| commit | 7be3380683ff0155884d13db23e37dd0172aaf9f | [log] [tgz] |
|---|---|---|
| author | James Forshaw <forshaw@chromium.org> | Wed Jul 10 22:40:16 2024 |
| committer | Copybara-Service <copybara-worker@google.com> | Wed Jul 10 22:46:52 2024 |
| tree | 92213d7799713bf7c24e126b8528380e792c8ba4 | |
| parent | dd19d700b82f4ab022f20af41a61ca5b2793e4ad [diff] |
[Windows] Disable AppContainer Sandbox Tests on ARM64. This CL disables some AppContainer sandbox tests on ARM64 which are flakey due to the testing configuration. Long term the code to create the profiles which is failing will be replaced, however until that code is enabled by default the tests are disabled as a short term solution. Bug: 352295101 Change-Id: I097014b3f1c2caba634762579d3e0b418f785915 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5692518 Reviewed-by: Alex Gough <ajgo@chromium.org> Commit-Queue: James Forshaw <forshaw@chromium.org> Cr-Commit-Position: refs/heads/main@{#1325789} NOKEYCHECK=True GitOrigin-RevId: ca398fc02ff0ac55df2c65ee50a762e06e60a3d6
This directory contains platform-specific sandboxing libraries. Sandboxing is a technique that can improve the security of an application by separating untrustworthy code (or code that handles untrustworthy data) and restricting its privileges and capabilities.
Each platform relies on the operating system's process primitive to isolate code into distinct security principals, and platform-specific technologies are used to implement the privilege reduction. At a high-level:
mac/ uses the Seatbelt sandbox. See the detailed design for more.linux/ uses namespaces and Seccomp-BPF. See the detailed design for more.win/ uses a combination of restricted tokens, distinct job objects, alternate desktops, and integrity levels. See the detailed design for more.Built on top of the low-level sandboxing library is the //sandbox/policy component, which provides concrete policies and helper utilities for sandboxing specific Chromium processes and services. The core sandbox library cannot depend on the policy component.