Use a Finch Experiment to control the Browser Blacklist

chrome_elf/blacklist/blacklist.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome_elf/blacklist/blacklist.h"
 
 #include <string.h>
 
 #include "base/basictypes.h"
 #include "chrome_elf/blacklist/blacklist_interceptions.h"
 #include "sandbox/win/src/interception_internal.h"
 #include "sandbox/win/src/internal_types.h"
 #include "sandbox/win/src/sandbox_utils.h"
 #include "sandbox/win/src/service_resolver.h"
 
 // http://blogs.msdn.com/oldnewthing/archive/2004/10/25/247180.aspx
 extern "C" IMAGE_DOS_HEADER __ImageBase;
 
 namespace blacklist{
 
 const wchar_t* g_troublesome_dlls[kTroublesomeDllsMaxCount] = {};
 int g_troublesome_dlls_cur_index = 0;
 
 const wchar_t kRegistryBeaconPath[] = L"SOFTWARE\\Google\\Chrome\\BLBeacon";
+const wchar_t kBeaconVersion[] = L"version";
+const wchar_t kBeaconState[] = L"state";
 
 }  // namespace blacklist
 
 // Allocate storage for thunks in a RWX page of this module to save on doing
 // an extra allocation at run time.
 #if !defined(_WIN64)
 // 64-bit images appear to not support writeable and executable pages.
 // This would yield compile warning C4330.
 // TODO(robertshield): Add 64 bit support.
 #pragma section(".crthunk",read,write,execute)
@@ skipping 103 matching lines @@
 
 bool IsNonBrowserProcess() {
   wchar_t* command_line = GetCommandLine();
   return (command_line && wcsstr(command_line, L"--type"));
 }
 
 }  // namespace
 
 namespace blacklist {
 
-bool CreateBeacon() {
-  HKEY beacon_key = NULL;
-  DWORD disposition = 0;
-  LONG result = ::RegCreateKeyEx(HKEY_CURRENT_USER,
+bool LeaveSetupBeacon() {
+  DWORD blacklist_state = 0;

[robertshield, 2014/01/02 20:42:22]

= BLACKLIST_DISABLED;

[csharp, 2014/01/02 21:57:59]

Done.

+  DWORD blacklist_state_size = sizeof(blacklist_state);
+  ::RegGetValue(HKEY_CURRENT_USER,
+                kRegistryBeaconPath,
+                kBeaconState,
+                RRF_RT_REG_DWORD,
+                NULL,
+                &blacklist_state,
+                &blacklist_state_size);

[robertshield, 2014/01/02 20:42:22]

Check the return value of RegGetValue and also fail on non-ERROR_SUCCESS in the
check immediately below.

[csharp, 2014/01/02 21:57:59]

Done.

+
+  if (blacklist_state != BLACKLIST_ENABLED)
+    return false;
+
+  blacklist_state = BLACKLIST_SETUP_RUNNING;
+  LONG result = ::RegSetKeyValue(HKEY_CURRENT_USER,
                                  kRegistryBeaconPath,
-                                 0,
-                                 NULL,
-                                 0,
-                                 KEY_WRITE,
-                                 NULL,
-                                 &beacon_key,
-                                 &disposition);
-  bool success = (result == ERROR_SUCCESS &&
-                  disposition != REG_OPENED_EXISTING_KEY);
-  if (result == ERROR_SUCCESS)
-    ::RegCloseKey(beacon_key);
-  return success;
-}
+                                 kBeaconState,
+                                 REG_DWORD,
+                                 &blacklist_state,
+                                 sizeof(blacklist_state));
 
-bool ClearBeacon() {
-  LONG result = ::RegDeleteKey(HKEY_CURRENT_USER, kRegistryBeaconPath);
   return (result == ERROR_SUCCESS);
 }
 
+bool ResetBeacon() {
+  DWORD blacklist_state = BLACKLIST_ENABLED;
+  LONG result = ::RegSetKeyValue(HKEY_CURRENT_USER,
+                                 kRegistryBeaconPath,
+                                 kBeaconState,
+                                 REG_DWORD,
+                                 &blacklist_state,
+                                 sizeof(blacklist_state));
+
+  return (result == ERROR_SUCCESS);
+}
+
 bool AddDllToBlacklist(const wchar_t* dll_name) {
   if (g_troublesome_dlls_cur_index >= kTroublesomeDllsMaxCount)
     return false;
   for (int i = 0; i < g_troublesome_dlls_cur_index; ++i) {
     if (!wcscmp(g_troublesome_dlls[i], dll_name))
       return true;
   }
 
   // Copy string to blacklist.
   wchar_t* str_buffer = new wchar_t[wcslen(dll_name) + 1];
@@ skipping 28 matching lines @@
 
   // Check to see that we found the functions we need in ntdll.
   if (!InitializeInterceptImports())
     return false;
 
   // Check to see if this is a non-browser process, abort if so.
   if (IsNonBrowserProcess())
     return false;
 
   // Check to see if a beacon is present, abort if so.
-  if (!force && !CreateBeacon())
+  if (!force && !LeaveSetupBeacon())
     return false;
 
   // Don't try blacklisting on unsupported OS versions.
   OSInfo os_info;
   if (os_info.version() <= VERSION_PRE_XP_SP2)
     return false;
 
   // Pseudo-handle, no need to close.
   HANDLE current_process = ::GetCurrentProcess();
 
@@ skipping 34 matching lines @@
                               &blacklist::BlNtMapViewOfSection,
                               thunk_storage,
                               sizeof(sandbox::ThunkData),
                               NULL);
 
   delete thunk;
   return NT_SUCCESS(ret);
 }
 
 }  // namespace blacklist