1// Copyright (c) 2012 The Chromium Authors. All rights reserved.
2// Use of this source code is governed by a BSD-style license that can be
3// found in the LICENSE file.
4
5#ifndef SANDBOX_LINUX_SUID_SETUID_SANDBOX_CLIENT_H_
6#define SANDBOX_LINUX_SUID_SETUID_SANDBOX_CLIENT_H_
7
8#include "base/basictypes.h"
9
10namespace base { class Environment; }
11
12namespace sandbox {
13
14// Helper class to use the setuid sandbox. This class is to be used both
15// before launching the setuid helper and after being executed through the
16// setuid helper.
17//
18// A typical use would be:
19// 1. The browser calls SetupLaunchEnvironment()
20// 2. The browser launches a renderer through the setuid sandbox.
21// 3. The renderer requests being chroot-ed through ChrootMe() and
22//    requests other sandboxing status via the status functions.
23class SetuidSandboxClient {
24 public:
25  // All instantation should go through this factory method.
26  static class SetuidSandboxClient* Create();
27  ~SetuidSandboxClient();
28
29  // Ask the setuid helper over the setuid sandbox IPC channel to chroot() us
30  // to an empty directory.
31  // Will only work if we have been launched through the setuid helper.
32  bool ChrootMe();
33
34  // Did we get launched through an up to date setuid binary ?
35  bool IsSuidSandboxUpToDate() const;
36  // Did we get launched through the setuid helper ?
37  bool IsSuidSandboxChild() const;
38  // Did the setuid helper create a new PID namespace ?
39  bool IsInNewPIDNamespace() const;
40  // Did the setuid helper create a new network namespace ?
41  bool IsInNewNETNamespace() const;
42  // Are we done and fully sandboxed ?
43  bool IsSandboxed() const;
44
45  // Set-up the environment. This should be done prior to launching the setuid
46  // helper.
47  void SetupLaunchEnvironment();
48
49 private:
50  // Holds the environment. Will never be NULL.
51  base::Environment* env_;
52  bool sandboxed_;
53  DISALLOW_IMPLICIT_CONSTRUCTORS(SetuidSandboxClient);
54};
55
56}  // namespace sandbox
57
58#endif  // SANDBOX_LINUX_SUID_SETUID_SANDBOX_CLIENT_H_
59
60