Home | History | Annotate | Download | only in mac 
      1 // Copyright 2014 The Chromium Authors. All rights reserved.
      2 // Use of this source code is governed by a BSD-style license that can be
      3 // found in the LICENSE file.
      4 
      5 #ifndef SANDBOX_MAC_LAUNCHD_INTERCEPTION_SERVER_H_
      6 #define SANDBOX_MAC_LAUNCHD_INTERCEPTION_SERVER_H_
      7 
      8 #include <dispatch/dispatch.h>
      9 #include <mach/mach.h>
     10 
     11 #include "base/mac/scoped_mach_port.h"
     12 #include "base/memory/scoped_ptr.h"
     13 #include "sandbox/mac/mach_message_server.h"
     14 #include "sandbox/mac/os_compatibility.h"
     15 
     16 namespace sandbox {
     17 
     18 class BootstrapSandbox;
     19 struct BootstrapSandboxPolicy;
     20 
     21 // This class is used to run a Mach IPC message server. This server can
     22 // hold the receive right for a bootstrap_port of a process, and it filters
     23 // a subset of the launchd/bootstrap IPC call set for sandboxing. It permits
     24 // or rejects requests based on the per-process policy specified in the
     25 // BootstrapSandbox.
     26 class LaunchdInterceptionServer : public MessageDemuxer {
     27  public:
     28   explicit LaunchdInterceptionServer(const BootstrapSandbox* sandbox);
     29   virtual ~LaunchdInterceptionServer();
     30 
     31   // Initializes the class and starts running the message server. If the
     32   // |server_receive_right| is non-NULL, this class will take ownership of
     33   // the receive right and intercept messages sent to that port.
     34   bool Initialize(mach_port_t server_receive_right);
     35 
     36   // MessageDemuxer:
     37   virtual void DemuxMessage(mach_msg_header_t* request,
     38                             mach_msg_header_t* reply) OVERRIDE;
     39 
     40   mach_port_t server_port() const { return message_server_->server_port(); }
     41 
     42  private:
     43   // Given a look_up2 request message, this looks up the appropriate sandbox
     44   // policy for the service name then formulates and sends the reply message.
     45   void HandleLookUp(mach_msg_header_t* request,
     46                     mach_msg_header_t* reply,
     47                     const BootstrapSandboxPolicy* policy);
     48 
     49   // Given a swap_integer request message, this verifies that it is safe, and
     50   // if so, forwards it on to launchd for servicing. If the request is unsafe,
     51   // it replies with an error.
     52   void HandleSwapInteger(mach_msg_header_t* request,
     53                          mach_msg_header_t* reply);
     54 
     55   // Forwards the original |request| on to real bootstrap server for handling.
     56   void ForwardMessage(mach_msg_header_t* request);
     57 
     58   // The sandbox for which this message server is running.
     59   const BootstrapSandbox* sandbox_;
     60 
     61   // The Mach IPC server.
     62   scoped_ptr<MachMessageServer> message_server_;
     63 
     64   // The Mach port handed out in reply to denied look up requests. All denied
     65   // requests share the same port, though nothing reads messages from it.
     66   base::mac::ScopedMachReceiveRight sandbox_port_;
     67   // The send right for the above |sandbox_port_|, used with
     68   // MACH_MSG_TYPE_COPY_SEND when handing out references to the dummy port.
     69   base::mac::ScopedMachSendRight sandbox_send_port_;
     70 
     71   // The compatibility shim that handles differences in message header IDs and
     72   // request/reply structures between different OS X versions.
     73   const LaunchdCompatibilityShim compat_shim_;
     74 };
     75 
     76 }  // namespace sandbox
     77 
     78 #endif  // SANDBOX_MAC_LAUNCHD_INTERCEPTION_SERVER_H_
     79