app_container_base.h 3.9 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697
  1. // Copyright 2017 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #ifndef SANDBOX_WIN_SRC_APP_CONTAINER_BASE_H_
  5. #define SANDBOX_WIN_SRC_APP_CONTAINER_BASE_H_
  6. #include <memory>
  7. #include <vector>
  8. #include "base/files/file_path.h"
  9. #include "base/memory/ref_counted.h"
  10. #include "base/win/scoped_handle.h"
  11. #include "base/win/sid.h"
  12. #include "base/win/windows_types.h"
  13. #include "sandbox/win/src/app_container.h"
  14. #include "sandbox/win/src/sandbox_types.h"
  15. #include "third_party/abseil-cpp/absl/types/optional.h"
  16. namespace sandbox {
  17. class AppContainerBase final : public AppContainer {
  18. public:
  19. AppContainerBase(const AppContainerBase&) = delete;
  20. AppContainerBase& operator=(const AppContainerBase&) = delete;
  21. void AddRef() override;
  22. void Release() override;
  23. bool GetRegistryLocation(REGSAM desired_access,
  24. base::win::ScopedHandle* key) override;
  25. bool GetFolderPath(base::FilePath* file_path) override;
  26. bool GetPipePath(const wchar_t* pipe_name,
  27. base::FilePath* pipe_path) override;
  28. bool AccessCheck(const wchar_t* object_name,
  29. SecurityObjectType object_type,
  30. DWORD desired_access,
  31. DWORD* granted_access,
  32. BOOL* access_status) override;
  33. bool AddCapability(const wchar_t* capability_name) override;
  34. bool AddCapability(base::win::WellKnownCapability capability) override;
  35. bool AddCapabilitySddl(const wchar_t* sddl_sid) override;
  36. bool AddImpersonationCapability(const wchar_t* capability_name) override;
  37. bool AddImpersonationCapability(
  38. base::win::WellKnownCapability capability) override;
  39. bool AddImpersonationCapabilitySddl(const wchar_t* sddl_sid) override;
  40. void SetEnableLowPrivilegeAppContainer(bool enable) override;
  41. bool GetEnableLowPrivilegeAppContainer() override;
  42. AppContainerType GetAppContainerType() override;
  43. const std::vector<base::win::Sid>& GetCapabilities() override;
  44. const std::vector<base::win::Sid>& GetImpersonationCapabilities() override;
  45. std::unique_ptr<SecurityCapabilities> GetSecurityCapabilities() override;
  46. // Get the package SID for this AC.
  47. const base::win::Sid& GetPackageSid() const;
  48. // Creates a new AppContainer object. This will create a new profile
  49. // if it doesn't already exist. The profile must be deleted manually using
  50. // the Delete method if it's no longer required.
  51. static AppContainerBase* CreateProfile(const wchar_t* package_name,
  52. const wchar_t* display_name,
  53. const wchar_t* description);
  54. // Opens a derived AppContainer object. No checks will be made on
  55. // whether the package exists or not.
  56. static AppContainerBase* Open(const wchar_t* package_name);
  57. // Creates a new Lowbox object. Need to followup with a call to build lowbox
  58. // token
  59. static AppContainerBase* CreateLowbox(const wchar_t* sid);
  60. // Delete a profile based on name. Returns true if successful, or if the
  61. // package doesn't already exist.
  62. static bool Delete(const wchar_t* package_name);
  63. // Build the token for the lowbox
  64. ResultCode BuildLowBoxToken(base::win::ScopedHandle* token,
  65. base::win::ScopedHandle* lockdown = nullptr);
  66. private:
  67. AppContainerBase(base::win::Sid& package_sid, AppContainerType type);
  68. ~AppContainerBase();
  69. bool AddCapability(const absl::optional<base::win::Sid>& capability_sid,
  70. bool impersonation_only);
  71. // Standard object-lifetime reference counter.
  72. volatile LONG ref_count_;
  73. base::win::Sid package_sid_;
  74. bool enable_low_privilege_app_container_;
  75. std::vector<base::win::Sid> capabilities_;
  76. std::vector<base::win::Sid> impersonation_capabilities_;
  77. AppContainerType type_;
  78. };
  79. } // namespace sandbox
  80. #endif // SANDBOX_WIN_SRC_APP_CONTAINER_BASE_H_