tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

Sandbox.h (3909B)

      1 /* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
      2 /* vim: set ts=8 sts=2 et sw=2 tw=80: */
      3 /* This Source Code Form is subject to the terms of the Mozilla Public
      4 * License, v. 2.0. If a copy of the MPL was not distributed with this file,
      5 * You can obtain one at http://mozilla.org/MPL/2.0/. */
      6 
      7 #ifndef mozilla_Sandbox_h
      8 #define mozilla_Sandbox_h
      9 
     10 #include "mozilla/Maybe.h"
     11 #include "mozilla/Types.h"
     12 #include "mozilla/UniquePtrExtensions.h"
     13 #include "nsXULAppAPI.h"
     14 #include <vector>
     15 
     16 #include "mozilla/ipc/UtilityProcessSandboxing.h"
     17 
     18 // This defines the entry points for a content process to start
     19 // sandboxing itself.  See also SandboxInfo.h for what parts of
     20 // sandboxing are enabled/supported.
     21 
     22 namespace mozilla {
     23 
     24 namespace ipc {
     25 class FileDescriptor;
     26 }  // namespace ipc
     27 
     28 // This must be called early, before glib creates any worker threads.
     29 // (See bug 1176099.)
     30 MOZ_EXPORT void SandboxEarlyInit(
     31    Maybe<mozilla::UniqueFileHandle>&& aSandboxReporter,
     32    Maybe<mozilla::UniqueFileHandle>&& aChrootClient);
     33 
     34 // A collection of sandbox parameters that have to be extracted from
     35 // prefs or other libxul facilities and passed down, because
     36 // libmozsandbox can't link against the APIs to read them.
     37 struct ContentProcessSandboxParams {
     38  // Content sandbox level; see also GetEffectiveSandboxLevel in
     39  // SandboxSettings.h and the comments for the Linux version of
     40  // "security.sandbox.content.level" in browser/app/profile/firefox.js
     41  int mLevel = 0;
     42  // The filesystem broker client file descriptor, or -1 to allow
     43  // direct filesystem access.  (Warning: this is not a RAII class and
     44  // will not close the fd on destruction.)
     45  int mBrokerFd = -1;
     46  // Determines whether we allow reading all files, for processes that
     47  // render file:/// URLs.
     48  bool mFileProcess = false;
     49  // Syscall numbers to allow even if the seccomp-bpf policy otherwise
     50  // wouldn't.
     51  std::vector<int> mSyscallWhitelist;
     52 
     53  static ContentProcessSandboxParams ForThisProcess(
     54      const Maybe<ipc::FileDescriptor>& aBroker);
     55 };
     56 
     57 // Similarly to ContentProcessSandboxParams, a collection of
     58 // parameters for the socket process.  Currently this is just the
     59 // level (and the broker), but in the future there could be more.
     60 struct SocketProcessSandboxParams {
     61  // Socket process sandbox level; see also GetEffectiveSandboxLevel
     62  // and the comments for "security.sandbox.socket.process.level" in
     63  // browser/app/profile/firefox.js
     64  int mLevel = 0;
     65 
     66  // The filesystem broker client fd; this *is* a RAII class so it
     67  // needs to be `release()`d or moved to consume it.
     68  mozilla::UniqueFileHandle mBroker;
     69 
     70  static SocketProcessSandboxParams ForThisProcess(
     71      const Maybe<ipc::FileDescriptor>& aBroker);
     72 };
     73 
     74 // Call only if SandboxInfo::CanSandboxContent() returns true.
     75 // (No-op if the sandbox is disabled.)
     76 // isFileProcess determines whether we allow system wide file reads.
     77 MOZ_EXPORT bool SetContentProcessSandbox(ContentProcessSandboxParams&& aParams);
     78 
     79 // Call only if SandboxInfo::CanSandboxMedia() returns true.
     80 // (No-op if MOZ_DISABLE_GMP_SANDBOX is set.)
     81 // aFilePath is the path to the plugin file.
     82 MOZ_EXPORT void SetMediaPluginSandbox(const char* aFilePath);
     83 
     84 MOZ_EXPORT void SetRemoteDataDecoderSandbox(int aBroker);
     85 
     86 MOZ_EXPORT void SetSocketProcessSandbox(SocketProcessSandboxParams&& aParams);
     87 
     88 MOZ_EXPORT void SetUtilitySandbox(int aBroker, ipc::SandboxingKind aKind);
     89 
     90 // We want to turn on/off crashing on error when running some tests
     91 // This will return current value and set the aValue we pass
     92 MOZ_EXPORT bool SetSandboxCrashOnError(bool aValue);
     93 
     94 // Call SandboxProfiler::Create to make sure SandboxProfiler exists if it should
     95 // exists, i.e., profiler symbols were found and the profiler is running
     96 MOZ_EXPORT void CreateSandboxProfiler();
     97 
     98 MOZ_EXPORT void DestroySandboxProfiler();
     99 
    100 }  // namespace mozilla
    101 
    102 #endif  // mozilla_Sandbox_h