content/common/sandbox_mac.h

   1 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #ifndef CONTENT_COMMON_SANDBOX_MAC_H_
   6 #define CONTENT_COMMON_SANDBOX_MAC_H_
   7 #pragma once
   8
   9 #include <string>
  10
  11 #include "base/basictypes.h"
  12 #include "base/hash_tables.h"
  13 #include "base/gtest_prod_util.h"
  14 #include "content/public/common/sandbox_type_mac.h"
  15
  16 class FilePath;
  17
  18 #if __OBJC__
  19 @class NSArray;
  20 @class NSString;
  21 #else
  22 class NSArray;
  23 class NSString;
  24 #endif
  25
  26 namespace sandbox {
  27
  28 // Class representing a substring of the sandbox profile tagged with its type.
  29 class SandboxSubstring {
  30  public:
  31   enum SandboxSubstringType {
  32     PLAIN,    // Just a plain string, no escaping necessary.
  33     LITERAL,  // Escape for use in (literal ...) expression.
  34     REGEX,    // Escape for use in (regex ...) expression.
  35   };
  36
  37   SandboxSubstring() {}
  38
  39   explicit SandboxSubstring(const std::string& value)
  40       : value_(value),
  41         type_(PLAIN) {}
  42
  43   SandboxSubstring(const std::string& value, SandboxSubstringType type)
  44       : value_(value),
  45         type_(type) {}
  46
  47   const std::string& value() { return value_; }
  48   SandboxSubstringType type() { return type_; }
  49
  50  private:
  51   std::string value_;
  52   SandboxSubstringType type_;
  53 };
  54
  55 class Sandbox {
  56  public:
  57   // A map of variable name -> string to substitute in its place.
  58   typedef base::hash_map<std::string, SandboxSubstring>
  59       SandboxVariableSubstitions;
  60
  61   // Warm up System APIs that empirically need to be accessed before the
  62   // sandbox is turned on. |sandbox_type| is the type of sandbox to warm up.
  63   // Valid |sandbox_type| values are defined by the enum SandboxType, or can be
  64   // defined by the embedder via
  65   // ContentClient::GetSandboxProfileForProcessType().
  66   static void SandboxWarmup(int sandbox_type);
  67
  68   // Turns on the OS X sandbox for this process.
  69   // |sandbox_type| - type of Sandbox to use. See SandboxWarmup() for legal
  70   // values.
  71   // |allowed_dir| - directory to allow access to, currently the only sandbox
  72   // profile that supports this is SANDBOX_TYPE_UTILITY .
  73   //
  74   // Returns true on success, false if an error occurred enabling the sandbox.
  75   static bool EnableSandbox(int sandbox_type,
  76                             const FilePath& allowed_dir);
  77
  78
  79   // Exposed for testing purposes, used by an accessory function of our tests
  80   // so we can't use FRIEND_TEST.
  81
  82   // Build the Sandbox command necessary to allow access to a named directory
  83   // indicated by |allowed_dir|.
  84   // Returns a string containing the sandbox profile commands necessary to allow
  85   // access to that directory or nil if an error occured.
  86
  87   // The header comment for PostProcessSandboxProfile() explains how variable
  88   // substition works in sandbox templates.
  89   // The returned string contains embedded variables. The function fills in
  90   // |substitutions| to contain the values for these variables.
  91   static NSString* BuildAllowDirectoryAccessSandboxString(
  92                        const FilePath& allowed_dir,
  93                        SandboxVariableSubstitions* substitutions);
  94
  95   // Assemble the final sandbox profile from a template by removing comments
  96   // and substituting variables.
  97   //
  98   // |sandbox_template| is a string which contains 2 entitites to operate on:
  99   //
 100   // - Comments - The sandbox comment syntax is used to make the OS sandbox
 101   // optionally ignore commands it doesn't support. e.g.
 102   // ;10.6_ONLY (foo)
 103   // Where (foo) is some command that is only supported on OS X 10.6.
 104   // The ;10.6_ONLY comment can then be removed from the template to enable
 105   // (foo) as appropriate.
 106   //
 107   // - Variables - denoted by @variable_name@ .  These are defined in the
 108   // sandbox template in cases where another string needs to be substituted at
 109   // runtime. e.g. @HOMEDIR_AS_LITERAL@ is substituted at runtime for the user's
 110   // home directory escaped appropriately for a (literal ...) expression.
 111   //
 112   // |comments_to_remove| is a list of NSStrings containing the comments to
 113   // remove.
 114   // |substitutions| is a hash of "variable name" -> "string to substitute".
 115   // Where the replacement string is tagged with information on how it is to be
 116   // escaped e.g. used as part of a regex string or a literal.
 117   //
 118   // On output |final_sandbox_profile_str| contains the final sandbox profile.
 119   // Returns true on success, false otherwise.
 120   static bool PostProcessSandboxProfile(
 121                   NSString* in_sandbox_data,
 122                   NSArray* comments_to_remove,
 123                   SandboxVariableSubstitions& substitutions,
 124                   std::string *final_sandbox_profile_str);
 125
 126  private:
 127   // Escape |src_utf8| for use in a plain string variable in a sandbox
 128   // configuraton file.  On return |dst| is set to the quoted output.
 129   // Returns: true on success, false otherwise.
 130   static bool QuotePlainString(const std::string& src_utf8, std::string* dst);
 131
 132   // Escape |str_utf8| for use in a regex literal in a sandbox
 133   // configuraton file.  On return |dst| is set to the utf-8 encoded quoted
 134   // output.
 135   //
 136   // The implementation of this function is based on empirical testing of the
 137   // OS X sandbox on 10.5.8 & 10.6.2 which is undocumented and subject to
 138   // change.
 139   //
 140   // Note: If str_utf8 contains any characters < 32 || >125 then the function
 141   // fails and false is returned.
 142   //
 143   // Returns: true on success, false otherwise.
 144   static bool QuoteStringForRegex(const std::string& str_utf8,
 145                                   std::string* dst);
 146
 147   // Convert provided path into a "canonical" path matching what the Sandbox
 148   // expects i.e. one without symlinks.
 149   // This path is not necessarily unique e.g. in the face of hardlinks.
 150   static void GetCanonicalSandboxPath(FilePath* path);
 151
 152   FRIEND_TEST_ALL_PREFIXES(MacDirAccessSandboxTest, StringEscape);
 153   FRIEND_TEST_ALL_PREFIXES(MacDirAccessSandboxTest, RegexEscape);
 154   FRIEND_TEST_ALL_PREFIXES(MacDirAccessSandboxTest, DISABLED_SandboxAccess);
 155
 156   DISALLOW_IMPLICIT_CONSTRUCTORS(Sandbox);
 157 };
 158
 159 }  // namespace sandbox
 160
 161 #endif  // CONTENT_COMMON_SANDBOX_MAC_H_