1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. 2 // Use of this source code is governed by a BSD-style license that can be 3 // found in the LICENSE file. 4 5 #ifndef SANDBOX_LINUX_SUID_SETUID_SANDBOX_CLIENT_H_ 6 #define SANDBOX_LINUX_SUID_SETUID_SANDBOX_CLIENT_H_ 7 8 #include "base/basictypes.h" 9 10 namespace base { class Environment; } 11 12 namespace sandbox { 13 14 // Helper class to use the setuid sandbox. This class is to be used both 15 // before launching the setuid helper and after being executed through the 16 // setuid helper. 17 // 18 // A typical use would be: 19 // 1. The browser calls SetupLaunchEnvironment() 20 // 2. The browser launches a renderer through the setuid sandbox. 21 // 3. The renderer requests being chroot-ed through ChrootMe() and 22 // requests other sandboxing status via the status functions. 23 class SetuidSandboxClient { 24 public: 25 // All instantation should go through this factory method. 26 static class SetuidSandboxClient* Create(); 27 ~SetuidSandboxClient(); 28 29 // Ask the setuid helper over the setuid sandbox IPC channel to chroot() us 30 // to an empty directory. 31 // Will only work if we have been launched through the setuid helper. 32 bool ChrootMe(); 33 34 // Did we get launched through an up to date setuid binary ? 35 bool IsSuidSandboxUpToDate() const; 36 // Did we get launched through the setuid helper ? 37 bool IsSuidSandboxChild() const; 38 // Did the setuid helper create a new PID namespace ? 39 bool IsInNewPIDNamespace() const; 40 // Did the setuid helper create a new network namespace ? 41 bool IsInNewNETNamespace() const; 42 // Are we done and fully sandboxed ? 43 bool IsSandboxed() const; 44 45 // Set-up the environment. This should be done prior to launching the setuid 46 // helper. 47 void SetupLaunchEnvironment(); 48 49 private: 50 // Holds the environment. Will never be NULL. 51 base::Environment* env_; 52 bool sandboxed_; 53 DISALLOW_IMPLICIT_CONSTRUCTORS(SetuidSandboxClient); 54 }; 55 56 } // namespace sandbox 57 58 #endif // SANDBOX_LINUX_SUID_SETUID_SANDBOX_CLIENT_H_ 59 60
