchd for servicing. If the request is unsafe,
  52   // it replies with an error.
  53   void HandleSwapInteger(mach_msg_header_t* request,
  54                          mach_msg_header_t* reply,
  55                          pid_t sender_pid);
  56
  57   // Sends a reply message. Returns true if the message was sent successfully.
  58   bool SendReply(mach_msg_header_t* reply);
  59
  60   // Forwards the original |request| on to real bootstrap server for handling.
  61   void ForwardMessage(mach_msg_header_t* request, mach_msg_header_t* reply);
  62
  63   // Replies to the message with the specified |error_code| as a MIG
  64   // error_reply RetCode.
  65   void RejectMessage(mach_msg_header_t* request,
  66                      mach_msg_header_t* reply,
  67                      int error_code);
  68
  69   // The sandbox for which this message server is running.
  70   const BootstrapSandbox* sandbox_;
  71
  72   // The Mach port on which the server is receiving requests.
  73   base::mac::ScopedMachReceiveRight server_port_;
  74
  75   // The dispatch queue used to service the server_source_.
  76   dispatch_queue_t server_queue_;
  77
  78   // A MACH_RECV dispatch source for the server_port_.
  79   dispatch_source_t server_source_;
  80
  81   // Request and reply buffers used in ReceiveMessage.
  82   base::mac::ScopedMachVM request_buffer_;
  83   base::mac::ScopedMachVM reply_buffer_;
  84
  85   // Whether or not ForwardMessage() was called during ReceiveMessage().
  86   bool did_forward_message_;
  87
  88   // The Mach port handed out in reply to denied look up requests. All denied
  89   // requests share the same port, though nothing reads messages from it.
  90   base::mac::ScopedMachReceiveRight sandbox_port_;
  91   // The send right for the above |sandbox_port_|, used with
  92   // MACH_MSG_TYPE_COPY_SEND when handing out references to the dummy port.
  93   base::mac::ScopedMachSendRight sandbox_send_port_;
  94
  95   // The compatibility shim that handles differences in message header IDs and
  96   // request/reply structures between different OS X versions.
  97   const LaunchdCompatibilityShim compat_shim_;
  98 };
  99
 100 }  // namespace sandbox
 101
 102 #endif  // SANDBOX_MAC_LAUNCHD_INTERCEPTION_SERVER_H_