| OLD | NEW |
|---|
| (Empty) |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | |
| 2 // Use of this source code is governed by a BSD-style license that can be | |
| 3 // found in the LICENSE file. | |
| 4 | |
| 5 #ifndef SANDBOX_SRC_SANDBOX_POLICY_H_ | |
| 6 #define SANDBOX_SRC_SANDBOX_POLICY_H_ | |
| 7 | |
| 8 #include <string> | |
| 9 | |
| 10 #include "base/basictypes.h" | |
| 11 #include "sandbox/src/sandbox_types.h" | |
| 12 #include "sandbox/src/security_level.h" | |
| 13 | |
| 14 namespace sandbox { | |
| 15 | |
| 16 class TargetPolicy { | |
| 17 public: | |
| 18 // Windows subsystems that can have specific rules. | |
| 19 // Note: The process subsystem(SUBSY_PROCESS) does not evaluate the request | |
| 20 // exactly like the CreateProcess API does. See the comment at the top of | |
| 21 // process_thread_dispatcher.cc for more details. | |
| 22 enum SubSystem { | |
| 23 SUBSYS_FILES, // Creation and opening of files and pipes. | |
| 24 SUBSYS_NAMED_PIPES, // Creation of named pipes. | |
| 25 SUBSYS_PROCESS, // Creation of child processes. | |
| 26 SUBSYS_REGISTRY, // Creation and opening of registry keys. | |
| 27 SUBSYS_SYNC, // Creation of named sync objects. | |
| 28 SUBSYS_HANDLES // Duplication of handles to other processes. | |
| 29 }; | |
| 30 | |
| 31 // Allowable semantics when a rule is matched. | |
| 32 enum Semantics { | |
| 33 FILES_ALLOW_ANY, // Allows open or create for any kind of access that | |
| 34 // the file system supports. | |
| 35 FILES_ALLOW_READONLY, // Allows open or create with read access only. | |
| 36 FILES_ALLOW_QUERY, // Allows access to query the attributes of a file. | |
| 37 FILES_ALLOW_DIR_ANY, // Allows open or create with directory semantics | |
| 38 // only. | |
| 39 HANDLES_DUP_ANY, // Allows duplicating handles opened with any | |
| 40 // access permissions. | |
| 41 HANDLES_DUP_BROKER, // Allows duplicating handles to the broker process. | |
| 42 NAMEDPIPES_ALLOW_ANY, // Allows creation of a named pipe. | |
| 43 PROCESS_MIN_EXEC, // Allows to create a process with minimal rights | |
| 44 // over the resulting process and thread handles. | |
| 45 // No other parameters besides the command line are | |
| 46 // passed to the child process. | |
| 47 PROCESS_ALL_EXEC, // Allows the creation of a process and return fill | |
| 48 // access on the returned handles. | |
| 49 // This flag can be used only when the main token of | |
| 50 // the sandboxed application is at least INTERACTIVE. | |
| 51 EVENTS_ALLOW_ANY, // Allows the creation of an event with full access. | |
| 52 EVENTS_ALLOW_READONLY, // Allows opening an even with synchronize access. | |
| 53 REG_ALLOW_READONLY, // Allows readonly access to a registry key. | |
| 54 REG_ALLOW_ANY // Allows read and write access to a registry key. | |
| 55 }; | |
| 56 | |
| 57 // Increments the reference count of this object. The reference count must | |
| 58 // be incremented if this interface is given to another component. | |
| 59 virtual void AddRef() = 0; | |
| 60 | |
| 61 // Decrements the reference count of this object. When the reference count | |
| 62 // is zero the object is automatically destroyed. | |
| 63 // Indicates that the caller is done with this interface. After calling | |
| 64 // release no other method should be called. | |
| 65 virtual void Release() = 0; | |
| 66 | |
| 67 // Sets the security level for the target process' two tokens. | |
| 68 // This setting is permanent and cannot be changed once the target process is | |
| 69 // spawned. | |
| 70 // initial: the security level for the initial token. This is the token that | |
| 71 // is used by the process from the creation of the process until the moment | |
| 72 // the process calls TargetServices::LowerToken() or the process calls | |
| 73 // win32's ReverToSelf(). Once this happens the initial token is no longer | |
| 74 // available and the lockdown token is in effect. | |
| 75 // lockdown: the security level for the token that comes into force after the | |
| 76 // process calls TargetServices::LowerToken() or the process calls | |
| 77 // ReverToSelf(). See the explanation of each level in the TokenLevel | |
| 78 // definition. | |
| 79 // Return value: SBOX_ALL_OK if the setting succeeds and false otherwise. | |
| 80 // Returns false if the lockdown value is more permissive than the initial | |
| 81 // value. | |
| 82 // | |
| 83 // Important: most of the sandbox-provided security relies on this single | |
| 84 // setting. The caller should strive to set the lockdown level as restricted | |
| 85 // as possible. | |
| 86 virtual ResultCode SetTokenLevel(TokenLevel initial, TokenLevel lockdown) = 0; | |
| 87 | |
| 88 // Sets the security level of the Job Object to which the target process will | |
| 89 // belong. This setting is permanent and cannot be changed once the target | |
| 90 // process is spawned. The job controls the global security settings which | |
| 91 // can not be specified in the token security profile. | |
| 92 // job_level: the security level for the job. See the explanation of each | |
| 93 // level in the JobLevel definition. | |
| 94 // ui_exceptions: specify what specific rights that are disabled in the | |
| 95 // chosen job_level that need to be granted. Use this parameter to avoid | |
| 96 // selecting the next permissive job level unless you need all the rights | |
| 97 // that are granted in such level. | |
| 98 // The exceptions can be specified as a combination of the following | |
| 99 // constants: | |
| 100 // JOB_OBJECT_UILIMIT_HANDLES : grant access to all user-mode handles. These | |
| 101 // include windows, icons, menus and various GDI objects. In addition the | |
| 102 // target process can set hooks, and broadcast messages to other processes | |
| 103 // that belong to the same desktop. | |
| 104 // JOB_OBJECT_UILIMIT_READCLIPBOARD : grant read-only access to the clipboard. | |
| 105 // JOB_OBJECT_UILIMIT_WRITECLIPBOARD : grant write access to the clipboard. | |
| 106 // JOB_OBJECT_UILIMIT_SYSTEMPARAMETERS : allow changes to the system-wide | |
| 107 // parameters as defined by the Win32 call SystemParametersInfo(). | |
| 108 // JOB_OBJECT_UILIMIT_DISPLAYSETTINGS : allow programmatic changes to the | |
| 109 // display settings. | |
| 110 // JOB_OBJECT_UILIMIT_GLOBALATOMS : allow access to the global atoms table. | |
| 111 // JOB_OBJECT_UILIMIT_DESKTOP : allow the creation of new desktops. | |
| 112 // JOB_OBJECT_UILIMIT_EXITWINDOWS : allow the call to ExitWindows(). | |
| 113 // | |
| 114 // Return value: SBOX_ALL_OK if the setting succeeds and false otherwise. | |
| 115 // | |
| 116 // Note: JOB_OBJECT_XXXX constants are defined in winnt.h and documented at | |
| 117 // length in: | |
| 118 // http://msdn2.microsoft.com/en-us/library/ms684152.aspx | |
| 119 // | |
| 120 // Note: the recommended level is JOB_RESTRICTED or JOB_LOCKDOWN. | |
| 121 virtual ResultCode SetJobLevel(JobLevel job_level, uint32 ui_exceptions) = 0; | |
| 122 | |
| 123 // Specifies the desktop on which the application is going to run. If the | |
| 124 // desktop does not exist, it will be created. If alternate_winstation is | |
| 125 // set to true, the desktop will be created on an alternate window station. | |
| 126 virtual ResultCode SetAlternateDesktop(bool alternate_winstation) = 0; | |
| 127 | |
| 128 // Returns the name of the alternate desktop used. If an alternate window | |
| 129 // station is specified, the name is prepended by the window station name, | |
| 130 // followed by a backslash. | |
| 131 virtual std::wstring GetAlternateDesktop() const = 0; | |
| 132 | |
| 133 // Precreates the desktop and window station, if any. | |
| 134 virtual ResultCode CreateAlternateDesktop(bool alternate_winstation) = 0; | |
| 135 | |
| 136 // Destroys the desktop and windows station. | |
| 137 virtual void DestroyAlternateDesktop() = 0; | |
| 138 | |
| 139 // Sets the integrity level of the process in the sandbox. Both the initial | |
| 140 // token and the main token will be affected by this. This is valid only | |
| 141 // on Vista. It is silently ignored on other OSes. If you set the integrity | |
| 142 // level to a level higher than your current level, the sandbox will fail | |
| 143 // to start. | |
| 144 virtual ResultCode SetIntegrityLevel(IntegrityLevel level) = 0; | |
| 145 | |
| 146 // Sets the integrity level of the process in the sandbox. The integrity level | |
| 147 // will not take effect before you call LowerToken. User Interface Privilege | |
| 148 // Isolation is not affected by this setting and will remain off for the | |
| 149 // process in the sandbox. This flag is valid on Vista only, it is silently | |
| 150 // ignored on other OSes. If you set the integrity level to a level higher | |
| 151 // than your current level, the sandbox will fail to start. | |
| 152 virtual ResultCode SetDelayedIntegrityLevel(IntegrityLevel level) = 0; | |
| 153 | |
| 154 // Sets the interceptions to operate in strict mode. By default, interceptions | |
| 155 // are performed in "relaxed" mode, where if something inside NTDLL.DLL is | |
| 156 // already patched we attempt to intercept it anyway. Setting interceptions | |
| 157 // to strict mode means that when we detect that the function is patched we'll | |
| 158 // refuse to perform the interception. | |
| 159 virtual void SetStrictInterceptions() = 0; | |
| 160 | |
| 161 // Adds a policy rule effective for processes spawned using this policy. | |
| 162 // subsystem: One of the above enumerated windows subsystems. | |
| 163 // semantics: One of the above enumerated FileSemantics. | |
| 164 // pattern: A specific full path or a full path with wildcard patterns. | |
| 165 // The valid wildcards are: | |
| 166 // '*' : Matches zero or more character. Only one in series allowed. | |
| 167 // '?' : Matches a single character. One or more in series are allowed. | |
| 168 // Examples: | |
| 169 // "c:\\documents and settings\\vince\\*.dmp" | |
| 170 // "c:\\documents and settings\\*\\crashdumps\\*.dmp" | |
| 171 // "c:\\temp\\app_log_?????_chrome.txt" | |
| 172 virtual ResultCode AddRule(SubSystem subsystem, Semantics semantics, | |
| 173 const wchar_t* pattern) = 0; | |
| 174 | |
| 175 // Adds a dll that will be unloaded in the target process before it gets | |
| 176 // a chance to initialize itself. Typically, dlls that cause the target | |
| 177 // to crash go here. | |
| 178 virtual ResultCode AddDllToUnload(const wchar_t* dll_name) = 0; | |
| 179 | |
| 180 // Adds a handle that will be closed in the target process after lockdown. | |
| 181 // A NULL value for handle_name indicates all handles of the specified type. | |
| 182 // An empty string for handle_name indicates the handle is unnamed. | |
| 183 virtual ResultCode AddKernelObjectToClose(const wchar_t* handle_type, | |
| 184 const wchar_t* handle_name) = 0; | |
| 185 }; | |
| 186 | |
| 187 } // namespace sandbox | |
| 188 | |
| 189 | |
| 190 #endif // SANDBOX_SRC_SANDBOX_POLICY_H_ | |
| OLD | NEW |
|---|
Chromium Code Reviews
Issue 10689170:
Move the Windows sandbox to sandbox/win (Closed)
Base URL: svn://svn.chromium.org/chrome/trunk/src