[Chrome ELF] Early browser security support.

chrome_elf/chrome_elf_util_unittest.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome_elf/chrome_elf_util.h"
 
 #include <tuple>
+#include <windows.h>
+#include <versionhelpers.h>  // windows.h must be before.
 
 #include "base/test/test_reg_util_win.h"
 #include "base/win/registry.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "testing/platform_test.h"
 
 namespace {
 
 const wchar_t kRegPathClientState[] = L"Software\\Google\\Update\\ClientState";
 const wchar_t kRegPathClientStateMedium[] =
@@ skipping 11 matching lines @@
 const wchar_t kCanaryExePath[] =
     L"C:\\Users\\user\\AppData\\Local\\Google\\Chrome SxS\\Application"
     L"\\chrome.exe";
 const wchar_t kChromeSystemExePath[] =
     L"C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe";
 const wchar_t kChromeUserExePath[] =
     L"C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe";
 const wchar_t kChromiumExePath[] =
     L"C:\\Users\\user\\AppData\\Local\\Chromium\\Application\\chrome.exe";
 
+typedef decltype(GetProcessMitigationPolicy)* GetProcessMitigationPolicyFunc;
+
+bool IsSecuritySet() {
+  // Check the settings from EarlyBrowserSecurity().
+  if (::IsWindows8OrGreater()) {
+    GetProcessMitigationPolicyFunc get_process_mitigation_policy =
+        reinterpret_cast<GetProcessMitigationPolicyFunc>(::GetProcAddress(
+            ::GetModuleHandleW(L"kernel32.dll"), "GetProcessMitigationPolicy"));
+    if (!get_process_mitigation_policy)
+      return false;
+
+    // Check that extension DLLs are disabled.
+    // (Legacy hooking.)
+    PROCESS_MITIGATION_EXTENSION_POINT_DISABLE_POLICY policy = {};
+    if (!get_process_mitigation_policy(::GetCurrentProcess(),
+                                       ProcessExtensionPointDisablePolicy,
+                                       &policy, sizeof(policy)))
+      return false;
+
+    return policy.DisableExtensionPoints;
+  }
+
+  return true;
+}
 
 TEST(ChromeElfUtilTest, CanaryTest) {
   EXPECT_TRUE(IsCanary(kCanaryExePath));
   EXPECT_FALSE(IsCanary(kChromeUserExePath));
   EXPECT_FALSE(IsCanary(kChromiumExePath));
 }
 
 TEST(ChromeElfUtilTest, SystemInstallTest) {
   EXPECT_TRUE(IsSystemInstall(kChromeSystemExePath));
   EXPECT_FALSE(IsSystemInstall(kChromeUserExePath));
 }
 
 TEST(ChromeElfUtilTest, BrowserProcessTest) {
   EXPECT_EQ(ProcessType::UNINITIALIZED, g_process_type);
   InitializeProcessType();
   EXPECT_FALSE(IsNonBrowserProcess());
 }
 
+TEST(ChromeElfUtilTest, BrowserProcessSecurityTest) {
+  EarlyBrowserSecurity();
+  EXPECT_TRUE(IsSecuritySet());
+}
+
 // Parameterized test with paramters:
 // 1: product: "canary" or "google"
 // 2: install level: "user" or "system"
 // 3: install mode: "single" or "multi"
 class ChromeElfUtilTest :
     public testing::TestWithParam<std::tuple<const char*,
                                              const char*,
                                              const char*> > {
  protected:
   void SetUp() override {
@@ skipping 114 matching lines @@
 INSTANTIATE_TEST_CASE_P(Canary, ChromeElfUtilTest,
                         testing::Combine(testing::Values("canary"),
                                          testing::Values("user"),
                                          testing::Values("single")));
 INSTANTIATE_TEST_CASE_P(GoogleChrome, ChromeElfUtilTest,
                         testing::Combine(testing::Values("google"),
                                          testing::Values("user", "system"),
                                          testing::Values("single", "multi")));
 
 }  // namespace