1 // Copyright 2014 The Chromium Authors. All rights reserved. 2 // Use of this source code is governed by a BSD-style license that can be 3 // found in the LICENSE file. 4 5 #ifndef SANDBOX_MAC_LAUNCHD_INTERCEPTION_SERVER_H_ 6 #define SANDBOX_MAC_LAUNCHD_INTERCEPTION_SERVER_H_ 7 8 #include <dispatch/dispatch.h> 9 #include <mach/mach.h> 10 11 #include "base/mac/scoped_mach_port.h" 12 #include "base/memory/scoped_ptr.h" 13 #include "sandbox/mac/mach_message_server.h" 14 #include "sandbox/mac/os_compatibility.h" 15 16 namespace sandbox { 17 18 class BootstrapSandbox; 19 struct BootstrapSandboxPolicy; 20 21 // This class is used to run a Mach IPC message server. This server can 22 // hold the receive right for a bootstrap_port of a process, and it filters 23 // a subset of the launchd/bootstrap IPC call set for sandboxing. It permits 24 // or rejects requests based on the per-process policy specified in the 25 // BootstrapSandbox. 26 class LaunchdInterceptionServer : public MessageDemuxer { 27 public: 28 explicit LaunchdInterceptionServer(const BootstrapSandbox* sandbox); 29 virtual ~LaunchdInterceptionServer(); 30 31 // Initializes the class and starts running the message server. If the 32 // |server_receive_right| is non-NULL, this class will take ownership of 33 // the receive right and intercept messages sent to that port. 34 bool Initialize(mach_port_t server_receive_right); 35 36 // MessageDemuxer: 37 virtual void DemuxMessage(mach_msg_header_t* request, 38 mach_msg_header_t* reply) OVERRIDE; 39 server_port()40 mach_port_t server_port() const { return message_server_->server_port(); } 41 42 private: 43 // Given a look_up2 request message, this looks up the appropriate sandbox 44 // policy for the service name then formulates and sends the reply message. 45 void HandleLookUp(mach_msg_header_t* request, 46 mach_msg_header_t* reply, 47 const BootstrapSandboxPolicy* policy); 48 49 // Given a swap_integer request message, this verifies that it is safe, and 50 // if so, forwards it on to launchd for servicing. If the request is unsafe, 51 // it replies with an error. 52 void HandleSwapInteger(mach_msg_header_t* request, 53 mach_msg_header_t* reply); 54 55 // Forwards the original |request| on to real bootstrap server for handling. 56 void ForwardMessage(mach_msg_header_t* request); 57 58 // The sandbox for which this message server is running. 59 const BootstrapSandbox* sandbox_; 60 61 // The Mach IPC server. 62 scoped_ptr<MachMessageServer> message_server_; 63 64 // The Mach port handed out in reply to denied look up requests. All denied 65 // requests share the same port, though nothing reads messages from it. 66 base::mac::ScopedMachReceiveRight sandbox_port_; 67 // The send right for the above |sandbox_port_|, used with 68 // MACH_MSG_TYPE_COPY_SEND when handing out references to the dummy port. 69 base::mac::ScopedMachSendRight sandbox_send_port_; 70 71 // The compatibility shim that handles differences in message header IDs and 72 // request/reply structures between different OS X versions. 73 const LaunchdCompatibilityShim compat_shim_; 74 }; 75 76 } // namespace sandbox 77 78 #endif // SANDBOX_MAC_LAUNCHD_INTERCEPTION_SERVER_H_ 79