OLD | NEW |
---|---|
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include <memory> | 5 #include <memory> |
6 #include <string> | 6 #include <string> |
7 | 7 |
8 #include "base/strings/string16.h" | 8 #include "base/strings/string16.h" |
9 #include "base/strings/sys_string_conversions.h" | 9 #include "base/strings/sys_string_conversions.h" |
10 #include "base/win/scoped_handle.h" | 10 #include "base/win/scoped_handle.h" |
11 #include "base/win/scoped_process_information.h" | 11 #include "base/win/scoped_process_information.h" |
12 #include "base/win/windows_version.h" | 12 #include "base/win/windows_version.h" |
13 #include "sandbox/win/src/process_thread_interception.h" | |
13 #include "sandbox/win/src/sandbox.h" | 14 #include "sandbox/win/src/sandbox.h" |
14 #include "sandbox/win/src/sandbox_factory.h" | 15 #include "sandbox/win/src/sandbox_factory.h" |
15 #include "sandbox/win/src/sandbox_policy.h" | 16 #include "sandbox/win/src/sandbox_policy.h" |
16 #include "sandbox/win/tests/common/controller.h" | 17 #include "sandbox/win/tests/common/controller.h" |
17 #include "testing/gtest/include/gtest/gtest.h" | 18 #include "testing/gtest/include/gtest/gtest.h" |
18 | 19 |
19 namespace { | 20 namespace { |
20 | 21 |
21 // While the shell API provides better calls than this home brew function | 22 // While the shell API provides better calls than this home brew function |
22 // we use GetSystemWindowsDirectoryW which does not query the registry so | 23 // we use GetSystemWindowsDirectoryW which does not query the registry so |
(...skipping 228 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
251 return SBOX_TEST_DENIED; | 252 return SBOX_TEST_DENIED; |
252 } | 253 } |
253 } else { | 254 } else { |
254 ::CloseHandle(token); | 255 ::CloseHandle(token); |
255 return SBOX_TEST_SUCCEEDED; | 256 return SBOX_TEST_SUCCEEDED; |
256 } | 257 } |
257 | 258 |
258 return SBOX_TEST_FAILED; | 259 return SBOX_TEST_FAILED; |
259 } | 260 } |
260 | 261 |
262 DWORD TestThreadFunc(LPVOID lpdwThreadParam) { | |
263 // This is the function that is called when testing thread creation. | |
264 return 0; | |
Will Harris
2015/09/04 02:41:01
I wonder if this should signal an event or somethi
liamjm (20p)
2015/09/04 21:30:39
Yeah, good idea.
Added an event, that the caller c
| |
265 } | |
266 | |
267 SBOX_TESTS_COMMAND int Process_CreateThread(int argc, wchar_t **argv) { | |
268 DWORD thread_id = 0; | |
269 HANDLE hThread = NULL; | |
270 hThread = ::CreateThread( | |
271 NULL, | |
272 0, | |
273 (LPTHREAD_START_ROUTINE)&TestThreadFunc, | |
274 NULL, | |
275 0, | |
276 &thread_id); | |
277 | |
278 if (!hThread) { | |
279 return SBOX_TEST_FAILED; | |
280 } | |
281 if (!thread_id) { | |
282 return SBOX_TEST_FAILED; | |
283 } | |
284 | |
285 if (WaitForSingleObject(hThread, INFINITE) != WAIT_OBJECT_0) { | |
286 return SBOX_TEST_FAILED; | |
287 } | |
288 return SBOX_TEST_SUCCEEDED; | |
289 } | |
290 | |
291 | |
261 TEST(ProcessPolicyTest, TestAllAccess) { | 292 TEST(ProcessPolicyTest, TestAllAccess) { |
262 // Check if the "all access" rule fails to be added when the token is too | 293 // Check if the "all access" rule fails to be added when the token is too |
263 // powerful. | 294 // powerful. |
264 TestRunner runner; | 295 TestRunner runner; |
265 | 296 |
266 // Check the failing case. | 297 // Check the failing case. |
267 runner.GetPolicy()->SetTokenLevel(USER_INTERACTIVE, USER_LOCKDOWN); | 298 runner.GetPolicy()->SetTokenLevel(USER_INTERACTIVE, USER_LOCKDOWN); |
268 EXPECT_EQ(SBOX_ERROR_UNSUPPORTED, | 299 EXPECT_EQ(SBOX_ERROR_UNSUPPORTED, |
269 runner.GetPolicy()->AddRule(TargetPolicy::SUBSYS_PROCESS, | 300 runner.GetPolicy()->AddRule(TargetPolicy::SUBSYS_PROCESS, |
270 TargetPolicy::PROCESS_ALL_EXEC, | 301 TargetPolicy::PROCESS_ALL_EXEC, |
(...skipping 104 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
375 base::string16 exe_path = MakeFullPathToSystem32(L"findstr.exe"); | 406 base::string16 exe_path = MakeFullPathToSystem32(L"findstr.exe"); |
376 ASSERT_TRUE(!exe_path.empty()); | 407 ASSERT_TRUE(!exe_path.empty()); |
377 EXPECT_TRUE(runner.AddRule(TargetPolicy::SUBSYS_PROCESS, | 408 EXPECT_TRUE(runner.AddRule(TargetPolicy::SUBSYS_PROCESS, |
378 TargetPolicy::PROCESS_ALL_EXEC, | 409 TargetPolicy::PROCESS_ALL_EXEC, |
379 exe_path.c_str())); | 410 exe_path.c_str())); |
380 | 411 |
381 EXPECT_EQ(SBOX_TEST_SUCCEEDED, | 412 EXPECT_EQ(SBOX_TEST_SUCCEEDED, |
382 runner.RunTest(L"Process_GetChildProcessToken findstr.exe")); | 413 runner.RunTest(L"Process_GetChildProcessToken findstr.exe")); |
383 } | 414 } |
384 | 415 |
416 TEST(ProcessPolicyTest, TestCreateThread) { | |
417 TestRunner runner(JOB_NONE, USER_INTERACTIVE, USER_INTERACTIVE); | |
418 | |
419 EXPECT_TRUE(runner.AddRule(TargetPolicy::SUBSYS_PROCESS, | |
420 TargetPolicy::PROCESS_MIN_EXEC, | |
421 L"this is not important")); | |
422 | |
423 EXPECT_EQ(SBOX_TEST_SUCCEEDED, | |
424 runner.RunTest(L"Process_CreateThread")); | |
425 } | |
426 | |
427 TEST(ProcessPolicyTest, TestCreateThreadWithoutCsrss) { | |
428 TestRunner runner(JOB_NONE, USER_INTERACTIVE, USER_INTERACTIVE); | |
429 | |
430 EXPECT_TRUE(runner.AddRule(TargetPolicy::SUBSYS_PROCESS, | |
431 TargetPolicy::PROCESS_MIN_EXEC, | |
432 L"this is not important")); | |
433 | |
434 sandbox::TargetPolicy* policy = runner.GetPolicy(); | |
435 // Sever the CSRSS connection by closing ALPC ports inside the sandbox. | |
436 ASSERT_EQ(SBOX_ALL_OK, policy->AddKernelObjectToClose(L"ALPC Port", NULL)); | |
437 | |
438 EXPECT_EQ(SBOX_TEST_SUCCEEDED, runner.RunTest(L"Process_CreateThread")); | |
439 } | |
440 | |
441 TEST(ProcessPolicyTest, TestCreateThreadOutsideSandbox) { | |
442 DWORD thread_id = 0; | |
443 HANDLE hThread = NULL; | |
444 hThread = TargetCreateThread( | |
445 ::CreateThread, | |
446 NULL, | |
447 0, | |
448 (LPTHREAD_START_ROUTINE)&TestThreadFunc, | |
449 NULL, | |
450 0, | |
451 &thread_id); | |
452 | |
453 EXPECT_NE(int(hThread), NULL); | |
454 EXPECT_EQ(WAIT_OBJECT_0, WaitForSingleObject(hThread, INFINITE)); | |
455 } | |
456 | |
457 | |
385 } // namespace sandbox | 458 } // namespace sandbox |
OLD | NEW |