| commit | 56f4c5ada210b5f94650efcf048751a1b0850b97 | [log] [tgz] |
|---|---|---|
| author | kylechar <kylechar@chromium.org> | Mon Dec 20 21:39:43 2021 |
| committer | Copybara-Service <copybara-worker@google.com> | Mon Dec 20 21:54:49 2021 |
| tree | 9b657472d412328bbc084a5f9b1df472e3a19ed9 | |
| parent | a01b9564500797c27b316fe5b5c120d001ad9a2d [diff] |
Remove Linux.ProxyLocaltimeCallToBrowserUs UMA Stop logging the histogram as it's expired. Fixed: 1230691 Change-Id: Ia68fbe6704a3a6fd965a08d8ddc271cfc42da159 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3350535 Reviewed-by: Robert Sesek <rsesek@chromium.org> Commit-Queue: Kyle Charbonneau <kylechar@chromium.org> Cr-Commit-Position: refs/heads/main@{#953034} NOKEYCHECK=True GitOrigin-RevId: d2371aa6c3b19ebe447d47a3f649ba62a33a2905
This directory contains platform-specific sandboxing libraries. Sandboxing is a technique that can improve the security of an application by separating untrustworthy code (or code that handles untrustworthy data) and restricting its privileges and capabilities.
Each platform relies on the operating system's process primitive to isolate code into distinct security principals, and platform-specific technologies are used to implement the privilege reduction. At a high-level:
mac/ uses the Seatbelt sandbox. See the detailed design for more.linux/ uses namespaces and Seccomp-BPF. See the detailed design for more.win/ uses a combination of restricted tokens, distinct job objects, alternate desktops, and integrity levels. See the detailed design for more.Built on top of the low-level sandboxing library is the //sandbox/policy component, which provides concrete policies and helper utilities for sandboxing specific Chromium processes and services. The core sandbox library cannot depend on the policy component.