1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
|
// Copyright 2021 The Chromium Authors
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
#include "printing/sandbox/print_backend_sandbox_hook_linux.h"
#include "base/base_paths.h"
#include "base/files/file_path.h"
#include "base/files/file_util.h"
#include "base/path_service.h"
#include "build/build_config.h"
#include "printing/buildflags/buildflags.h"
#include "sandbox/linux/syscall_broker/broker_command.h"
#include "sandbox/linux/syscall_broker/broker_file_permission.h"
#include "sandbox/policy/export.h"
#include "sandbox/policy/linux/sandbox_linux.h"
#if BUILDFLAG(IS_CHROMEOS) && BUILDFLAG(USE_CUPS)
#include "printing/backend/cups_connection_pool.h"
#endif
using sandbox::syscall_broker::BrokerFilePermission;
using sandbox::syscall_broker::MakeBrokerCommandSet;
namespace printing {
namespace {
sandbox::syscall_broker::BrokerCommandSet GetPrintBackendBrokerCommandSet() {
// Need read access to look at system PPD files.
// Need ability to create/write/delete for temporary files in order to
// support PPD handling in `printing::ParsePpdCapabilities()`.
sandbox::syscall_broker::BrokerCommandSet broker_command_set =
MakeBrokerCommandSet({
sandbox::syscall_broker::COMMAND_ACCESS,
sandbox::syscall_broker::COMMAND_OPEN,
sandbox::syscall_broker::COMMAND_READLINK,
sandbox::syscall_broker::COMMAND_STAT,
sandbox::syscall_broker::COMMAND_UNLINK,
});
return broker_command_set;
}
std::vector<BrokerFilePermission> GetPrintBackendFilePermissions() {
#if BUILDFLAG(IS_CHROMEOS) && BUILDFLAG(USE_CUPS)
// No extra permissions required, as the needed socket connections to the CUPS
// server are established before entering the sandbox.
return std::vector<BrokerFilePermission>();
#else
base::FilePath temp_dir_path;
CHECK(base::GetTempDir(&temp_dir_path));
base::FilePath home_dir_path;
CHECK(base::PathService::Get(base::DIR_HOME, &home_dir_path));
base::FilePath cups_options_path = home_dir_path.Append(".cups/lpoptions");
std::vector<BrokerFilePermission> permissions{
// To support reading system PPDs. This list is per the CUPS docs with
// macOS-specific paths omitted.
// https://www.cups.org/doc/man-cupsd-helper.html
BrokerFilePermission::ReadOnlyRecursive("/opt/share/ppd/"),
BrokerFilePermission::ReadOnlyRecursive("/usr/local/share/ppd/"),
BrokerFilePermission::ReadOnlyRecursive("/usr/share/cups/drv/"),
BrokerFilePermission::ReadOnlyRecursive("/usr/share/cups/model/"),
BrokerFilePermission::ReadOnlyRecursive("/usr/share/ppd/"),
// To support reading user's default printer.
// https://www.cups.org/doc/cupspm.html#cupsEnumDests
// https://www.cups.org/doc/options.html
BrokerFilePermission::ReadOnly(cups_options_path.value()),
// To support PPD handling in `printing::ParsePpdCapabilities()`.
BrokerFilePermission::ReadWriteCreateTemporary(temp_dir_path.value()),
};
return permissions;
#endif // BUILDFLAG(IS_CHROMEOS) && BUILDFLAG(USE_CUPS)
}
} // namespace
bool PrintBackendPreSandboxHook(
sandbox::policy::SandboxLinux::Options options) {
#if BUILDFLAG(IS_CHROMEOS) && BUILDFLAG(USE_CUPS)
// Create the socket connections to the CUPS server before engaging the
// sandbox, since new connections cannot be made after that.
CupsConnectionPool::Create();
#endif
auto* instance = sandbox::policy::SandboxLinux::GetInstance();
instance->StartBrokerProcess(GetPrintBackendBrokerCommandSet(),
GetPrintBackendFilePermissions(), options);
instance->EngageNamespaceSandboxIfPossible();
return true;
}
} // namespace printing
|
