sandbox_mac.mm 3.6 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110
  1. // Copyright (c) 2012 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #include "sandbox/policy/mac/sandbox_mac.h"
  5. #include <fcntl.h>
  6. #include <sys/param.h>
  7. #include <string>
  8. #include "base/files/scoped_file.h"
  9. #include "base/logging.h"
  10. #include "base/posix/eintr_wrapper.h"
  11. #include "ppapi/buildflags/buildflags.h"
  12. #include "printing/buildflags/buildflags.h"
  13. #include "sandbox/policy/mac/audio.sb.h"
  14. #include "sandbox/policy/mac/cdm.sb.h"
  15. #include "sandbox/policy/mac/common.sb.h"
  16. #include "sandbox/policy/mac/gpu.sb.h"
  17. #include "sandbox/policy/mac/mirroring.sb.h"
  18. #include "sandbox/policy/mac/nacl_loader.sb.h"
  19. #include "sandbox/policy/mac/network.sb.h"
  20. #include "sandbox/policy/mac/ppapi.sb.h"
  21. #include "sandbox/policy/mac/print_backend.sb.h"
  22. #include "sandbox/policy/mac/print_compositor.sb.h"
  23. #include "sandbox/policy/mac/renderer.sb.h"
  24. #include "sandbox/policy/mac/screen_ai.sb.h"
  25. #include "sandbox/policy/mac/speech_recognition.sb.h"
  26. #include "sandbox/policy/mac/utility.sb.h"
  27. #include "sandbox/policy/mojom/sandbox.mojom.h"
  28. namespace sandbox {
  29. namespace policy {
  30. base::FilePath GetCanonicalPath(const base::FilePath& path) {
  31. base::ScopedFD fd(HANDLE_EINTR(open(path.value().c_str(), O_RDONLY)));
  32. if (!fd.is_valid()) {
  33. DPLOG(ERROR) << "GetCanonicalSandboxPath() failed for: " << path.value();
  34. return path;
  35. }
  36. base::FilePath::CharType canonical_path[MAXPATHLEN];
  37. if (HANDLE_EINTR(fcntl(fd.get(), F_GETPATH, canonical_path)) != 0) {
  38. DPLOG(ERROR) << "GetCanonicalSandboxPath() failed for: " << path.value();
  39. return path;
  40. }
  41. return base::FilePath(canonical_path);
  42. }
  43. std::string GetSandboxProfile(sandbox::mojom::Sandbox sandbox_type) {
  44. std::string profile = std::string(kSeatbeltPolicyString_common);
  45. switch (sandbox_type) {
  46. case sandbox::mojom::Sandbox::kAudio:
  47. profile += kSeatbeltPolicyString_audio;
  48. break;
  49. case sandbox::mojom::Sandbox::kCdm:
  50. profile += kSeatbeltPolicyString_cdm;
  51. break;
  52. case sandbox::mojom::Sandbox::kGpu:
  53. profile += kSeatbeltPolicyString_gpu;
  54. break;
  55. case sandbox::mojom::Sandbox::kMirroring:
  56. profile += kSeatbeltPolicyString_mirroring;
  57. break;
  58. case sandbox::mojom::Sandbox::kNaClLoader:
  59. profile += kSeatbeltPolicyString_nacl_loader;
  60. break;
  61. case sandbox::mojom::Sandbox::kNetwork:
  62. profile += kSeatbeltPolicyString_network;
  63. break;
  64. #if BUILDFLAG(ENABLE_PLUGINS)
  65. case sandbox::mojom::Sandbox::kPpapi:
  66. profile += kSeatbeltPolicyString_ppapi;
  67. break;
  68. #endif
  69. #if BUILDFLAG(ENABLE_PRINTING)
  70. case sandbox::mojom::Sandbox::kPrintBackend:
  71. profile += kSeatbeltPolicyString_print_backend;
  72. break;
  73. #endif
  74. case sandbox::mojom::Sandbox::kPrintCompositor:
  75. profile += kSeatbeltPolicyString_print_compositor;
  76. break;
  77. case sandbox::mojom::Sandbox::kScreenAI:
  78. profile += kSeatbeltPolicyString_screen_ai;
  79. break;
  80. case sandbox::mojom::Sandbox::kSpeechRecognition:
  81. profile += kSeatbeltPolicyString_speech_recognition;
  82. break;
  83. // kService and kUtility are the same on OS_MAC, so fallthrough.
  84. case sandbox::mojom::Sandbox::kService:
  85. case sandbox::mojom::Sandbox::kServiceWithJit:
  86. case sandbox::mojom::Sandbox::kUtility:
  87. profile += kSeatbeltPolicyString_utility;
  88. break;
  89. case sandbox::mojom::Sandbox::kRenderer:
  90. profile += kSeatbeltPolicyString_renderer;
  91. break;
  92. case sandbox::mojom::Sandbox::kNoSandbox:
  93. CHECK(false);
  94. break;
  95. }
  96. return profile;
  97. }
  98. } // namespace policy
  99. } // namespace sandbox