| OLD | NEW |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "sandbox/win/src/acl.h" | 5 #include "sandbox/win/src/acl.h" |
| 6 | 6 |
| 7 #include <aclapi.h> | 7 #include <aclapi.h> |
| 8 #include <sddl.h> | 8 #include <sddl.h> |
| 9 | 9 |
| 10 #include "base/logging.h" | 10 #include "base/logging.h" |
| 11 | 11 |
| 12 namespace sandbox { | 12 namespace sandbox { |
| 13 | 13 |
| 14 bool GetDefaultDacl(HANDLE token, | 14 bool GetDefaultDacl( |
| 15 scoped_ptr_malloc<TOKEN_DEFAULT_DACL>* default_dacl) { | 15 HANDLE token, |
| 16 scoped_ptr<TOKEN_DEFAULT_DACL, base::FreeDeleter>* default_dacl) { |
| 16 if (token == NULL) | 17 if (token == NULL) |
| 17 return false; | 18 return false; |
| 18 | 19 |
| 19 DCHECK(default_dacl != NULL); | 20 DCHECK(default_dacl != NULL); |
| 20 | 21 |
| 21 unsigned long length = 0; | 22 unsigned long length = 0; |
| 22 ::GetTokenInformation(token, TokenDefaultDacl, NULL, 0, &length); | 23 ::GetTokenInformation(token, TokenDefaultDacl, NULL, 0, &length); |
| 23 if (length == 0) { | 24 if (length == 0) { |
| 24 NOTREACHED(); | 25 NOTREACHED(); |
| 25 return false; | 26 return false; |
| (...skipping 26 matching lines...) Expand all Loading... |
| 52 if (ERROR_SUCCESS != ::SetEntriesInAcl(1, &new_access, old_dacl, new_dacl)) | 53 if (ERROR_SUCCESS != ::SetEntriesInAcl(1, &new_access, old_dacl, new_dacl)) |
| 53 return false; | 54 return false; |
| 54 | 55 |
| 55 return true; | 56 return true; |
| 56 } | 57 } |
| 57 | 58 |
| 58 bool AddSidToDefaultDacl(HANDLE token, const Sid& sid, ACCESS_MASK access) { | 59 bool AddSidToDefaultDacl(HANDLE token, const Sid& sid, ACCESS_MASK access) { |
| 59 if (token == NULL) | 60 if (token == NULL) |
| 60 return false; | 61 return false; |
| 61 | 62 |
| 62 scoped_ptr_malloc<TOKEN_DEFAULT_DACL> default_dacl; | 63 scoped_ptr<TOKEN_DEFAULT_DACL, base::FreeDeleter> default_dacl; |
| 63 if (!GetDefaultDacl(token, &default_dacl)) | 64 if (!GetDefaultDacl(token, &default_dacl)) |
| 64 return false; | 65 return false; |
| 65 | 66 |
| 66 ACL* new_dacl = NULL; | 67 ACL* new_dacl = NULL; |
| 67 if (!AddSidToDacl(sid, default_dacl->DefaultDacl, access, &new_dacl)) | 68 if (!AddSidToDacl(sid, default_dacl->DefaultDacl, access, &new_dacl)) |
| 68 return false; | 69 return false; |
| 69 | 70 |
| 70 TOKEN_DEFAULT_DACL new_token_dacl = {0}; | 71 TOKEN_DEFAULT_DACL new_token_dacl = {0}; |
| 71 new_token_dacl.DefaultDacl = new_dacl; | 72 new_token_dacl.DefaultDacl = new_dacl; |
| 72 | 73 |
| 73 BOOL ret = ::SetTokenInformation(token, TokenDefaultDacl, &new_token_dacl, | 74 BOOL ret = ::SetTokenInformation(token, TokenDefaultDacl, &new_token_dacl, |
| 74 sizeof(new_token_dacl)); | 75 sizeof(new_token_dacl)); |
| 75 ::LocalFree(new_dacl); | 76 ::LocalFree(new_dacl); |
| 76 return (TRUE == ret); | 77 return (TRUE == ret); |
| 77 } | 78 } |
| 78 | 79 |
| 79 bool AddUserSidToDefaultDacl(HANDLE token, ACCESS_MASK access) { | 80 bool AddUserSidToDefaultDacl(HANDLE token, ACCESS_MASK access) { |
| 80 DWORD size = sizeof(TOKEN_USER) + SECURITY_MAX_SID_SIZE; | 81 DWORD size = sizeof(TOKEN_USER) + SECURITY_MAX_SID_SIZE; |
| 81 TOKEN_USER* token_user = reinterpret_cast<TOKEN_USER*>(malloc(size)); | 82 TOKEN_USER* token_user = reinterpret_cast<TOKEN_USER*>(malloc(size)); |
| 82 | 83 |
| 83 scoped_ptr_malloc<TOKEN_USER> token_user_ptr(token_user); | 84 scoped_ptr<TOKEN_USER, base::FreeDeleter> token_user_ptr(token_user); |
| 84 | 85 |
| 85 if (!::GetTokenInformation(token, TokenUser, token_user, size, &size)) | 86 if (!::GetTokenInformation(token, TokenUser, token_user, size, &size)) |
| 86 return false; | 87 return false; |
| 87 | 88 |
| 88 return AddSidToDefaultDacl(token, | 89 return AddSidToDefaultDacl(token, |
| 89 reinterpret_cast<SID*>(token_user->User.Sid), | 90 reinterpret_cast<SID*>(token_user->User.Sid), |
| 90 access); | 91 access); |
| 91 } | 92 } |
| 92 | 93 |
| 93 bool AddKnownSidToKernelObject(HANDLE object, const Sid& sid, | 94 bool AddKnownSidToKernelObject(HANDLE object, const Sid& sid, |
| (...skipping 19 matching lines...) Expand all Loading... |
| 113 ::LocalFree(new_dacl); | 114 ::LocalFree(new_dacl); |
| 114 ::LocalFree(descriptor); | 115 ::LocalFree(descriptor); |
| 115 | 116 |
| 116 if (ERROR_SUCCESS != result) | 117 if (ERROR_SUCCESS != result) |
| 117 return false; | 118 return false; |
| 118 | 119 |
| 119 return true; | 120 return true; |
| 120 } | 121 } |
| 121 | 122 |
| 122 } // namespace sandbox | 123 } // namespace sandbox |
| OLD | NEW |