| // Copyright 2017 The Chromium Authors. All rights reserved. |
| // Use of this source code is governed by a BSD-style license that can be |
| // found in the LICENSE file. |
| |
| #include "sandbox/policy/features.h" |
| |
| #include "build/build_config.h" |
| #include "build/chromeos_buildflags.h" |
| #include "sandbox/features.h" |
| |
| namespace sandbox::policy::features { |
| |
| #if !BUILDFLAG(IS_MAC) && !BUILDFLAG(IS_FUCHSIA) |
| // Enables network service sandbox. |
| // (Only causes an effect when feature kNetworkService is enabled.) |
| const base::Feature kNetworkServiceSandbox{"NetworkServiceSandbox", |
| base::FEATURE_DISABLED_BY_DEFAULT}; |
| #endif // !BUILDFLAG(IS_MAC) && !BUILDFLAG(IS_FUCHSIA) |
| |
| #if BUILDFLAG(IS_WIN) |
| // Emergency "off switch" for new Windows KTM security mitigation, |
| // sandbox::MITIGATION_KTM_COMPONENT. |
| const base::Feature kWinSboxDisableKtmComponent{ |
| "WinSboxDisableKtmComponent", base::FEATURE_ENABLED_BY_DEFAULT}; |
| |
| // Experiment for Windows sandbox security mitigation, |
| // sandbox::MITIGATION_EXTENSION_POINT_DISABLE. |
| const base::Feature kWinSboxDisableExtensionPoints{ |
| "WinSboxDisableExtensionPoint", base::FEATURE_DISABLED_BY_DEFAULT}; |
| |
| // Enables GPU AppContainer sandbox on Windows. |
| const base::Feature kGpuAppContainer{"GpuAppContainer", |
| base::FEATURE_DISABLED_BY_DEFAULT}; |
| |
| // Enables GPU Low Privilege AppContainer when combined with kGpuAppContainer. |
| const base::Feature kGpuLPAC{"GpuLPAC", base::FEATURE_ENABLED_BY_DEFAULT}; |
| |
| // Enables Renderer AppContainer |
| const base::Feature kRendererAppContainer{"RendererAppContainer", |
| base::FEATURE_DISABLED_BY_DEFAULT}; |
| |
| #endif // BUILDFLAG(IS_WIN) |
| |
| #if !BUILDFLAG(IS_ANDROID) |
| // Controls whether the isolated XR service is sandboxed. |
| const base::Feature kXRSandbox{"XRSandbox", base::FEATURE_ENABLED_BY_DEFAULT}; |
| #endif // !BUILDFLAG(IS_ANDROID) |
| |
| #if BUILDFLAG(IS_CHROMEOS_ASH) |
| // Controls whether the Spectre variant 2 mitigation is enabled. We use a USE |
| // flag on some Chrome OS boards to disable the mitigation by disabling this |
| // feature in exchange for system performance. |
| const base::Feature kSpectreVariant2Mitigation{ |
| "SpectreVariant2Mitigation", base::FEATURE_ENABLED_BY_DEFAULT}; |
| |
| // An override for the Spectre variant 2 default behavior. Security sensitive |
| // users can enable this feature to ensure that the mitigation is always |
| // enabled. |
| const base::Feature kForceSpectreVariant2Mitigation{ |
| "ForceSpectreVariant2Mitigation", base::FEATURE_DISABLED_BY_DEFAULT}; |
| #endif // BUILDFLAG(IS_CHROMEOS_ASH) |
| |
| bool IsNetworkSandboxEnabled() { |
| #if BUILDFLAG(IS_MAC) || BUILDFLAG(IS_FUCHSIA) |
| return true; |
| #else |
| #if BUILDFLAG(IS_WIN) |
| if (!sandbox::features::IsAppContainerSandboxSupported()) |
| return false; |
| #endif // BUILDFLAG(IS_WIN) |
| // Check feature status. |
| return base::FeatureList::IsEnabled(kNetworkServiceSandbox); |
| #endif // BUILDFLAG(IS_MAC) || BUILDFLAG(IS_FUCHSIA) |
| } |
| |
| } // namespace sandbox::policy::features |