// Copyright 2017 The Chromium Authors. All rights reserved. // Use of this source code is governed by a BSD-style license that can be // found in the LICENSE file. #include "sandbox/policy/features.h" #include "build/build_config.h" #include "build/chromeos_buildflags.h" #include "sandbox/features.h" namespace sandbox::policy::features { #if !BUILDFLAG(IS_MAC) && !BUILDFLAG(IS_FUCHSIA) // Enables network service sandbox. // (Only causes an effect when feature kNetworkService is enabled.) const base::Feature kNetworkServiceSandbox{"NetworkServiceSandbox", base::FEATURE_DISABLED_BY_DEFAULT}; #endif // !BUILDFLAG(IS_MAC) && !BUILDFLAG(IS_FUCHSIA) #if BUILDFLAG(IS_WIN) // Emergency "off switch" for new Windows KTM security mitigation, // sandbox::MITIGATION_KTM_COMPONENT. const base::Feature kWinSboxDisableKtmComponent{ "WinSboxDisableKtmComponent", base::FEATURE_ENABLED_BY_DEFAULT}; // Experiment for Windows sandbox security mitigation, // sandbox::MITIGATION_EXTENSION_POINT_DISABLE. const base::Feature kWinSboxDisableExtensionPoints{ "WinSboxDisableExtensionPoint", base::FEATURE_DISABLED_BY_DEFAULT}; // Enables GPU AppContainer sandbox on Windows. const base::Feature kGpuAppContainer{"GpuAppContainer", base::FEATURE_DISABLED_BY_DEFAULT}; // Enables GPU Low Privilege AppContainer when combined with kGpuAppContainer. const base::Feature kGpuLPAC{"GpuLPAC", base::FEATURE_ENABLED_BY_DEFAULT}; // Enables Renderer AppContainer const base::Feature kRendererAppContainer{"RendererAppContainer", base::FEATURE_DISABLED_BY_DEFAULT}; // Enables shared/fixed policy for Windows sandbox policies. const base::Feature kSharedSandboxPolicies{"SharedSandboxPolicies", base::FEATURE_DISABLED_BY_DEFAULT}; #endif // BUILDFLAG(IS_WIN) #if !BUILDFLAG(IS_ANDROID) // Controls whether the isolated XR service is sandboxed. const base::Feature kXRSandbox{"XRSandbox", base::FEATURE_ENABLED_BY_DEFAULT}; #endif // !BUILDFLAG(IS_ANDROID) #if BUILDFLAG(IS_CHROMEOS_ASH) // Controls whether the Spectre variant 2 mitigation is enabled. We use a USE // flag on some Chrome OS boards to disable the mitigation by disabling this // feature in exchange for system performance. const base::Feature kSpectreVariant2Mitigation{ "SpectreVariant2Mitigation", base::FEATURE_ENABLED_BY_DEFAULT}; // An override for the Spectre variant 2 default behavior. Security sensitive // users can enable this feature to ensure that the mitigation is always // enabled. const base::Feature kForceSpectreVariant2Mitigation{ "ForceSpectreVariant2Mitigation", base::FEATURE_DISABLED_BY_DEFAULT}; #endif // BUILDFLAG(IS_CHROMEOS_ASH) bool IsNetworkSandboxEnabled() { #if BUILDFLAG(IS_MAC) || BUILDFLAG(IS_FUCHSIA) return true; #else #if BUILDFLAG(IS_WIN) if (!sandbox::features::IsAppContainerSandboxSupported()) return false; #endif // BUILDFLAG(IS_WIN) // Check feature status. return base::FeatureList::IsEnabled(kNetworkServiceSandbox); #endif // BUILDFLAG(IS_MAC) || BUILDFLAG(IS_FUCHSIA) } } // namespace sandbox::policy::features