Block legacy hooking mechanisms on Win8+

Block legacy hooking mechanisms on Win8+

This should reduce crashes in third-party hooks.
Finch experiment included for A-B testing.

BUG=557798

[jschuh, 2015-11-18 16:27:56]

Description was changed from

==========
Block legacy hooking mechanisms on Win8+

This should reduce crashes in third-party hooks.
Finch experiment included for A-B testing.
==========

to

==========
Block legacy hooking mechanisms on Win8+

This should reduce crashes in third-party hooks.
Finch experiment included for A-B testing.

BUG=557798
==========

[jschuh, 2015-11-18 16:32:39]

jschuh@chromium.org changed reviewers:
+ robertshield@chromium.org

[jschuh, 2015-11-18 16:32:40]

PTAL. I'm setting this as the default, and providing a Finch toggle. And I'm not
gating the flag for sandboxed processes, because those should *really* never
trigger these hook paths in the first place.

[robertshield, 2015-11-18 17:51:03]

https://codereview.chromium.org/1452393002/diff/1/chrome/browser/chrome_elf_i...
File chrome/browser/chrome_elf_init_win.cc (right):

https://codereview.chromium.org/1452393002/diff/1/chrome/browser/chrome_elf_i...
chrome/browser/chrome_elf_init_win.cc:91:
base::FieldTrialList::FindFullName("WindowsHookBlocking") != "Disabled") {
Not sure it's useful to apply the policy here. This is the browser end of elf
initialization which isn't terribly early in the process. AppInit_Dlls, etc.
will have already loaded by this point. 

What you probably want is to do this during elf dll initialization, here:
https://code.google.com/p/chromium/codesearch#chromium/src/chrome_elf/chrome_...

There are some constraints: no using base/ and don't do anything that isn't safe
under the loader lock.

[jschuh, 2015-11-18 18:21:15]

https://codereview.chromium.org/1452393002/diff/1/chrome/browser/chrome_elf_i...
File chrome/browser/chrome_elf_init_win.cc (right):

https://codereview.chromium.org/1452393002/diff/1/chrome/browser/chrome_elf_i...
chrome/browser/chrome_elf_init_win.cc:91:
base::FieldTrialList::FindFullName("WindowsHookBlocking") != "Disabled") {
On 2015/11/18 17:51:03, robertshield wrote:
> Not sure it's useful to apply the policy here. This is the browser end of elf
> initialization which isn't terribly early in the process. AppInit_Dlls, etc.
> will have already loaded by this point. 
> 
> What you probably want is to do this during elf dll initialization, here:
>
https://code.google.com/p/chromium/codesearch#chromium/src/chrome_elf/chrome_...
> 
> There are some constraints: no using base/ and don't do anything that isn't
safe
> under the loader lock. 

Okay, that makes a lot more sense. Because I traced it through, and this seemed
very late to me as well.

Given the restrictions, it sounds like I won't be able to finch gate this, or am
I wrong?

[robertshield, 2015-11-18 19:50:29]

https://codereview.chromium.org/1452393002/diff/1/chrome/browser/chrome_elf_i...
File chrome/browser/chrome_elf_init_win.cc (right):

https://codereview.chromium.org/1452393002/diff/1/chrome/browser/chrome_elf_i...
chrome/browser/chrome_elf_init_win.cc:91:
base::FieldTrialList::FindFullName("WindowsHookBlocking") != "Disabled") {
On 2015/11/18 18:21:15, jschuh (very slow) wrote:
> On 2015/11/18 17:51:03, robertshield wrote:
> > Not sure it's useful to apply the policy here. This is the browser end of
elf
> > initialization which isn't terribly early in the process. AppInit_Dlls, etc.
> > will have already loaded by this point. 
> > 
> > What you probably want is to do this during elf dll initialization, here:
> >
>
https://code.google.com/p/chromium/codesearch#chromium/src/chrome_elf/chrome_...
> > 
> > There are some constraints: no using base/ and don't do anything that isn't
> safe
> > under the loader lock. 
> 
> Okay, that makes a lot more sense. Because I traced it through, and this
seemed
> very late to me as well.
> 
> Given the restrictions, it sounds like I won't be able to finch gate this, or
am
> I wrong?

You can, but there are hoops to jump through and involves cooperation from the
browser process. We do this for the blacklist by proxying through the registry
to communicate finch state to elf. This means on first run, elf does nothing,
when the browser starts up it reads some finch state, writes it to the registry,
on subsequent runs, elf finds this state in the registry and then does stuff. It
ain't pretty, but it works.

Example Elf side of things :
https://code.google.com/p/chromium/codesearch#chromium/src/chrome_elf/blackli...
Browser side of things:
https://code.google.com/p/chromium/codesearch#chromium/src/chrome/browser/chr...