1// Copyright 2014 The Chromium Authors. All rights reserved. 2// Use of this source code is governed by a BSD-style license that can be 3// found in the LICENSE file. 4 5#ifndef SANDBOX_MAC_LAUNCHD_INTERCEPTION_SERVER_H_ 6#define SANDBOX_MAC_LAUNCHD_INTERCEPTION_SERVER_H_ 7 8#include <dispatch/dispatch.h> 9 10#include "base/mac/scoped_mach_port.h" 11#include "base/memory/scoped_ptr.h" 12#include "sandbox/mac/message_server.h" 13#include "sandbox/mac/os_compatibility.h" 14 15namespace sandbox { 16 17class BootstrapSandbox; 18struct BootstrapSandboxPolicy; 19 20// This class is used to run a Mach IPC message server. This server can 21// hold the receive right for a bootstrap_port of a process, and it filters 22// a subset of the launchd/bootstrap IPC call set for sandboxing. It permits 23// or rejects requests based on the per-process policy specified in the 24// BootstrapSandbox. 25class LaunchdInterceptionServer : public MessageDemuxer { 26 public: 27 explicit LaunchdInterceptionServer(const BootstrapSandbox* sandbox); 28 virtual ~LaunchdInterceptionServer(); 29 30 // Initializes the class and starts running the message server. If the 31 // |server_receive_right| is non-NULL, this class will take ownership of 32 // the receive right and intercept messages sent to that port. 33 bool Initialize(mach_port_t server_receive_right); 34 35 // MessageDemuxer: 36 virtual void DemuxMessage(IPCMessage request) OVERRIDE; 37 38 mach_port_t server_port() const { return message_server_->GetServerPort(); } 39 40 private: 41 // Given a look_up2 request message, this looks up the appropriate sandbox 42 // policy for the service name then formulates and sends the reply message. 43 void HandleLookUp(IPCMessage request, const BootstrapSandboxPolicy* policy); 44 45 // Given a swap_integer request message, this verifies that it is safe, and 46 // if so, forwards it on to launchd for servicing. If the request is unsafe, 47 // it replies with an error. 48 void HandleSwapInteger(IPCMessage request); 49 50 // Forwards the original |request| on to real bootstrap server for handling. 51 void ForwardMessage(IPCMessage request); 52 53 // The sandbox for which this message server is running. 54 const BootstrapSandbox* sandbox_; 55 56 // The Mach IPC server. 57 scoped_ptr<MessageServer> message_server_; 58 59 // The Mach port handed out in reply to denied look up requests. All denied 60 // requests share the same port, though nothing reads messages from it. 61 base::mac::ScopedMachReceiveRight sandbox_port_; 62 // The send right for the above |sandbox_port_|, used with 63 // MACH_MSG_TYPE_COPY_SEND when handing out references to the dummy port. 64 base::mac::ScopedMachSendRight sandbox_send_port_; 65 66 // The compatibility shim that handles differences in message header IDs and 67 // request/reply structures between different OS X versions. 68 const LaunchdCompatibilityShim compat_shim_; 69}; 70 71} // namespace sandbox 72 73#endif // SANDBOX_MAC_LAUNCHD_INTERCEPTION_SERVER_H_ 74