OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "content/common/sandbox_win.h" | 5 #include "content/common/sandbox_win.h" |
6 | 6 |
7 #include <string> | 7 #include <string> |
8 | 8 |
9 #include "base/base_switches.h" | 9 #include "base/base_switches.h" |
10 #include "base/command_line.h" | 10 #include "base/command_line.h" |
(...skipping 199 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
210 | 210 |
211 // Adds policy rules for unloaded the known dlls that cause chrome to crash. | 211 // Adds policy rules for unloaded the known dlls that cause chrome to crash. |
212 // Eviction of injected DLLs is done by the sandbox so that the injected module | 212 // Eviction of injected DLLs is done by the sandbox so that the injected module |
213 // does not get a chance to execute any code. | 213 // does not get a chance to execute any code. |
214 void AddGenericDllEvictionPolicy(sandbox::TargetPolicy* policy) { | 214 void AddGenericDllEvictionPolicy(sandbox::TargetPolicy* policy) { |
215 for (int ix = 0; ix != arraysize(kTroublesomeDlls); ++ix) | 215 for (int ix = 0; ix != arraysize(kTroublesomeDlls); ++ix) |
216 BlacklistAddOneDll(kTroublesomeDlls[ix], true, policy); | 216 BlacklistAddOneDll(kTroublesomeDlls[ix], true, policy); |
217 } | 217 } |
218 | 218 |
219 // Returns the object path prepended with the current logon session. | 219 // Returns the object path prepended with the current logon session. |
220 string16 PrependWindowsSessionPath(const char16* object) { | 220 base::string16 PrependWindowsSessionPath(const char16* object) { |
221 // Cache this because it can't change after process creation. | 221 // Cache this because it can't change after process creation. |
222 static uintptr_t s_session_id = 0; | 222 static uintptr_t s_session_id = 0; |
223 if (s_session_id == 0) { | 223 if (s_session_id == 0) { |
224 HANDLE token; | 224 HANDLE token; |
225 DWORD session_id_length; | 225 DWORD session_id_length; |
226 DWORD session_id = 0; | 226 DWORD session_id = 0; |
227 | 227 |
228 CHECK(::OpenProcessToken(::GetCurrentProcess(), TOKEN_QUERY, &token)); | 228 CHECK(::OpenProcessToken(::GetCurrentProcess(), TOKEN_QUERY, &token)); |
229 CHECK(::GetTokenInformation(token, TokenSessionId, &session_id, | 229 CHECK(::GetTokenInformation(token, TokenSessionId, &session_id, |
230 sizeof(session_id), &session_id_length)); | 230 sizeof(session_id), &session_id_length)); |
(...skipping 276 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
507 if (ShouldSetJobLevel(cmd_line)) | 507 if (ShouldSetJobLevel(cmd_line)) |
508 policy->SetJobLevel(job_level, ui_exceptions); | 508 policy->SetJobLevel(job_level, ui_exceptions); |
509 else | 509 else |
510 policy->SetJobLevel(sandbox::JOB_NONE, 0); | 510 policy->SetJobLevel(sandbox::JOB_NONE, 0); |
511 } | 511 } |
512 | 512 |
513 // TODO(jschuh): Need get these restrictions applied to NaCl and Pepper. | 513 // TODO(jschuh): Need get these restrictions applied to NaCl and Pepper. |
514 // Just have to figure out what needs to be warmed up first. | 514 // Just have to figure out what needs to be warmed up first. |
515 void AddBaseHandleClosePolicy(sandbox::TargetPolicy* policy) { | 515 void AddBaseHandleClosePolicy(sandbox::TargetPolicy* policy) { |
516 // TODO(cpu): Add back the BaseNamedObjects policy. | 516 // TODO(cpu): Add back the BaseNamedObjects policy. |
517 string16 object_path = PrependWindowsSessionPath( | 517 base::string16 object_path = PrependWindowsSessionPath( |
518 L"\\BaseNamedObjects\\windows_shell_global_counters"); | 518 L"\\BaseNamedObjects\\windows_shell_global_counters"); |
519 policy->AddKernelObjectToClose(L"Section", object_path.data()); | 519 policy->AddKernelObjectToClose(L"Section", object_path.data()); |
520 } | 520 } |
521 | 521 |
522 bool InitBrokerServices(sandbox::BrokerServices* broker_services) { | 522 bool InitBrokerServices(sandbox::BrokerServices* broker_services) { |
523 // TODO(abarth): DCHECK(CalledOnValidThread()); | 523 // TODO(abarth): DCHECK(CalledOnValidThread()); |
524 // See <http://b/1287166>. | 524 // See <http://b/1287166>. |
525 DCHECK(broker_services); | 525 DCHECK(broker_services); |
526 DCHECK(!g_broker_services); | 526 DCHECK(!g_broker_services); |
527 sandbox::ResultCode result = broker_services->Init(); | 527 sandbox::ResultCode result = broker_services->Init(); |
(...skipping 208 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
736 } | 736 } |
737 | 737 |
738 return false; | 738 return false; |
739 } | 739 } |
740 | 740 |
741 bool BrokerAddTargetPeer(HANDLE peer_process) { | 741 bool BrokerAddTargetPeer(HANDLE peer_process) { |
742 return g_broker_services->AddTargetPeer(peer_process) == sandbox::SBOX_ALL_OK; | 742 return g_broker_services->AddTargetPeer(peer_process) == sandbox::SBOX_ALL_OK; |
743 } | 743 } |
744 | 744 |
745 } // namespace content | 745 } // namespace content |
OLD | NEW |