OLD | NEW |
1 // Copyright (c) 2010 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2011 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 // | 4 // |
5 // Utilities for windows process and threads stuff. | 5 // Utilities for windows process and threads stuff. |
6 | 6 |
7 #include "ceee/common/process_utils_win.h" | 7 #include "ceee/common/process_utils_win.h" |
8 | 8 |
9 #include <sddl.h> | 9 #include <sddl.h> |
10 | 10 |
11 #include "base/logging.h" | 11 #include "base/logging.h" |
12 #include "base/scoped_handle.h" | 12 #include "base/win/scoped_handle.h" |
13 #include "base/win/windows_version.h" | 13 #include "base/win/windows_version.h" |
14 #include "ceee/common/com_utils.h" | 14 #include "ceee/common/com_utils.h" |
15 | 15 |
16 | |
17 namespace process_utils_win { | 16 namespace process_utils_win { |
18 | 17 |
19 HRESULT SetThreadIntegrityLevel(HANDLE* thread, const std::wstring& level) { | 18 HRESULT SetThreadIntegrityLevel(HANDLE* thread, const std::wstring& level) { |
20 HANDLE temp_handle = NULL; | 19 HANDLE temp_handle = NULL; |
21 BOOL success = ::OpenProcessToken( | 20 BOOL success = ::OpenProcessToken( |
22 ::GetCurrentProcess(), MAXIMUM_ALLOWED, &temp_handle); | 21 ::GetCurrentProcess(), MAXIMUM_ALLOWED, &temp_handle); |
23 ScopedHandle process_token(temp_handle); | 22 base::win::ScopedHandle process_token(temp_handle); |
24 temp_handle = NULL; | 23 temp_handle = NULL; |
25 if (success) { | 24 if (success) { |
26 success = ::DuplicateTokenEx( | 25 success = ::DuplicateTokenEx( |
27 process_token, MAXIMUM_ALLOWED, NULL, SecurityImpersonation, | 26 process_token, MAXIMUM_ALLOWED, NULL, SecurityImpersonation, |
28 TokenImpersonation, &temp_handle); | 27 TokenImpersonation, &temp_handle); |
29 ScopedHandle mic_token(temp_handle); | 28 base::win::ScopedHandle mic_token(temp_handle); |
30 temp_handle = NULL; | 29 temp_handle = NULL; |
31 if (success) { | 30 if (success) { |
32 PSID mic_sid = NULL; | 31 PSID mic_sid = NULL; |
33 success = ::ConvertStringSidToSid(level.c_str(), &mic_sid); | 32 success = ::ConvertStringSidToSid(level.c_str(), &mic_sid); |
34 if (success) { | 33 if (success) { |
35 // Set Process IL to Low | 34 // Set Process IL to Low |
36 TOKEN_MANDATORY_LABEL tml = {0}; | 35 TOKEN_MANDATORY_LABEL tml = {0}; |
37 tml.Label.Attributes = SE_GROUP_INTEGRITY | SE_GROUP_INTEGRITY_ENABLED; | 36 tml.Label.Attributes = SE_GROUP_INTEGRITY | SE_GROUP_INTEGRITY_ENABLED; |
38 tml.Label.Sid = mic_sid; | 37 tml.Label.Sid = mic_sid; |
39 success = ::SetTokenInformation( | 38 success = ::SetTokenInformation( |
(...skipping 51 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
91 // has an associated full elevation token. This seems to do the trick and I | 90 // has an associated full elevation token. This seems to do the trick and I |
92 // carefully checked it against the obvious alternative of checking the | 91 // carefully checked it against the obvious alternative of checking the |
93 // integrity level of the current process. This is what I found out: | 92 // integrity level of the current process. This is what I found out: |
94 // UAC off, normal start: token default, high integrity | 93 // UAC off, normal start: token default, high integrity |
95 // UAC off, admin start: token default, high integrity | 94 // UAC off, admin start: token default, high integrity |
96 // UAC on, normal start: token limited, medium integrity | 95 // UAC on, normal start: token limited, medium integrity |
97 // UAC on, admin start: token full, medium integrity | 96 // UAC on, admin start: token full, medium integrity |
98 // All that for an admin-group member, who can run in elevated mode. | 97 // All that for an admin-group member, who can run in elevated mode. |
99 // This logic applies to Vista/Win7. The case of earlier systems is handled | 98 // This logic applies to Vista/Win7. The case of earlier systems is handled |
100 // at the start. | 99 // at the start. |
101 ScopedHandle process_token(temp_handle); | 100 base::win::ScopedHandle process_token(temp_handle); |
102 TOKEN_ELEVATION_TYPE elevation_type = TokenElevationTypeDefault; | 101 TOKEN_ELEVATION_TYPE elevation_type = TokenElevationTypeDefault; |
103 DWORD variable_len_dummy = 0; | 102 DWORD variable_len_dummy = 0; |
104 if (!::GetTokenInformation(process_token, TokenElevationType, &elevation_type, | 103 if (!::GetTokenInformation(process_token, TokenElevationType, &elevation_type, |
105 sizeof(elevation_type), &variable_len_dummy)) { | 104 sizeof(elevation_type), &variable_len_dummy)) { |
106 DWORD error_code = ::GetLastError(); | 105 DWORD error_code = ::GetLastError(); |
107 LOG(WARNING) << "Failed to retrieve token information." << | 106 LOG(WARNING) << "Failed to retrieve token information." << |
108 com::LogWe(error_code); | 107 com::LogWe(error_code); |
109 return com::AlwaysErrorFromWin32(error_code); | 108 return com::AlwaysErrorFromWin32(error_code); |
110 } | 109 } |
111 | 110 |
(...skipping 212 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
324 is_wow64_process_func_ = is_wow64_process_func; | 323 is_wow64_process_func_ = is_wow64_process_func; |
325 DCHECK(open_process_func_ != NULL && close_handle_func_ != NULL && | 324 DCHECK(open_process_func_ != NULL && close_handle_func_ != NULL && |
326 is_wow64_process_func_ != NULL); | 325 is_wow64_process_func_ != NULL); |
327 } | 326 } |
328 | 327 |
329 void ProcessCompatibilityCheck::ResetState() { | 328 void ProcessCompatibilityCheck::ResetState() { |
330 PatchState(OpenProcess, CloseHandle, IsWow64Process); | 329 PatchState(OpenProcess, CloseHandle, IsWow64Process); |
331 GetInstance()->StandardInitialize(); | 330 GetInstance()->StandardInitialize(); |
332 } | 331 } |
333 | 332 |
334 } // namespace com | 333 } // namespace process_utils_win |
OLD | NEW |