Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(452)

Side by Side Diff: sandbox/src/restricted_token_utils.cc

Issue 6126002: Remove base/scoped_handle_win.h stub and fix up all callers to use the new location and namespace. (Closed) Base URL: svn://svn.chromium.org/chrome/trunk/src
Patch Set: review Created 9 years, 11 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch | Annotate | Revision Log
OLDNEW
1 // Copyright (c) 2010 The Chromium Authors. All rights reserved. 1 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be 2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file. 3 // found in the LICENSE file.
4 4
5 #include <aclapi.h> 5 #include <aclapi.h>
6 #include <sddl.h> 6 #include <sddl.h>
7 #include <vector> 7 #include <vector>
8 8
9 #include "sandbox/src/restricted_token_utils.h" 9 #include "sandbox/src/restricted_token_utils.h"
10 10
11 #include "base/logging.h" 11 #include "base/logging.h"
12 #include "base/scoped_handle_win.h" 12 #include "base/win/scoped_handle.h"
13 #include "base/win/windows_version.h" 13 #include "base/win/windows_version.h"
14 #include "sandbox/src/job.h" 14 #include "sandbox/src/job.h"
15 #include "sandbox/src/restricted_token.h" 15 #include "sandbox/src/restricted_token.h"
16 #include "sandbox/src/security_level.h" 16 #include "sandbox/src/security_level.h"
17 #include "sandbox/src/sid.h" 17 #include "sandbox/src/sid.h"
18 18
19 namespace sandbox { 19 namespace sandbox {
20 20
21 DWORD CreateRestrictedToken(HANDLE *token_handle, 21 DWORD CreateRestrictedToken(HANDLE *token_handle,
22 TokenLevel security_level, 22 TokenLevel security_level,
(...skipping 136 matching lines...) Expand 10 before | Expand all | Expand 10 after
159 159
160 // Create the primary (restricted) token for the process 160 // Create the primary (restricted) token for the process
161 HANDLE primary_token_handle = NULL; 161 HANDLE primary_token_handle = NULL;
162 err_code = CreateRestrictedToken(&primary_token_handle, 162 err_code = CreateRestrictedToken(&primary_token_handle,
163 primary_level, 163 primary_level,
164 INTEGRITY_LEVEL_LAST, 164 INTEGRITY_LEVEL_LAST,
165 PRIMARY); 165 PRIMARY);
166 if (ERROR_SUCCESS != err_code) { 166 if (ERROR_SUCCESS != err_code) {
167 return err_code; 167 return err_code;
168 } 168 }
169 ScopedHandle primary_token(primary_token_handle); 169 base::win::ScopedHandle primary_token(primary_token_handle);
170 170
171 // Create the impersonation token (restricted) to be able to start the 171 // Create the impersonation token (restricted) to be able to start the
172 // process. 172 // process.
173 HANDLE impersonation_token_handle; 173 HANDLE impersonation_token_handle;
174 err_code = CreateRestrictedToken(&impersonation_token_handle, 174 err_code = CreateRestrictedToken(&impersonation_token_handle,
175 impersonation_level, 175 impersonation_level,
176 INTEGRITY_LEVEL_LAST, 176 INTEGRITY_LEVEL_LAST,
177 IMPERSONATION); 177 IMPERSONATION);
178 if (ERROR_SUCCESS != err_code) { 178 if (ERROR_SUCCESS != err_code) {
179 return err_code; 179 return err_code;
180 } 180 }
181 ScopedHandle impersonation_token(impersonation_token_handle); 181 base::win::ScopedHandle impersonation_token(impersonation_token_handle);
182 182
183 // Start the process 183 // Start the process
184 STARTUPINFO startup_info = {0}; 184 STARTUPINFO startup_info = {0};
185 PROCESS_INFORMATION process_info = {0}; 185 PROCESS_INFORMATION process_info = {0};
186 186
187 if (!::CreateProcessAsUser(primary_token.Get(), 187 if (!::CreateProcessAsUser(primary_token.Get(),
188 NULL, // No application name. 188 NULL, // No application name.
189 command_line, 189 command_line,
190 NULL, // No security attribute. 190 NULL, // No security attribute.
191 NULL, // No thread attribute. 191 NULL, // No thread attribute.
192 FALSE, // Do not inherit handles. 192 FALSE, // Do not inherit handles.
193 CREATE_SUSPENDED | CREATE_BREAKAWAY_FROM_JOB, 193 CREATE_SUSPENDED | CREATE_BREAKAWAY_FROM_JOB,
194 NULL, // Use the environment of the caller. 194 NULL, // Use the environment of the caller.
195 NULL, // Use current directory of the caller. 195 NULL, // Use current directory of the caller.
196 &startup_info, 196 &startup_info,
197 &process_info)) { 197 &process_info)) {
198 return ::GetLastError(); 198 return ::GetLastError();
199 } 199 }
200 200
201 ScopedHandle thread_handle(process_info.hThread); 201 base::win::ScopedHandle thread_handle(process_info.hThread);
202 ScopedHandle process_handle(process_info.hProcess); 202 base::win::ScopedHandle process_handle(process_info.hProcess);
203 203
204 // Change the token of the main thread of the new process for the 204 // Change the token of the main thread of the new process for the
205 // impersonation token with more rights. 205 // impersonation token with more rights.
206 if (!::SetThreadToken(&process_info.hThread, impersonation_token.Get())) { 206 if (!::SetThreadToken(&process_info.hThread, impersonation_token.Get())) {
207 ::TerminateProcess(process_handle.Get(), 207 ::TerminateProcess(process_handle.Get(),
208 0); // exit code 208 0); // exit code
209 return ::GetLastError(); 209 return ::GetLastError();
210 } 210 }
211 211
212 err_code = job.AssignProcessToJob(process_handle.Get()); 212 err_code = job.AssignProcessToJob(process_handle.Get());
(...skipping 115 matching lines...) Expand 10 before | Expand all | Expand 10 after
328 ace_access.c_str(), 328 ace_access.c_str(),
329 integrity_level_str); 329 integrity_level_str);
330 if (ERROR_SUCCESS != error) 330 if (ERROR_SUCCESS != error)
331 return error; 331 return error;
332 332
333 HANDLE token_handle; 333 HANDLE token_handle;
334 if (!::OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_DEFAULT, 334 if (!::OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_DEFAULT,
335 &token_handle)) 335 &token_handle))
336 return ::GetLastError(); 336 return ::GetLastError();
337 337
338 ScopedHandle token(token_handle); 338 base::win::ScopedHandle token(token_handle);
339 339
340 return SetTokenIntegrityLevel(token.Get(), integrity_level); 340 return SetTokenIntegrityLevel(token.Get(), integrity_level);
341 } 341 }
342 342
343
344 } // namespace sandbox 343 } // namespace sandbox
OLDNEW

Powered by Google App Engine
This is Rietveld 408576698