seatbelt_exec.h 5.1 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134
  1. // Copyright 2017 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #ifndef SANDBOX_MAC_SEATBELT_EXEC_H_
  5. #define SANDBOX_MAC_SEATBELT_EXEC_H_
  6. #include <string>
  7. #include "sandbox/mac/seatbelt.pb.h"
  8. #include "sandbox/mac/seatbelt_export.h"
  9. namespace sandbox {
  10. namespace switches {
  11. // This switch is set by the process running the SeatbeltExecClient. It
  12. // specifies the FD number from which the SeatbeltExecServer should read the
  13. // sandbox profile and parameters. This is prefixed with "--" and ends with "="
  14. // for easier processing in C.
  15. SEATBELT_EXPORT extern const char kSeatbeltClient[];
  16. // This is the same as kSeatbeltClient without the prefix and suffix.
  17. SEATBELT_EXPORT extern const char kSeatbeltClientName[];
  18. } // namespace switches
  19. // SeatbeltExecClient is used by the process that is launching another sandboxed
  20. // process. The API allows the launcher process to supply a sandbox profile and
  21. // parameters, which will be communicated to the sandboxed process over IPC.
  22. class SEATBELT_EXPORT SeatbeltExecClient {
  23. public:
  24. SeatbeltExecClient();
  25. ~SeatbeltExecClient();
  26. // The Set*Parameter functions return true if the parameter was successfully
  27. // inserted. Check the return value, which indicates if the parameter was
  28. // added successfully.
  29. // Set a boolean parameter in the sandbox profile.
  30. [[nodiscard]] bool SetBooleanParameter(const std::string& key, bool value);
  31. // Set a string parameter in the sandbox profile.
  32. [[nodiscard]] bool SetParameter(const std::string& key,
  33. const std::string& value);
  34. // Set the actual sandbox profile, using the scheme-like SBPL.
  35. void SetProfile(const std::string& policy);
  36. // This returns the FD used for reading the sandbox profile in the child
  37. // process. The FD should be mapped into the sandboxed child process.
  38. // This must be called before SendProfile() or the returned FD will be -1.
  39. // Callers should check that the returned FD is valid.
  40. int GetReadFD();
  41. // Sends the policy to the SeatbeltExecServer and returns success or failure.
  42. bool SendProfile();
  43. // Returns the underlying protobuf for testing purposes.
  44. const mac::SandboxPolicy& GetPolicyForTesting() { return policy_; }
  45. private:
  46. // This writes a string (the serialized protobuf) to the |pipe_|.
  47. bool WriteString(const std::string& str);
  48. // This is the protobuf which contains the sandbox profile and parameters,
  49. // and is serialized and sent to the other process.
  50. mac::SandboxPolicy policy_;
  51. // A file descriptor pair used for interprocess communication.
  52. int pipe_[2];
  53. };
  54. // SeatbeltExecServer is used by the process that will be sandboxed to receive
  55. // the profile and parameters from the launcher process. It can then initialize
  56. // the profile, sandboxing the process.
  57. class SEATBELT_EXPORT SeatbeltExecServer {
  58. public:
  59. // Creates a server instance with |server_fd| being the pipe returned from
  60. // SeatbeltExecClient::GetReadFD(). To sandbox the process,
  61. // InitializeSandbox() must be called.
  62. explicit SeatbeltExecServer(int sandbox_fd);
  63. ~SeatbeltExecServer();
  64. // CreateFromArguments parses the command line arguments for the
  65. // kSeatbeltClient flag. If no flag is present, then |sandbox_required| is
  66. // false and |server| is nullptr. If the flag is present, then
  67. // |sandbox_required| is true. If the SeatbeltExecServer was successfully
  68. // created then |server| will be the result instance, upon which
  69. // InitializeSandbox() must be called. If initialization fails, then |server|
  70. // will be nullptr.
  71. struct CreateFromArgumentsResult {
  72. CreateFromArgumentsResult();
  73. CreateFromArgumentsResult(CreateFromArgumentsResult&&);
  74. ~CreateFromArgumentsResult();
  75. bool sandbox_required = false;
  76. std::unique_ptr<SeatbeltExecServer> server;
  77. };
  78. static CreateFromArgumentsResult CreateFromArguments(
  79. const char* executable_path,
  80. int argc,
  81. const char* const* argv);
  82. // Reads the policy from the client, applies the profile, and returns whether
  83. // or not the operation succeeds.
  84. bool InitializeSandbox();
  85. // Applies the given sandbox policy, and returns whether or not the operation
  86. // succeeds.
  87. bool ApplySandboxProfile(const mac::SandboxPolicy& sandbox_policy);
  88. // Set a string parameter in the sandbox profile. This is present in the
  89. // server because the process about to initialize a sandbox may need to add
  90. // some extra parameters, such as the path to the executable or the current
  91. // PID. This must be called before InitializeSandbox().
  92. [[nodiscard]] bool SetParameter(const std::string& key,
  93. const std::string& value);
  94. private:
  95. // Reads from the |fd_| and stores the data into a string. This does
  96. // not append a NUL terminator as protobuf does not expect one.
  97. bool ReadString(std::string* string);
  98. // The file descriptor used to communicate with the launcher process.
  99. int fd_;
  100. // Extra parameters added by the server process.
  101. std::map<std::string, std::string> extra_params_;
  102. };
  103. } // namespace sandbox
  104. #endif // SANDBOX_MAC_SEATBELT_EXEC_H_