| OLD | NEW |
| 1 // Copyright (c) 2010 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2011 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 // | 4 // |
| 5 // Utilities for windows process and threads stuff. | 5 // Utilities for windows process and threads stuff. |
| 6 | 6 |
| 7 #include "ceee/common/process_utils_win.h" | 7 #include "ceee/common/process_utils_win.h" |
| 8 | 8 |
| 9 #include <sddl.h> | 9 #include <sddl.h> |
| 10 | 10 |
| 11 #include "base/logging.h" | 11 #include "base/logging.h" |
| 12 #include "base/scoped_handle.h" | 12 #include "base/win/scoped_handle.h" |
| 13 #include "base/win/windows_version.h" | 13 #include "base/win/windows_version.h" |
| 14 #include "ceee/common/com_utils.h" | 14 #include "ceee/common/com_utils.h" |
| 15 | 15 |
| 16 | |
| 17 namespace process_utils_win { | 16 namespace process_utils_win { |
| 18 | 17 |
| 19 HRESULT SetThreadIntegrityLevel(HANDLE* thread, const std::wstring& level) { | 18 HRESULT SetThreadIntegrityLevel(HANDLE* thread, const std::wstring& level) { |
| 20 HANDLE temp_handle = NULL; | 19 HANDLE temp_handle = NULL; |
| 21 BOOL success = ::OpenProcessToken( | 20 BOOL success = ::OpenProcessToken( |
| 22 ::GetCurrentProcess(), MAXIMUM_ALLOWED, &temp_handle); | 21 ::GetCurrentProcess(), MAXIMUM_ALLOWED, &temp_handle); |
| 23 ScopedHandle process_token(temp_handle); | 22 base::win::ScopedHandle process_token(temp_handle); |
| 24 temp_handle = NULL; | 23 temp_handle = NULL; |
| 25 if (success) { | 24 if (success) { |
| 26 success = ::DuplicateTokenEx( | 25 success = ::DuplicateTokenEx( |
| 27 process_token, MAXIMUM_ALLOWED, NULL, SecurityImpersonation, | 26 process_token, MAXIMUM_ALLOWED, NULL, SecurityImpersonation, |
| 28 TokenImpersonation, &temp_handle); | 27 TokenImpersonation, &temp_handle); |
| 29 ScopedHandle mic_token(temp_handle); | 28 base::win::ScopedHandle mic_token(temp_handle); |
| 30 temp_handle = NULL; | 29 temp_handle = NULL; |
| 31 if (success) { | 30 if (success) { |
| 32 PSID mic_sid = NULL; | 31 PSID mic_sid = NULL; |
| 33 success = ::ConvertStringSidToSid(level.c_str(), &mic_sid); | 32 success = ::ConvertStringSidToSid(level.c_str(), &mic_sid); |
| 34 if (success) { | 33 if (success) { |
| 35 // Set Process IL to Low | 34 // Set Process IL to Low |
| 36 TOKEN_MANDATORY_LABEL tml = {0}; | 35 TOKEN_MANDATORY_LABEL tml = {0}; |
| 37 tml.Label.Attributes = SE_GROUP_INTEGRITY | SE_GROUP_INTEGRITY_ENABLED; | 36 tml.Label.Attributes = SE_GROUP_INTEGRITY | SE_GROUP_INTEGRITY_ENABLED; |
| 38 tml.Label.Sid = mic_sid; | 37 tml.Label.Sid = mic_sid; |
| 39 success = ::SetTokenInformation( | 38 success = ::SetTokenInformation( |
| (...skipping 51 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 91 // has an associated full elevation token. This seems to do the trick and I | 90 // has an associated full elevation token. This seems to do the trick and I |
| 92 // carefully checked it against the obvious alternative of checking the | 91 // carefully checked it against the obvious alternative of checking the |
| 93 // integrity level of the current process. This is what I found out: | 92 // integrity level of the current process. This is what I found out: |
| 94 // UAC off, normal start: token default, high integrity | 93 // UAC off, normal start: token default, high integrity |
| 95 // UAC off, admin start: token default, high integrity | 94 // UAC off, admin start: token default, high integrity |
| 96 // UAC on, normal start: token limited, medium integrity | 95 // UAC on, normal start: token limited, medium integrity |
| 97 // UAC on, admin start: token full, medium integrity | 96 // UAC on, admin start: token full, medium integrity |
| 98 // All that for an admin-group member, who can run in elevated mode. | 97 // All that for an admin-group member, who can run in elevated mode. |
| 99 // This logic applies to Vista/Win7. The case of earlier systems is handled | 98 // This logic applies to Vista/Win7. The case of earlier systems is handled |
| 100 // at the start. | 99 // at the start. |
| 101 ScopedHandle process_token(temp_handle); | 100 base::win::ScopedHandle process_token(temp_handle); |
| 102 TOKEN_ELEVATION_TYPE elevation_type = TokenElevationTypeDefault; | 101 TOKEN_ELEVATION_TYPE elevation_type = TokenElevationTypeDefault; |
| 103 DWORD variable_len_dummy = 0; | 102 DWORD variable_len_dummy = 0; |
| 104 if (!::GetTokenInformation(process_token, TokenElevationType, &elevation_type, | 103 if (!::GetTokenInformation(process_token, TokenElevationType, &elevation_type, |
| 105 sizeof(elevation_type), &variable_len_dummy)) { | 104 sizeof(elevation_type), &variable_len_dummy)) { |
| 106 DWORD error_code = ::GetLastError(); | 105 DWORD error_code = ::GetLastError(); |
| 107 LOG(WARNING) << "Failed to retrieve token information." << | 106 LOG(WARNING) << "Failed to retrieve token information." << |
| 108 com::LogWe(error_code); | 107 com::LogWe(error_code); |
| 109 return com::AlwaysErrorFromWin32(error_code); | 108 return com::AlwaysErrorFromWin32(error_code); |
| 110 } | 109 } |
| 111 | 110 |
| (...skipping 212 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 324 is_wow64_process_func_ = is_wow64_process_func; | 323 is_wow64_process_func_ = is_wow64_process_func; |
| 325 DCHECK(open_process_func_ != NULL && close_handle_func_ != NULL && | 324 DCHECK(open_process_func_ != NULL && close_handle_func_ != NULL && |
| 326 is_wow64_process_func_ != NULL); | 325 is_wow64_process_func_ != NULL); |
| 327 } | 326 } |
| 328 | 327 |
| 329 void ProcessCompatibilityCheck::ResetState() { | 328 void ProcessCompatibilityCheck::ResetState() { |
| 330 PatchState(OpenProcess, CloseHandle, IsWow64Process); | 329 PatchState(OpenProcess, CloseHandle, IsWow64Process); |
| 331 GetInstance()->StandardInitialize(); | 330 GetInstance()->StandardInitialize(); |
| 332 } | 331 } |
| 333 | 332 |
| 334 } // namespace com | 333 } // namespace process_utils_win |
| OLD | NEW |