blob: f5edf8832b44f7e5a4f791a643045b63df1f462d (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
|
// Copyright (c) 2012 The Chromium Authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
#include "content/public/common/sandbox_init.h"
#include "base/command_line.h"
#include "base/logging.h"
#include "content/common/sandbox_policy.h"
#include "content/public/common/content_switches.h"
#include "sandbox/win/src/sandbox.h"
#include "sandbox/win/src/sandbox_types.h"
namespace content {
bool InitializeSandbox(sandbox::SandboxInterfaceInfo* sandbox_info) {
const CommandLine& command_line = *CommandLine::ForCurrentProcess();
std::string process_type =
command_line.GetSwitchValueASCII(switches::kProcessType);
sandbox::BrokerServices* broker_services = sandbox_info->broker_services;
if (broker_services && (process_type.empty() ||
process_type == switches::kNaClBrokerProcess ||
process_type == switches::kServiceProcess)) {
if (!InitBrokerServices(broker_services))
return false;
}
if (process_type.empty() || process_type == switches::kNaClBrokerProcess) {
// IMPORTANT: This piece of code needs to run as early as possible in the
// process because it will initialize the sandbox broker, which requires the
// process to swap its window station. During this time all the UI will be
// broken. This has to run before threads and windows are created.
if (broker_services) {
if (!command_line.HasSwitch(switches::kNoSandbox)) {
bool use_winsta = !command_line.HasSwitch(
switches::kDisableAltWinstation);
// Precreate the desktop and window station used by the renderers.
sandbox::TargetPolicy* policy = broker_services->CreatePolicy();
sandbox::ResultCode result = policy->CreateAlternateDesktop(use_winsta);
CHECK(sandbox::SBOX_ERROR_FAILED_TO_SWITCH_BACK_WINSTATION != result);
policy->Release();
}
}
return true;
}
if (command_line.HasSwitch(switches::kNoSandbox))
return true;
sandbox::TargetServices* target_services = sandbox_info->target_services;
if ((process_type == switches::kRendererProcess) ||
(process_type == switches::kWorkerProcess) ||
(process_type == switches::kNaClLoaderProcess) ||
(process_type == switches::kUtilityProcess)) {
// The above five process types must be sandboxed unless --no-sandbox
// is present in the command line.
if (!target_services)
return false;
} else {
// Other process types might or might not be sandboxed.
// TODO(cpu): clean this mess.
if (!target_services)
return true;
}
return InitTargetServices(target_services);
}
} // namespace content
|
