| OLD | NEW |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include <aclapi.h> | 5 #include <aclapi.h> |
| 6 #include <sddl.h> | 6 #include <sddl.h> |
| 7 #include <vector> | 7 #include <vector> |
| 8 | 8 |
| 9 #include "sandbox/win/src/restricted_token_utils.h" | 9 #include "sandbox/win/src/restricted_token_utils.h" |
| 10 | 10 |
| (...skipping 11 matching lines...) Expand all Loading... |
| 22 DWORD CreateRestrictedToken(HANDLE *token_handle, | 22 DWORD CreateRestrictedToken(HANDLE *token_handle, |
| 23 TokenLevel security_level, | 23 TokenLevel security_level, |
| 24 IntegrityLevel integrity_level, | 24 IntegrityLevel integrity_level, |
| 25 TokenType token_type) { | 25 TokenType token_type) { |
| 26 if (!token_handle) | 26 if (!token_handle) |
| 27 return ERROR_BAD_ARGUMENTS; | 27 return ERROR_BAD_ARGUMENTS; |
| 28 | 28 |
| 29 RestrictedToken restricted_token; | 29 RestrictedToken restricted_token; |
| 30 restricted_token.Init(NULL); // Initialized with the current process token | 30 restricted_token.Init(NULL); // Initialized with the current process token |
| 31 | 31 |
| 32 std::vector<std::wstring> privilege_exceptions; | 32 std::vector<base::string16> privilege_exceptions; |
| 33 std::vector<Sid> sid_exceptions; | 33 std::vector<Sid> sid_exceptions; |
| 34 | 34 |
| 35 bool deny_sids = true; | 35 bool deny_sids = true; |
| 36 bool remove_privileges = true; | 36 bool remove_privileges = true; |
| 37 | 37 |
| 38 switch (security_level) { | 38 switch (security_level) { |
| 39 case USER_UNPROTECTED: { | 39 case USER_UNPROTECTED: { |
| 40 deny_sids = false; | 40 deny_sids = false; |
| 41 remove_privileges = false; | 41 remove_privileges = false; |
| 42 break; | 42 break; |
| (...skipping 187 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 230 | 230 |
| 231 (*job_handle_ret) = job.Detach(); | 231 (*job_handle_ret) = job.Detach(); |
| 232 | 232 |
| 233 return ERROR_SUCCESS; | 233 return ERROR_SUCCESS; |
| 234 } | 234 } |
| 235 | 235 |
| 236 DWORD SetObjectIntegrityLabel(HANDLE handle, SE_OBJECT_TYPE type, | 236 DWORD SetObjectIntegrityLabel(HANDLE handle, SE_OBJECT_TYPE type, |
| 237 const wchar_t* ace_access, | 237 const wchar_t* ace_access, |
| 238 const wchar_t* integrity_level_sid) { | 238 const wchar_t* integrity_level_sid) { |
| 239 // Build the SDDL string for the label. | 239 // Build the SDDL string for the label. |
| 240 std::wstring sddl = L"S:("; // SDDL for a SACL. | 240 base::string16 sddl = L"S:("; // SDDL for a SACL. |
| 241 sddl += SDDL_MANDATORY_LABEL; // Ace Type is "Mandatory Label". | 241 sddl += SDDL_MANDATORY_LABEL; // Ace Type is "Mandatory Label". |
| 242 sddl += L";;"; // No Ace Flags. | 242 sddl += L";;"; // No Ace Flags. |
| 243 sddl += ace_access; // Add the ACE access. | 243 sddl += ace_access; // Add the ACE access. |
| 244 sddl += L";;;"; // No ObjectType and Inherited Object Type. | 244 sddl += L";;;"; // No ObjectType and Inherited Object Type. |
| 245 sddl += integrity_level_sid; // Trustee Sid. | 245 sddl += integrity_level_sid; // Trustee Sid. |
| 246 sddl += L")"; | 246 sddl += L")"; |
| 247 | 247 |
| 248 DWORD error = ERROR_SUCCESS; | 248 DWORD error = ERROR_SUCCESS; |
| 249 PSECURITY_DESCRIPTOR sec_desc = NULL; | 249 PSECURITY_DESCRIPTOR sec_desc = NULL; |
| 250 | 250 |
| (...skipping 85 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 336 if (!::OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_DEFAULT, | 336 if (!::OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_DEFAULT, |
| 337 &token_handle)) | 337 &token_handle)) |
| 338 return ::GetLastError(); | 338 return ::GetLastError(); |
| 339 | 339 |
| 340 base::win::ScopedHandle token(token_handle); | 340 base::win::ScopedHandle token(token_handle); |
| 341 | 341 |
| 342 return SetTokenIntegrityLevel(token.Get(), integrity_level); | 342 return SetTokenIntegrityLevel(token.Get(), integrity_level); |
| 343 } | 343 } |
| 344 | 344 |
| 345 } // namespace sandbox | 345 } // namespace sandbox |
| OLD | NEW |