[Chrome ELF] Early browser security support.

chrome_elf/chrome_elf_util_unittest.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <tuple>
 #include <windows.h>
 #include <versionhelpers.h>  // windows.h must be before.
 
 #include "base/test/test_reg_util_win.h"
 #include "base/win/registry.h"
 #include "chrome/install_static/install_util.h"
 #include "chrome_elf/chrome_elf_constants.h"
+#include "chrome_elf/chrome_elf_security.h"
 #include "chrome_elf/nt_registry/nt_registry.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "testing/platform_test.h"
 
 using namespace install_static;
 
 namespace {
 
 const wchar_t kCanaryExePath[] =
     L"C:\\Users\\user\\AppData\\Local\\Google\\Chrome SxS\\Application"
     L"\\chrome.exe";
 const wchar_t kChromeSystemExePath[] =
     L"C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe";
 const wchar_t kChromeUserExePath[] =
     L"C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe";
 const wchar_t kChromiumExePath[] =
     L"C:\\Users\\user\\AppData\\Local\\Chromium\\Application\\chrome.exe";
 
+bool SetSecurityFinchFlag(bool creation) {
+  bool success = true;
+  base::win::RegKey security_key(HKEY_CURRENT_USER, L"", KEY_ALL_ACCESS);
+
+  if (creation) {
+    if (ERROR_SUCCESS !=
+        security_key.CreateKey(elf_sec::kRegSecurityFinchPath, KEY_QUERY_VALUE))
+      success = false;
+  } else {
+    if (ERROR_SUCCESS != security_key.DeleteKey(elf_sec::kRegSecurityFinchPath))
+      success = false;
+  }
+
+  security_key.Close();
+  return success;
+}
+
+bool IsSecuritySet() {
+  typedef decltype(GetProcessMitigationPolicy)* GetProcessMitigationPolicyFunc;
+
+  // Check the settings from EarlyBrowserSecurity().
+  if (::IsWindows8OrGreater()) {
+    GetProcessMitigationPolicyFunc get_process_mitigation_policy =
+        reinterpret_cast<GetProcessMitigationPolicyFunc>(::GetProcAddress(
+            ::GetModuleHandleW(L"kernel32.dll"), "GetProcessMitigationPolicy"));
+    if (!get_process_mitigation_policy)
+      return false;
+
+    // Check that extension points are disabled.
+    // (Legacy hooking.)
+    PROCESS_MITIGATION_EXTENSION_POINT_DISABLE_POLICY policy = {};
+    if (!get_process_mitigation_policy(::GetCurrentProcess(),
+                                       ProcessExtensionPointDisablePolicy,
+                                       &policy, sizeof(policy)))
+      return false;
+
+    return policy.DisableExtensionPoints;
+  }
+
+  return true;
+}
+
+void RegRedirect(nt::ROOT_KEY key,
+                 registry_util::RegistryOverrideManager& rom) {
+  base::string16 temp;
+
+  if (key == nt::HKCU) {
+    rom.OverrideRegistry(HKEY_CURRENT_USER, &temp);
+    ::wcsncpy(nt::HKCU_override, temp.c_str(), nt::g_kRegMaxPathLen - 1);
+  } else if (key == nt::HKLM) {
+    rom.OverrideRegistry(HKEY_LOCAL_MACHINE, &temp);
+    ::wcsncpy(nt::HKLM_override, temp.c_str(), nt::g_kRegMaxPathLen - 1);
+  }
+  // nt::AUTO should not be passed into this function.
+}
+
 TEST(ChromeElfUtilTest, CanaryTest) {
   EXPECT_TRUE(IsSxSChrome(kCanaryExePath));
   EXPECT_FALSE(IsSxSChrome(kChromeUserExePath));
   EXPECT_FALSE(IsSxSChrome(kChromiumExePath));
 }
 
 TEST(ChromeElfUtilTest, SystemInstallTest) {
   EXPECT_TRUE(IsSystemInstall(kChromeSystemExePath));
   EXPECT_FALSE(IsSystemInstall(kChromeUserExePath));
 }
 
 TEST(ChromeElfUtilTest, BrowserProcessTest) {
   EXPECT_EQ(ProcessType::UNINITIALIZED, g_process_type);
   InitializeProcessType();
   EXPECT_FALSE(IsNonBrowserProcess());
 }
 
+TEST(ChromeElfUtilTest, BrowserProcessSecurityTest) {
+  if (!::IsWindows8OrGreater())
+    return;
+
+  // Set up registry override for this test.
+  registry_util::RegistryOverrideManager override_manager;
+  RegRedirect(nt::HKCU, override_manager);
+
+  // First, ensure that the emergency-off finch signal works.
+  EXPECT_TRUE(SetSecurityFinchFlag(true));
+  EarlyBrowserSecurity();
+  EXPECT_FALSE(IsSecuritySet());
+  EXPECT_TRUE(SetSecurityFinchFlag(false));
+
+  // Second, test that the process mitigation is set when no finch signal.
+  EarlyBrowserSecurity();
+  EXPECT_TRUE(IsSecuritySet());
+}
+
 //------------------------------------------------------------------------------
 // NT registry API tests (chrome_elf_reg)
 //------------------------------------------------------------------------------
 
 TEST(ChromeElfUtilTest, NTRegistry) {
   HANDLE key_handle;
   const wchar_t* dword_val_name = L"DwordTestValue";
   DWORD dword_val = 1234;
   const wchar_t* sz_val_name = L"SzTestValue";
   base::string16 sz_val = L"blah de blah de blahhhhh.";
   const wchar_t* sz_val_name2 = L"SzTestValueEmpty";
   base::string16 sz_val2 = L"";
   const wchar_t* multisz_val_name = L"SzmultiTestValue";
   std::vector<base::string16> multisz_val;
   base::string16 multi1 = L"one";
   base::string16 multi2 = L"two";
   base::string16 multi3 = L"three";
   const wchar_t* multisz_val_name2 = L"SzmultiTestValueBad";
   base::string16 multi_empty = L"";
   const wchar_t* sz_new_key_1 = L"test\\new\\subkey";
   const wchar_t* sz_new_key_2 = L"test\\new\\subkey\\blah\\";
   const wchar_t* sz_new_key_3 = L"\\test\\new\\subkey\\\\blah2";
 
   // Set up registry override for this test.
-  base::string16 temp;
   registry_util::RegistryOverrideManager override_manager;
-  override_manager.OverrideRegistry(HKEY_CURRENT_USER, &temp);
-  ::wcsncpy(nt::HKCU_override, temp.c_str(), nt::g_kRegMaxPathLen - 1);
+  RegRedirect(nt::HKCU, override_manager);
 
   // Create a temp key to play under.
   ASSERT_TRUE(nt::CreateRegKey(nt::HKCU, elf_sec::kRegSecurityPath,
                                KEY_ALL_ACCESS, &key_handle));
 
   // Exercise the supported getter & setter functions.
   EXPECT_TRUE(nt::SetRegValueDWORD(key_handle, dword_val_name, dword_val));
   EXPECT_TRUE(nt::SetRegValueSZ(key_handle, sz_val_name, sz_val));
   EXPECT_TRUE(nt::SetRegValueSZ(key_handle, sz_val_name2, sz_val2));
 
@@ skipping 69 matching lines @@
 
 // Parameterized test with paramters:
 // 1: product: "canary" or "google"
 // 2: install level: "user" or "system"
 // 3: install mode: "single" or "multi"
 class ChromeElfUtilTest
     : public testing::TestWithParam<
           std::tuple<const char*, const char*, const char*>> {
  protected:
   void SetUp() override {
-    base::string16 temp;
-    override_manager_.OverrideRegistry(HKEY_LOCAL_MACHINE, &temp);
-    ::wcsncpy(nt::HKLM_override, temp.c_str(), nt::g_kRegMaxPathLen - 1);
-    temp.clear();
-    override_manager_.OverrideRegistry(HKEY_CURRENT_USER, &temp);
-    ::wcsncpy(nt::HKCU_override, temp.c_str(), nt::g_kRegMaxPathLen - 1);
+    // Set up registry override for these tests.
+    RegRedirect(nt::HKLM, override_manager_);
+    RegRedirect(nt::HKCU, override_manager_);
 
     const char* app;
     const char* level;
     const char* mode;
     std::tie(app, level, mode) = GetParam();
     is_canary_ = (std::string(app) == "canary");
     system_level_ = (std::string(level) != "user");
     multi_install_ = (std::string(mode) != "single");
     if (is_canary_) {
       ASSERT_FALSE(system_level_);
@@ skipping 334 matching lines @@
                         testing::Combine(testing::Values("canary"),
                                          testing::Values("user"),
                                          testing::Values("single")));
 INSTANTIATE_TEST_CASE_P(GoogleChrome,
                         ChromeElfUtilTest,
                         testing::Combine(testing::Values("google"),
                                          testing::Values("user", "system"),
                                          testing::Values("single", "multi")));
 
 }  // namespace