OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include <stddef.h> | 5 #include <stddef.h> |
6 | 6 |
7 #include <map> | 7 #include <map> |
8 | 8 |
9 #include "sandbox/win/src/policy_broker.h" | 9 #include "sandbox/win/src/policy_broker.h" |
10 | 10 |
(...skipping 78 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
89 // Verify that the structure is fully initialized. | 89 // Verify that the structure is fully initialized. |
90 for (size_t i = 0; i < sizeof(g_nt)/sizeof(void*); i++) | 90 for (size_t i = 0; i < sizeof(g_nt)/sizeof(void*); i++) |
91 DCHECK(reinterpret_cast<char**>(&g_nt)[i]); | 91 DCHECK(reinterpret_cast<char**>(&g_nt)[i]); |
92 #endif | 92 #endif |
93 return (SBOX_ALL_OK == child->TransferVariable("g_nt", &g_nt, sizeof(g_nt))); | 93 return (SBOX_ALL_OK == child->TransferVariable("g_nt", &g_nt, sizeof(g_nt))); |
94 } | 94 } |
95 | 95 |
96 #undef INIT_GLOBAL_NT | 96 #undef INIT_GLOBAL_NT |
97 #undef INIT_GLOBAL_RTL | 97 #undef INIT_GLOBAL_RTL |
98 | 98 |
99 bool SetupBasicInterceptions(InterceptionManager* manager) { | 99 bool SetupBasicInterceptions(InterceptionManager* manager, |
| 100 bool is_csrss_connected) { |
100 // Interceptions provided by process_thread_policy, without actual policy. | 101 // Interceptions provided by process_thread_policy, without actual policy. |
101 if (!INTERCEPT_NT(manager, NtOpenThread, OPEN_THREAD_ID, 20) || | 102 if (!INTERCEPT_NT(manager, NtOpenThread, OPEN_THREAD_ID, 20) || |
102 !INTERCEPT_NT(manager, NtOpenProcess, OPEN_PROCESS_ID, 20) || | 103 !INTERCEPT_NT(manager, NtOpenProcess, OPEN_PROCESS_ID, 20) || |
103 !INTERCEPT_NT(manager, NtOpenProcessToken, OPEN_PROCESS_TOKEN_ID, 16)) | 104 !INTERCEPT_NT(manager, NtOpenProcessToken, OPEN_PROCESS_TOKEN_ID, 16)) |
104 return false; | 105 return false; |
105 | 106 |
106 // Interceptions with neither policy nor IPC. | 107 // Interceptions with neither policy nor IPC. |
107 if (!INTERCEPT_NT(manager, NtSetInformationThread, SET_INFORMATION_THREAD_ID, | 108 if (!INTERCEPT_NT(manager, NtSetInformationThread, SET_INFORMATION_THREAD_ID, |
108 20) || | 109 20) || |
109 !INTERCEPT_NT(manager, NtOpenThreadToken, OPEN_THREAD_TOKEN_ID, 20)) | 110 !INTERCEPT_NT(manager, NtOpenThreadToken, OPEN_THREAD_TOKEN_ID, 20)) |
110 return false; | 111 return false; |
111 | 112 |
112 if (base::win::GetVersion() >= base::win::VERSION_XP) { | 113 if (base::win::GetVersion() >= base::win::VERSION_XP) { |
113 // Bug 27218: We don't have dispatch for some x64 syscalls. | 114 // Bug 27218: We don't have dispatch for some x64 syscalls. |
114 // This one is also provided by process_thread_policy. | 115 // This one is also provided by process_thread_policy. |
115 if (!INTERCEPT_NT(manager, NtOpenProcessTokenEx, OPEN_PROCESS_TOKEN_EX_ID, | 116 if (!INTERCEPT_NT(manager, NtOpenProcessTokenEx, OPEN_PROCESS_TOKEN_EX_ID, |
116 20)) | 117 20)) |
117 return false; | 118 return false; |
118 | 119 |
119 return INTERCEPT_NT(manager, NtOpenThreadTokenEx, OPEN_THREAD_TOKEN_EX_ID, | 120 if (!INTERCEPT_NT(manager, NtOpenThreadTokenEx, OPEN_THREAD_TOKEN_EX_ID, |
120 24); | 121 24)) |
| 122 return false; |
| 123 } |
| 124 |
| 125 if (!is_csrss_connected) { |
| 126 if (!INTERCEPT_EAT(manager, kKerneldllName, CreateThread, CREATE_THREAD_ID, |
| 127 28)) |
| 128 return false; |
121 } | 129 } |
122 | 130 |
123 return true; | 131 return true; |
124 } | 132 } |
125 | 133 |
126 } // namespace sandbox | 134 } // namespace sandbox |
OLD | NEW |