[Chrome ELF] Early browser security support.

chrome_elf/chrome_elf_util.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome_elf/chrome_elf_util.h"
 
 #include <assert.h>
+#include <stddef.h>
 #include <windows.h>
-#include <stddef.h>
+#include <versionhelpers.h>  // windows.h must be before
 
 #include "base/macros.h"
 #include "base/strings/string16.h"
 
 ProcessType g_process_type = ProcessType::UNINITIALIZED;
 
 namespace {
 
 const wchar_t kRegPathClientState[] = L"Software\\Google\\Update\\ClientState";
 const wchar_t kRegPathClientStateMedium[] =
@@ skipping 195 matching lines @@
     return;
   }
 
   g_process_type = ProcessType::BROWSER_PROCESS;
 }
 
 bool IsNonBrowserProcess() {
   assert(g_process_type != ProcessType::UNINITIALIZED);
   return g_process_type == ProcessType::NON_BROWSER_PROCESS;
 }
+
+typedef decltype(SetProcessMitigationPolicy)* SetProcessMitigationPolicyFunc;

[robertshield, 2016/04/12 20:53:12]

Any reason not to keep this typedef inside the scope of the EarlyBrowserSecurity
function?

[penny, 2016/04/15 18:03:51]

Done.

+
+void EarlyBrowserSecurity() {
+  // This function is called from within DllMain.
+  // Don't do anything naughty while we have the loader lock.
+  NTSTATUS ret_val;

[robertshield, 2016/04/12 20:53:12]

initialize to STATUS_SUCCESS

[penny, 2016/04/15 18:03:51]

Done.

+  HANDLE handle;

[robertshield, 2016/04/12 20:53:12]

initialize this to NULL

[penny, 2016/04/15 18:03:51]

Done.

+
+  // Check for kRegistrySecurityFinchPath.  If it exists,
+  // we do NOT disable extension points.  (Emergency off flag.)
+  if (nt::OpenRegKey(nt::HKCU, elf_sec::kRegSecurityFinchPath, KEY_QUERY_VALUE,
+                     &handle, &ret_val)) {
+    nt::CloseRegKey(handle);
+    return;
+  }
+#ifdef _DEBUG
+  // The only failure expected is for the path not existing.
+  if (ret_val != STATUS_OBJECT_NAME_NOT_FOUND)
+    assert(false);
+#endif
+
+  if (::IsWindows8OrGreater()) {
+    SetProcessMitigationPolicyFunc set_process_mitigation_policy =
+        reinterpret_cast<SetProcessMitigationPolicyFunc>(::GetProcAddress(
+            ::GetModuleHandleW(L"kernel32.dll"), "SetProcessMitigationPolicy"));
+    if (set_process_mitigation_policy) {
+      // Disable extension points in this process.
+      // (Legacy hooking.)
+      PROCESS_MITIGATION_EXTENSION_POINT_DISABLE_POLICY policy = {};
+      policy.DisableExtensionPoints = true;
+
+      set_process_mitigation_policy(ProcessExtensionPointDisablePolicy, &policy,
+                                    sizeof(policy));
+    }
+  }
+
+  return;
+}