1 // Copyright (c) 2011 The Chromium Authors. All rights reserved. 2 // Use of this source code is governed by a BSD-style license that can be 3 // found in the LICENSE file. 4 5 #include "content/public/common/sandbox_init.h" 6 7 #include "base/command_line.h" 8 #include "base/files/file_path.h" 9 #include "base/logging.h" 10 #include "content/common/sandbox_mac.h" 11 #include "content/public/common/content_switches.h" 12 13 namespace content { 14 15 bool InitializeSandbox(int sandbox_type, const base::FilePath& allowed_dir) { 16 // Warm up APIs before turning on the sandbox. 17 Sandbox::SandboxWarmup(sandbox_type); 18 19 // Actually sandbox the process. 20 return Sandbox::EnableSandbox(sandbox_type, allowed_dir); 21 } 22 23 // Fill in |sandbox_type| and |allowed_dir| based on the command line, returns 24 // false if the current process type doesn't need to be sandboxed or if the 25 // sandbox was disabled from the command line. 26 bool GetSandboxTypeFromCommandLine(int* sandbox_type, 27 base::FilePath* allowed_dir) { 28 DCHECK(sandbox_type); 29 DCHECK(allowed_dir); 30 31 *sandbox_type = -1; 32 *allowed_dir = base::FilePath(); // Empty by default. 33 34 const CommandLine& command_line = *CommandLine::ForCurrentProcess(); 35 if (command_line.HasSwitch(switches::kNoSandbox)) 36 return false; 37 38 std::string process_type = 39 command_line.GetSwitchValueASCII(switches::kProcessType); 40 if (process_type.empty()) { 41 // Browser process isn't sandboxed. 42 return false; 43 } else if (process_type == switches::kRendererProcess) { 44 *sandbox_type = SANDBOX_TYPE_RENDERER; 45 } else if (process_type == switches::kUtilityProcess) { 46 // Utility process sandbox. 47 *sandbox_type = SANDBOX_TYPE_UTILITY; 48 *allowed_dir = 49 command_line.GetSwitchValuePath(switches::kUtilityProcessAllowedDir); 50 } else if (process_type == switches::kWorkerProcess) { 51 // Worker process sandbox. 52 *sandbox_type = SANDBOX_TYPE_WORKER; 53 } else if (process_type == switches::kGpuProcess) { 54 if (command_line.HasSwitch(switches::kDisableGpuSandbox)) 55 return false; 56 *sandbox_type = SANDBOX_TYPE_GPU; 57 } else if ((process_type == switches::kPluginProcess) || 58 (process_type == switches::kPpapiBrokerProcess)) { 59 return false; 60 } else if (process_type == switches::kPpapiPluginProcess) { 61 *sandbox_type = SANDBOX_TYPE_PPAPI; 62 } else { 63 // This is a process which we don't know about, i.e. an embedder-defined 64 // process. If the embedder wants it sandboxed, they have a chance to return 65 // the sandbox profile in ContentClient::GetSandboxProfileForSandboxType. 66 return false; 67 } 68 return true; 69 } 70 71 bool InitializeSandbox() { 72 int sandbox_type = 0; 73 base::FilePath allowed_dir; 74 if (!GetSandboxTypeFromCommandLine(&sandbox_type, &allowed_dir)) 75 return true; 76 return InitializeSandbox(sandbox_type, allowed_dir); 77 } 78 79 extern const char kBootstrapPortNameForNPAPIPlugins[] = 80 "org.chromium.sandbox.real_bootstrap_server"; 81 82 } // namespace content 83