sandbox_delegate.h 2.2 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566
  1. // Copyright (c) 2017 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #ifndef SANDBOX_POLICY_SANDBOX_DELEGATE_H_
  5. #define SANDBOX_POLICY_SANDBOX_DELEGATE_H_
  6. #include <string>
  7. #include "base/process/process.h"
  8. #include "build/build_config.h"
  9. namespace sandbox {
  10. namespace mojom {
  11. enum class Sandbox;
  12. } // namespace mojom
  13. class TargetPolicy;
  14. namespace policy {
  15. class SandboxDelegate {
  16. public:
  17. virtual ~SandboxDelegate() {}
  18. // Returns the Sandbox to enforce on the process, or
  19. // Sandbox::kNoSandbox to run without a sandbox policy.
  20. virtual sandbox::mojom::Sandbox GetSandboxType() = 0;
  21. #if BUILDFLAG(IS_WIN)
  22. // Returns a tag for the sandbox. All targets with the same tag will share
  23. // their FixedPolicy configuration - the delegate can call
  24. // FixedPolicy::IsFixed() to skip setting this configuration after the first
  25. // such policy has been configured. Provide an empty string to force every
  26. // policy to be unique.
  27. virtual std::string GetSandboxTag() = 0;
  28. // Whether to disable the default policy specified in
  29. // AddPolicyForSandboxedProcess.
  30. virtual bool DisableDefaultPolicy() = 0;
  31. // Get the AppContainer ID for the sandbox. If this returns false then the
  32. // AppContainer will not be enabled for the process.
  33. virtual bool GetAppContainerId(std::string* appcontainer_id) = 0;
  34. // Called right before spawning the process. Returns false on failure.
  35. // Methods in FixedPolicy only need to be called if IsFixed() returns
  36. // false.
  37. virtual bool PreSpawnTarget(TargetPolicy* policy) = 0;
  38. // Called right after the process is launched, but before its thread is run.
  39. virtual void PostSpawnTarget(base::ProcessHandle process) = 0;
  40. // Whether this process should run inside a Job if running unsandboxed.
  41. virtual bool ShouldUnsandboxedRunInJob() = 0;
  42. // Whether this process will be compatible with Control-flow Enforcement
  43. // Technology (CET) / Hardware-enforced Stack Protection.
  44. virtual bool CetCompatible() = 0;
  45. #endif // BUILDFLAG(IS_WIN)
  46. };
  47. } // namespace policy
  48. } // namespace sandbox
  49. #endif // SANDBOX_POLICY_SANDBOX_DELEGATE_H_