sandbox_policy_diagnostic.h 2.1 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263
  1. // Copyright 2019 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #ifndef SANDBOX_WIN_SRC_SANDBOX_POLICY_DIAGNOSTIC_H_
  5. #define SANDBOX_WIN_SRC_SANDBOX_POLICY_DIAGNOSTIC_H_
  6. #include <stddef.h>
  7. #include <memory>
  8. #include <string>
  9. #include <vector>
  10. #include "base/win/sid.h"
  11. #include "sandbox/win/src/app_container.h"
  12. #include "sandbox/win/src/handle_closer.h"
  13. #include "sandbox/win/src/policy_low_level.h"
  14. #include "sandbox/win/src/process_mitigations.h"
  15. #include "sandbox/win/src/sandbox.h"
  16. #include "sandbox/win/src/security_level.h"
  17. #include "third_party/abseil-cpp/absl/types/optional.h"
  18. namespace sandbox {
  19. class PolicyBase;
  20. // Intended to rhyme with TargetPolicy, may eventually share a common base
  21. // with a configuration holding class (i.e. this class will extend with dynamic
  22. // members such as the |process_ids_| list.)
  23. class PolicyDiagnostic final : public PolicyInfo {
  24. public:
  25. // This should quickly copy what it needs from PolicyBase.
  26. explicit PolicyDiagnostic(PolicyBase* policy);
  27. PolicyDiagnostic(const PolicyDiagnostic&) = delete;
  28. PolicyDiagnostic& operator=(const PolicyDiagnostic&) = delete;
  29. ~PolicyDiagnostic() override;
  30. const char* JsonString() override;
  31. private:
  32. // |json_string_| is lazily constructed.
  33. std::unique_ptr<std::string> json_string_;
  34. uint32_t process_id_;
  35. TokenLevel lockdown_level_ = USER_LAST;
  36. JobLevel job_level_ = JobLevel::kNone;
  37. IntegrityLevel desired_integrity_level_ = INTEGRITY_LEVEL_LAST;
  38. MitigationFlags desired_mitigations_ = 0;
  39. absl::optional<base::win::Sid> app_container_sid_;
  40. // Only populated if |app_container_sid_| is present.
  41. std::vector<base::win::Sid> capabilities_;
  42. // Only populated if |app_container_sid_| is present.
  43. std::vector<base::win::Sid> initial_capabilities_;
  44. AppContainerType app_container_type_ = AppContainerType::kNone;
  45. std::unique_ptr<PolicyGlobal> policy_rules_;
  46. bool is_csrss_connected_ = false;
  47. HandleMap handles_to_close_;
  48. std::string tag_;
  49. };
  50. } // namespace sandbox
  51. #endif // SANDBOX_WIN_SRC_SANDBOX_POLICY_DIAGNOSTIC_H_