1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
|
/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
/* vim: set ts=8 sts=2 et sw=2 tw=80: */
/* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this file,
* You can obtain one at http://mozilla.org/MPL/2.0/. */
#ifndef mozilla_Sandbox_h
#define mozilla_Sandbox_h
#include "mozilla/Maybe.h"
#include "mozilla/Types.h"
#include "mozilla/UniquePtrExtensions.h"
#include "nsXULAppAPI.h"
#include <vector>
#include "mozilla/ipc/UtilityProcessSandboxing.h"
// This defines the entry points for a content process to start
// sandboxing itself. See also SandboxInfo.h for what parts of
// sandboxing are enabled/supported.
namespace mozilla {
namespace ipc {
class FileDescriptor;
} // namespace ipc
// This must be called early, before glib creates any worker threads.
// (See bug 1176099.)
MOZ_EXPORT void SandboxEarlyInit(
Maybe<mozilla::UniqueFileHandle>&& aSandboxReporter,
Maybe<mozilla::UniqueFileHandle>&& aChrootClient);
// A collection of sandbox parameters that have to be extracted from
// prefs or other libxul facilities and passed down, because
// libmozsandbox can't link against the APIs to read them.
struct ContentProcessSandboxParams {
// Content sandbox level; see also GetEffectiveSandboxLevel in
// SandboxSettings.h and the comments for the Linux version of
// "security.sandbox.content.level" in browser/app/profile/firefox.js
int mLevel = 0;
// The filesystem broker client file descriptor, or -1 to allow
// direct filesystem access. (Warning: this is not a RAII class and
// will not close the fd on destruction.)
int mBrokerFd = -1;
// Determines whether we allow reading all files, for processes that
// render file:/// URLs.
bool mFileProcess = false;
// Syscall numbers to allow even if the seccomp-bpf policy otherwise
// wouldn't.
std::vector<int> mSyscallWhitelist;
static ContentProcessSandboxParams ForThisProcess(
const Maybe<ipc::FileDescriptor>& aBroker);
};
// Similarly to ContentProcessSandboxParams, a collection of
// parameters for the socket process. Currently this is just the
// level (and the broker), but in the future there could be more.
struct SocketProcessSandboxParams {
// Socket process sandbox level; see also GetEffectiveSandboxLevel
// and the comments for "security.sandbox.socket.process.level" in
// browser/app/profile/firefox.js
int mLevel = 0;
// The filesystem broker client fd; this *is* a RAII class so it
// needs to be `release()`d or moved to consume it.
mozilla::UniqueFileHandle mBroker;
static SocketProcessSandboxParams ForThisProcess(
const Maybe<ipc::FileDescriptor>& aBroker);
};
// Call only if SandboxInfo::CanSandboxContent() returns true.
// (No-op if the sandbox is disabled.)
// isFileProcess determines whether we allow system wide file reads.
MOZ_EXPORT bool SetContentProcessSandbox(ContentProcessSandboxParams&& aParams);
// Call only if SandboxInfo::CanSandboxMedia() returns true.
// (No-op if MOZ_DISABLE_GMP_SANDBOX is set.)
// aFilePath is the path to the plugin file.
MOZ_EXPORT void SetMediaPluginSandbox(const char* aFilePath);
MOZ_EXPORT void SetRemoteDataDecoderSandbox(int aBroker);
MOZ_EXPORT void SetSocketProcessSandbox(SocketProcessSandboxParams&& aParams);
MOZ_EXPORT void SetUtilitySandbox(int aBroker, ipc::SandboxingKind aKind);
// We want to turn on/off crashing on error when running some tests
// This will return current value and set the aValue we pass
MOZ_EXPORT bool SetSandboxCrashOnError(bool aValue);
// Call SandboxProfiler::Create to make sure SandboxProfiler exists if it should
// exists, i.e., profiler symbols were found and the profiler is running
MOZ_EXPORT void CreateSandboxProfiler();
MOZ_EXPORT void DestroySandboxProfiler();
} // namespace mozilla
#endif // mozilla_Sandbox_h
|
