// Copyright 2021 The Chromium Authors. All rights reserved. // Use of this source code is governed by a BSD-style license that can be // found in the LICENSE file. #ifndef COMPONENTS_EXO_SECURITY_DELEGATE_H_ #define COMPONENTS_EXO_SECURITY_DELEGATE_H_ #include #include namespace aura { class Window; } namespace exo { // Defines the set of actions/associations which are needed to implement a // per-product Exo server. Product here refrs to things like "Crostini", "ArcVM" // and "Lacross", and distinguishes from wayland's notion of a client. Each // product may have multiple clients associated with it. // // TODO(b/200896773): Flesh this class out once we're clear on what things // should be secure. class SecurityDelegate { public: // Get a SecurityDelegate instance with all of the defaults. static std::unique_ptr GetDefaultSecurityDelegate(); virtual ~SecurityDelegate(); // The path of the wayland server will be determined (partially) by its // security context. This process is documented in go/secure-exo-ids. All // sockets for the same security context will be placed in a single directory, // on ChromeOS that directory is "/run/wayland//". The intention is // that systems that need access to the wayland socket will mount their // security context's directory into their mount namespace, and not others'. // // The empty string refers to "no security context", only the default wayland // server may use it, and it is an error to spawn a non-default server without // a security context. virtual std::string GetSecurityContext() const = 0; // "Self-activation" is a security sensitive windowing operation that is a // common paradigm in X11. The need to self-activate is controlled // per-subsystem, i.e. a product like ARC++ knows that its windows should be // able to self activate, whereas Crostini knows they usually shouldn't. virtual bool CanSelfActivate(aura::Window* window) const; // Called when a client made pointer lock request, defined in // pointer-constraints-unstable-v1.xml extension protocol. True if the client // can lock the location of the pointer and disable movement, or return false // to reject the pointer lock request. virtual bool CanLockPointer(aura::Window* window) const; }; } // namespace exo #endif // COMPONENTS_EXO_SECURITY_DELEGATE_H_