SandboxOpenedFiles.h

Enable keyboard shortcuts

/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */

/* vim: set ts=8 sts=2 et sw=2 tw=80: */

/* This Source Code Form is subject to the terms of the Mozilla Public

 * License, v. 2.0. If a copy of the MPL was not distributed with this file,

 * You can obtain one at http://mozilla.org/MPL/2.0/. */

#ifndef mozilla_SandboxOpenedFiles_h

#define mozilla_SandboxOpenedFiles_h

#include "mozilla/Atomics.h"

#include "mozilla/Range.h"

#include "mozilla/UniquePtr.h"

#include <vector>

#include <string>

// The use of C++ standard library containers here should be safe; the

// standard (section container.requirements.dataraces) requires that

// using const methods/pointers not introduce data races (e.g., from

// interior mutability or global state).

//

// Reentrancy isn't guaranteed, and the library could use async signal

// unsafe mutexes for "read-only" operations, but I'm assuming that that's

// not the case at least for simple containers like string and vector.

namespace mozilla {

// This class represents a file that's been pre-opened for a media

// plugin.  It can be move-constructed but not copied.

class SandboxOpenedFile final {

 public:

  enum class Dup { NO, YES };

  struct Error {};

  // This constructor opens the named file and saves the descriptor.

  // If the open fails, IsOpen() will return false and GetDesc() will

  // quietly return -1.  If aDup is Dup::YES, GetDesc() will return a

  // dup() of the descriptor every time it's called; otherwise, the

  // first call will return the descriptor and any further calls will

  // log an error message and return -1.

  explicit SandboxOpenedFile(const char* aPath, Dup aDup = Dup::NO);

  // This constructor is for files which the process will try to open

  // but we don't want to grant access: using it will always fail

  // (GetDesc will return -1) without logging.

  SandboxOpenedFile(const char* aPath, Error);

  // Simulates opening the pre-opened file; see the constructor's

  // comment for details.  Does not set errno on error, but may modify

  // it as a side-effect.  Thread-safe and intended to be async signal safe.

  int GetDesc() const;

  const char* Path() const { return mPath.c_str(); }

  bool IsOpen() const { return mMaybeFd >= 0; }

  ~SandboxOpenedFile();

  MOZ_IMPLICIT SandboxOpenedFile(SandboxOpenedFile&& aMoved);

 private:

  std::string mPath;

  mutable Atomic<int> mMaybeFd;

  bool mDup;

  bool mExpectError;

  int TakeDesc() const { return mMaybeFd.exchange(-1); }

};

// This class represents a collection of files to be used to handle

// open() calls from the media plugin (and the dynamic loader).

// Because the seccomp-bpf policy exists until the process exits, this

// object must not be destroyed after the syscall filter is installed.

class SandboxOpenedFiles {

 public:

  SandboxOpenedFiles() = default;

  template <typename... Args>

  void Add(Args&&... aArgs) {

    mFiles.emplace_back(std::forward<Args>(aArgs)...);

  int GetDesc(const char* aPath) const;

 private:

  std::vector<SandboxOpenedFile> mFiles;

  // We could allow destroying instances of this class that aren't

  // used with seccomp-bpf (e.g., for unit testing) by having the

  // destructor check a flag set by the syscall policy and crash,

  // but let's not write that code until we actually need it.

  ~SandboxOpenedFiles() = delete;

};

}  // namespace mozilla

#endif  // mozilla_SandboxOpenedFiles_h