content/common/sandbox_init_mac.cc

   1 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "content/public/common/sandbox_init.h"
   6
   7 #include "base/command_line.h"
   8 #include "base/file_path.h"
   9 #include "base/logging.h"
  10 #include "content/common/sandbox_mac.h"
  11 #include "content/public/common/content_switches.h"
  12
  13 namespace content {
  14
  15 bool InitializeSandbox(int sandbox_type, const FilePath& allowed_dir) {
  16   // Warm up APIs before turning on the sandbox.
  17   Sandbox::SandboxWarmup(sandbox_type);
  18
  19   // Actually sandbox the process.
  20   return Sandbox::EnableSandbox(sandbox_type, allowed_dir);
  21 }
  22
  23 // Fill in |sandbox_type| and |allowed_dir| based on the command line,  returns
  24 // false if the current process type doesn't need to be sandboxed or if the
  25 // sandbox was disabled from the command line.
  26 bool GetSandboxTypeFromCommandLine(int* sandbox_type,
  27                                    FilePath* allowed_dir) {
  28   DCHECK(sandbox_type);
  29   DCHECK(allowed_dir);
  30
  31   *sandbox_type = -1;
  32   *allowed_dir = FilePath();  // Empty by default.
  33
  34   const CommandLine& command_line = *CommandLine::ForCurrentProcess();
  35   if (command_line.HasSwitch(switches::kNoSandbox))
  36     return false;
  37
  38   std::string process_type =
  39       command_line.GetSwitchValueASCII(switches::kProcessType);
  40   if (process_type.empty()) {
  41     // Browser process isn't sandboxed.
  42     return false;
  43   } else if (process_type == switches::kRendererProcess) {
  44     if (!command_line.HasSwitch(switches::kDisable3DAPIs) &&
  45         !command_line.HasSwitch(switches::kDisableExperimentalWebGL) &&
  46         command_line.HasSwitch(switches::kInProcessWebGL)) {
  47       // TODO(kbr): this check seems to be necessary only on this
  48       // platform because the sandbox is initialized later. Remove
  49       // this once this flag is removed.
  50       return false;
  51     } else {
  52       *sandbox_type = SANDBOX_TYPE_RENDERER;
  53     }
  54   } else if (process_type == switches::kUtilityProcess) {
  55     // Utility process sandbox.
  56     *sandbox_type = SANDBOX_TYPE_UTILITY;
  57     *allowed_dir =
  58         command_line.GetSwitchValuePath(switches::kUtilityProcessAllowedDir);
  59   } else if (process_type == switches::kWorkerProcess) {
  60     // Worker process sandbox.
  61     *sandbox_type = SANDBOX_TYPE_WORKER;
  62   } else if (process_type == switches::kGpuProcess) {
  63     *sandbox_type = SANDBOX_TYPE_GPU;
  64   } else if ((process_type == switches::kPluginProcess) ||
  65              (process_type == switches::kServiceProcess) ||
  66              (process_type == switches::kPpapiBrokerProcess)) {
  67     return false;
  68   } else if (process_type == switches::kPpapiPluginProcess) {
  69     *sandbox_type = SANDBOX_TYPE_PPAPI;
  70   } else {
  71     // Failsafe: If you hit an unreached here, is your new process type in need
  72     // of sandboxing?
  73     NOTREACHED() << "Unknown process type " << process_type;
  74     return false;
  75   }
  76   return true;
  77 }
  78
  79 bool InitializeSandbox() {
  80   int sandbox_type = 0;
  81   FilePath allowed_dir;
  82   if (!GetSandboxTypeFromCommandLine(&sandbox_type, &allowed_dir))
  83     return true;
  84   return InitializeSandbox(sandbox_type, allowed_dir);
  85 }
  86
  87 }  // namespace content