1 // Copyright 2019 Google LLC 2 // 3 // Licensed under the Apache License, Version 2.0 (the "License"); 4 // you may not use this file except in compliance with the License. 5 // You may obtain a copy of the License at 6 // 7 // https://www.apache.org/licenses/LICENSE-2.0 8 // 9 // Unless required by applicable law or agreed to in writing, software 10 // distributed under the License is distributed on an "AS IS" BASIS, 11 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 12 // See the License for the specific language governing permissions and 13 // limitations under the License. 14 15 // The sandbox2::IPC class provides routines for exchanging data between sandbox 16 // and the sandboxee. 17 18 #ifndef SANDBOXED_API_SANDBOX2_IPC_H_ 19 #define SANDBOXED_API_SANDBOX2_IPC_H_ 20 21 #include <memory> 22 #include <string> 23 #include <tuple> 24 #include <vector> 25 26 #include "absl/base/attributes.h" 27 #include "absl/strings/string_view.h" 28 #include "sandboxed_api/sandbox2/comms.h" 29 30 namespace sandbox2 { 31 32 class IPC final { 33 public: 34 IPC() = default; 35 36 IPC(const IPC&) = delete; 37 IPC& operator=(const IPC&) = delete; 38 ~IPC()39 ~IPC() { InternalCleanupFdMap(); } 40 41 ABSL_DEPRECATED("Use Sandbox2::comms() instead") comms()42 Comms* comms() const { return comms_.get(); } 43 44 // Marks local_fd so that it should be sent to the remote process (sandboxee), 45 // and duplicated onto remote_fd in it. The local_fd will be closed after 46 // being sent (in SendFdsOverComms() which is called by the Monitor class when 47 // Sandbox2::RunAsync() is called), so local_fd should not be used from that 48 // point on. The application must not close local_fd after calling MapFd(). 49 void MapFd(int local_fd, int remote_fd); 50 51 // Similar to MapFd(), except local_fd remains available for use in the 52 // application even after Sandbox2::RunAsync() is called; the application 53 // retains responsibility for closing local_fd and may do so at any time after 54 // calling MapDupedFd(). 55 void MapDupedFd(int local_fd, int remote_fd); 56 57 // Creates and returns a socketpair endpoint. The other endpoint of the 58 // socketpair is marked as to be sent to the remote process (sandboxee) with 59 // SendFdsOverComms() as with MapFd(). 60 // If a name is specified, uses the Client::GetMappedFD api to retrieve the 61 // corresponding file descriptor in the sandboxee. 62 int ReceiveFd(int remote_fd, absl::string_view name); 63 int ReceiveFd(int remote_fd); 64 int ReceiveFd(absl::string_view name); 65 66 // Enable sandboxee logging, this will start a thread that waits for log 67 // messages from the sandboxee. You'll also have to call 68 // Client::SendLogsToSupervisor in the sandboxee. 69 void EnableLogServer(); 70 71 private: 72 friend class Executor; 73 friend class MonitorBase; 74 friend class IpcPeer; // For testing 75 76 // Uses a pre-connected file descriptor. 77 void SetUpServerSideComms(int fd); 78 79 // Sends file descriptors to the sandboxee. Close the local FDs (e.g. passed 80 // in MapFd()) - they cannot be used anymore. 81 bool SendFdsOverComms(); 82 83 void InternalCleanupFdMap(); 84 85 // Tuple of file descriptor pairs which will be sent to the sandboxee: in the 86 // form of tuple<local_fd, remote_fd, name>: 87 // local_fd: local fd which should be sent to sandboxee 88 // remote_fd: it will be overwritten by local_fd. 89 std::vector<std::tuple<int, int, std::string>> fd_map_; 90 91 // Comms channel used to exchange data with the sandboxee. 92 std::unique_ptr<Comms> comms_; 93 }; 94 95 } // namespace sandbox2 96 97 #endif // SANDBOXED_API_SANDBOX2_IPC_H_ 98