security_delegate.h 2.3 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758
  1. // Copyright 2021 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #ifndef COMPONENTS_EXO_SECURITY_DELEGATE_H_
  5. #define COMPONENTS_EXO_SECURITY_DELEGATE_H_
  6. #include <memory>
  7. #include <string>
  8. namespace aura {
  9. class Window;
  10. }
  11. namespace exo {
  12. // Defines the set of actions/associations which are needed to implement a
  13. // per-product Exo server. Product here refrs to things like "Crostini", "ArcVM"
  14. // and "Lacross", and distinguishes from wayland's notion of a client. Each
  15. // product may have multiple clients associated with it.
  16. //
  17. // TODO(b/200896773): Flesh this class out once we're clear on what things
  18. // should be secure.
  19. class SecurityDelegate {
  20. public:
  21. // Get a SecurityDelegate instance with all of the defaults.
  22. static std::unique_ptr<SecurityDelegate> GetDefaultSecurityDelegate();
  23. virtual ~SecurityDelegate();
  24. // The path of the wayland server will be determined (partially) by its
  25. // security context. This process is documented in go/secure-exo-ids. All
  26. // sockets for the same security context will be placed in a single directory,
  27. // on ChromeOS that directory is "/run/wayland/<context>/". The intention is
  28. // that systems that need access to the wayland socket will mount their
  29. // security context's directory into their mount namespace, and not others'.
  30. //
  31. // The empty string refers to "no security context", only the default wayland
  32. // server may use it, and it is an error to spawn a non-default server without
  33. // a security context.
  34. virtual std::string GetSecurityContext() const = 0;
  35. // "Self-activation" is a security sensitive windowing operation that is a
  36. // common paradigm in X11. The need to self-activate is controlled
  37. // per-subsystem, i.e. a product like ARC++ knows that its windows should be
  38. // able to self activate, whereas Crostini knows they usually shouldn't.
  39. virtual bool CanSelfActivate(aura::Window* window) const;
  40. // Called when a client made pointer lock request, defined in
  41. // pointer-constraints-unstable-v1.xml extension protocol. True if the client
  42. // can lock the location of the pointer and disable movement, or return false
  43. // to reject the pointer lock request.
  44. virtual bool CanLockPointer(aura::Window* window) const;
  45. };
  46. } // namespace exo
  47. #endif // COMPONENTS_EXO_SECURITY_DELEGATE_H_