12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879 |
- // Copyright 2017 The Chromium Authors. All rights reserved.
- // Use of this source code is governed by a BSD-style license that can be
- // found in the LICENSE file.
- #include "sandbox/policy/features.h"
- #include "build/build_config.h"
- #include "build/chromeos_buildflags.h"
- #include "sandbox/features.h"
- namespace sandbox::policy::features {
- #if !BUILDFLAG(IS_MAC) && !BUILDFLAG(IS_FUCHSIA)
- // Enables network service sandbox.
- // (Only causes an effect when feature kNetworkService is enabled.)
- const base::Feature kNetworkServiceSandbox{"NetworkServiceSandbox",
- base::FEATURE_DISABLED_BY_DEFAULT};
- #endif // !BUILDFLAG(IS_MAC) && !BUILDFLAG(IS_FUCHSIA)
- #if BUILDFLAG(IS_WIN)
- // Emergency "off switch" for new Windows KTM security mitigation,
- // sandbox::MITIGATION_KTM_COMPONENT.
- const base::Feature kWinSboxDisableKtmComponent{
- "WinSboxDisableKtmComponent", base::FEATURE_ENABLED_BY_DEFAULT};
- // Experiment for Windows sandbox security mitigation,
- // sandbox::MITIGATION_EXTENSION_POINT_DISABLE.
- const base::Feature kWinSboxDisableExtensionPoints{
- "WinSboxDisableExtensionPoint", base::FEATURE_DISABLED_BY_DEFAULT};
- // Enables GPU AppContainer sandbox on Windows.
- const base::Feature kGpuAppContainer{"GpuAppContainer",
- base::FEATURE_DISABLED_BY_DEFAULT};
- // Enables GPU Low Privilege AppContainer when combined with kGpuAppContainer.
- const base::Feature kGpuLPAC{"GpuLPAC", base::FEATURE_ENABLED_BY_DEFAULT};
- // Enables Renderer AppContainer
- const base::Feature kRendererAppContainer{"RendererAppContainer",
- base::FEATURE_DISABLED_BY_DEFAULT};
- // Enables shared/fixed policy for Windows sandbox policies.
- const base::Feature kSharedSandboxPolicies{"SharedSandboxPolicies",
- base::FEATURE_DISABLED_BY_DEFAULT};
- #endif // BUILDFLAG(IS_WIN)
- #if !BUILDFLAG(IS_ANDROID)
- // Controls whether the isolated XR service is sandboxed.
- const base::Feature kXRSandbox{"XRSandbox", base::FEATURE_ENABLED_BY_DEFAULT};
- #endif // !BUILDFLAG(IS_ANDROID)
- #if BUILDFLAG(IS_CHROMEOS_ASH)
- // Controls whether the Spectre variant 2 mitigation is enabled. We use a USE
- // flag on some Chrome OS boards to disable the mitigation by disabling this
- // feature in exchange for system performance.
- const base::Feature kSpectreVariant2Mitigation{
- "SpectreVariant2Mitigation", base::FEATURE_ENABLED_BY_DEFAULT};
- // An override for the Spectre variant 2 default behavior. Security sensitive
- // users can enable this feature to ensure that the mitigation is always
- // enabled.
- const base::Feature kForceSpectreVariant2Mitigation{
- "ForceSpectreVariant2Mitigation", base::FEATURE_DISABLED_BY_DEFAULT};
- #endif // BUILDFLAG(IS_CHROMEOS_ASH)
- bool IsNetworkSandboxEnabled() {
- #if BUILDFLAG(IS_MAC) || BUILDFLAG(IS_FUCHSIA)
- return true;
- #else
- #if BUILDFLAG(IS_WIN)
- if (!sandbox::features::IsAppContainerSandboxSupported())
- return false;
- #endif // BUILDFLAG(IS_WIN)
- // Check feature status.
- return base::FeatureList::IsEnabled(kNetworkServiceSandbox);
- #endif // BUILDFLAG(IS_MAC) || BUILDFLAG(IS_FUCHSIA)
- }
- } // namespace sandbox::policy::features
|