summaryrefslogtreecommitdiffstats
path: root/sandbox/src/job.cc
diff options
context:
space:
mode:
Diffstat (limited to 'sandbox/src/job.cc')
-rw-r--r--sandbox/src/job.cc116
1 files changed, 0 insertions, 116 deletions
diff --git a/sandbox/src/job.cc b/sandbox/src/job.cc
deleted file mode 100644
index 8ed3a77..0000000
--- a/sandbox/src/job.cc
+++ /dev/null
@@ -1,116 +0,0 @@
-// Copyright (c) 2011 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "sandbox/src/job.h"
-
-#include "base/win/windows_version.h"
-#include "sandbox/src/restricted_token.h"
-
-namespace sandbox {
-
-Job::~Job() {
- if (job_handle_)
- ::CloseHandle(job_handle_);
-};
-
-DWORD Job::Init(JobLevel security_level, wchar_t *job_name,
- DWORD ui_exceptions) {
- if (job_handle_)
- return ERROR_ALREADY_INITIALIZED;
-
- job_handle_ = ::CreateJobObject(NULL, // No security attribute
- job_name);
- if (!job_handle_)
- return ::GetLastError();
-
- JOBOBJECT_EXTENDED_LIMIT_INFORMATION jeli = {0};
- JOBOBJECT_BASIC_UI_RESTRICTIONS jbur = {0};
-
- // Set the settings for the different security levels. Note: The higher levels
- // inherit from the lower levels.
- switch (security_level) {
- case JOB_LOCKDOWN: {
- jeli.BasicLimitInformation.LimitFlags |=
- JOB_OBJECT_LIMIT_DIE_ON_UNHANDLED_EXCEPTION;
- }
- case JOB_RESTRICTED: {
- jbur.UIRestrictionsClass |= JOB_OBJECT_UILIMIT_WRITECLIPBOARD;
- jbur.UIRestrictionsClass |= JOB_OBJECT_UILIMIT_READCLIPBOARD;
- jbur.UIRestrictionsClass |= JOB_OBJECT_UILIMIT_HANDLES;
- jbur.UIRestrictionsClass |= JOB_OBJECT_UILIMIT_GLOBALATOMS;
- }
- case JOB_LIMITED_USER: {
- jbur.UIRestrictionsClass |= JOB_OBJECT_UILIMIT_DISPLAYSETTINGS;
- jeli.BasicLimitInformation.LimitFlags |= JOB_OBJECT_LIMIT_ACTIVE_PROCESS;
- jeli.BasicLimitInformation.ActiveProcessLimit = 1;
- }
- case JOB_INTERACTIVE: {
- jbur.UIRestrictionsClass |= JOB_OBJECT_UILIMIT_SYSTEMPARAMETERS;
- jbur.UIRestrictionsClass |= JOB_OBJECT_UILIMIT_DESKTOP;
- jbur.UIRestrictionsClass |= JOB_OBJECT_UILIMIT_EXITWINDOWS;
- }
- case JOB_UNPROTECTED: {
- // The JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE flag is not supported on
- // Windows 2000. We need a mechanism on Windows 2000 to ensure
- // that processes in the job are terminated when the job is closed
- if (base::win::GetVersion() == base::win::VERSION_PRE_XP)
- break;
-
- jeli.BasicLimitInformation.LimitFlags |=
- JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE;
- break;
- }
- default: {
- return ERROR_BAD_ARGUMENTS;
- }
- }
-
- if (FALSE == ::SetInformationJobObject(job_handle_,
- JobObjectExtendedLimitInformation,
- &jeli,
- sizeof(jeli))) {
- return ::GetLastError();
- }
-
- jbur.UIRestrictionsClass = jbur.UIRestrictionsClass & (~ui_exceptions);
- if (FALSE == ::SetInformationJobObject(job_handle_,
- JobObjectBasicUIRestrictions,
- &jbur,
- sizeof(jbur))) {
- return ::GetLastError();
- }
-
- return ERROR_SUCCESS;
-}
-
-DWORD Job::UserHandleGrantAccess(HANDLE handle) {
- if (!job_handle_)
- return ERROR_NO_DATA;
-
- if (!::UserHandleGrantAccess(handle,
- job_handle_,
- TRUE)) { // Access allowed.
- return ::GetLastError();
- }
-
- return ERROR_SUCCESS;
-}
-
-HANDLE Job::Detach() {
- HANDLE handle_temp = job_handle_;
- job_handle_ = NULL;
- return handle_temp;
-}
-
-DWORD Job::AssignProcessToJob(HANDLE process_handle) {
- if (!job_handle_)
- return ERROR_NO_DATA;
-
- if (FALSE == ::AssignProcessToJobObject(job_handle_, process_handle))
- return ::GetLastError();
-
- return ERROR_SUCCESS;
-}
-
-} // namespace sandbox