features.cc 3.1 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879
  1. // Copyright 2017 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #include "sandbox/policy/features.h"
  5. #include "build/build_config.h"
  6. #include "build/chromeos_buildflags.h"
  7. #include "sandbox/features.h"
  8. namespace sandbox::policy::features {
  9. #if !BUILDFLAG(IS_MAC) && !BUILDFLAG(IS_FUCHSIA)
  10. // Enables network service sandbox.
  11. // (Only causes an effect when feature kNetworkService is enabled.)
  12. const base::Feature kNetworkServiceSandbox{"NetworkServiceSandbox",
  13. base::FEATURE_DISABLED_BY_DEFAULT};
  14. #endif // !BUILDFLAG(IS_MAC) && !BUILDFLAG(IS_FUCHSIA)
  15. #if BUILDFLAG(IS_WIN)
  16. // Emergency "off switch" for new Windows KTM security mitigation,
  17. // sandbox::MITIGATION_KTM_COMPONENT.
  18. const base::Feature kWinSboxDisableKtmComponent{
  19. "WinSboxDisableKtmComponent", base::FEATURE_ENABLED_BY_DEFAULT};
  20. // Experiment for Windows sandbox security mitigation,
  21. // sandbox::MITIGATION_EXTENSION_POINT_DISABLE.
  22. const base::Feature kWinSboxDisableExtensionPoints{
  23. "WinSboxDisableExtensionPoint", base::FEATURE_DISABLED_BY_DEFAULT};
  24. // Enables GPU AppContainer sandbox on Windows.
  25. const base::Feature kGpuAppContainer{"GpuAppContainer",
  26. base::FEATURE_DISABLED_BY_DEFAULT};
  27. // Enables GPU Low Privilege AppContainer when combined with kGpuAppContainer.
  28. const base::Feature kGpuLPAC{"GpuLPAC", base::FEATURE_ENABLED_BY_DEFAULT};
  29. // Enables Renderer AppContainer
  30. const base::Feature kRendererAppContainer{"RendererAppContainer",
  31. base::FEATURE_DISABLED_BY_DEFAULT};
  32. // Enables shared/fixed policy for Windows sandbox policies.
  33. const base::Feature kSharedSandboxPolicies{"SharedSandboxPolicies",
  34. base::FEATURE_DISABLED_BY_DEFAULT};
  35. #endif // BUILDFLAG(IS_WIN)
  36. #if !BUILDFLAG(IS_ANDROID)
  37. // Controls whether the isolated XR service is sandboxed.
  38. const base::Feature kXRSandbox{"XRSandbox", base::FEATURE_ENABLED_BY_DEFAULT};
  39. #endif // !BUILDFLAG(IS_ANDROID)
  40. #if BUILDFLAG(IS_CHROMEOS_ASH)
  41. // Controls whether the Spectre variant 2 mitigation is enabled. We use a USE
  42. // flag on some Chrome OS boards to disable the mitigation by disabling this
  43. // feature in exchange for system performance.
  44. const base::Feature kSpectreVariant2Mitigation{
  45. "SpectreVariant2Mitigation", base::FEATURE_ENABLED_BY_DEFAULT};
  46. // An override for the Spectre variant 2 default behavior. Security sensitive
  47. // users can enable this feature to ensure that the mitigation is always
  48. // enabled.
  49. const base::Feature kForceSpectreVariant2Mitigation{
  50. "ForceSpectreVariant2Mitigation", base::FEATURE_DISABLED_BY_DEFAULT};
  51. #endif // BUILDFLAG(IS_CHROMEOS_ASH)
  52. bool IsNetworkSandboxEnabled() {
  53. #if BUILDFLAG(IS_MAC) || BUILDFLAG(IS_FUCHSIA)
  54. return true;
  55. #else
  56. #if BUILDFLAG(IS_WIN)
  57. if (!sandbox::features::IsAppContainerSandboxSupported())
  58. return false;
  59. #endif // BUILDFLAG(IS_WIN)
  60. // Check feature status.
  61. return base::FeatureList::IsEnabled(kNetworkServiceSandbox);
  62. #endif // BUILDFLAG(IS_MAC) || BUILDFLAG(IS_FUCHSIA)
  63. }
  64. } // namespace sandbox::policy::features