Cleanup/Remove Windows XP/Vista version checks from Windows sandbox code

sandbox/win/src/process_mitigations.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sandbox/win/src/process_mitigations.h"
 
 #include <stddef.h>
 
 #include <algorithm>
 
@@ skipping 20 matching lines @@
 
 namespace sandbox {
 
 bool ApplyProcessMitigationsToCurrentProcess(MitigationFlags flags) {
   if (!CanSetProcessMitigationsPostStartup(flags))
     return false;
 
   base::win::Version version = base::win::GetVersion();
   HMODULE module = ::GetModuleHandleA("kernel32.dll");
 
-  if (version >= base::win::VERSION_VISTA &&
-      (flags & MITIGATION_DLL_SEARCH_ORDER)) {
+  if (flags & MITIGATION_DLL_SEARCH_ORDER) {
     SetDefaultDllDirectoriesFunction set_default_dll_directories =
         reinterpret_cast<SetDefaultDllDirectoriesFunction>(
             ::GetProcAddress(module, "SetDefaultDllDirectories"));
 
     // Check for SetDefaultDllDirectories since it requires KB2533623.
     if (set_default_dll_directories) {
       if (!set_default_dll_directories(LOAD_LIBRARY_SEARCH_DEFAULT_DIRS) &&
           ERROR_ACCESS_DENIED != ::GetLastError()) {
         return false;
       }
     }
   }
 
   // Set the heap to terminate on corruption
-  if (version >= base::win::VERSION_VISTA &&
-      (flags & MITIGATION_HEAP_TERMINATE)) {
+  if (flags & MITIGATION_HEAP_TERMINATE) {
     if (!::HeapSetInformation(NULL, HeapEnableTerminationOnCorruption,
                               NULL, 0) &&
         ERROR_ACCESS_DENIED != ::GetLastError()) {
       return false;
     }
   }
 
-  if (version >= base::win::VERSION_WIN7 &&
-      (flags & MITIGATION_HARDEN_TOKEN_IL_POLICY)) {
+  if (flags & MITIGATION_HARDEN_TOKEN_IL_POLICY) {
       DWORD error = HardenProcessIntegrityLevelPolicy();
       if ((error != ERROR_SUCCESS) && (error != ERROR_ACCESS_DENIED))
         return false;
   }
 
 #if !defined(_WIN64)  // DEP is always enabled on 64-bit.
   if (flags & MITIGATION_DEP) {
     DWORD dep_flags = PROCESS_DEP_ENABLE;
-    // DEP support is quirky on XP, so don't force a failure in that case.
-    const bool return_on_fail = version >= base::win::VERSION_VISTA;
 
     if (flags & MITIGATION_DEP_NO_ATL_THUNK)
       dep_flags |= PROCESS_DEP_DISABLE_ATL_THUNK_EMULATION;
 
     SetProcessDEPPolicyFunction set_process_dep_policy =
         reinterpret_cast<SetProcessDEPPolicyFunction>(
             ::GetProcAddress(module, "SetProcessDEPPolicy"));
     if (set_process_dep_policy) {
       if (!set_process_dep_policy(dep_flags) &&
-          ERROR_ACCESS_DENIED != ::GetLastError() && return_on_fail) {
-        return false;
-      }
-    } else {
-      // We're on XP sp2, so use the less standard approach.
-      // For reference: http://www.uninformed.org/?v=2&a=4
-      static const int MEM_EXECUTE_OPTION_DISABLE = 2;
-      static const int MEM_EXECUTE_OPTION_ATL7_THUNK_EMULATION = 4;
-      static const int MEM_EXECUTE_OPTION_PERMANENT = 8;
-
-      NtSetInformationProcessFunction set_information_process = NULL;
-      ResolveNTFunctionPtr("NtSetInformationProcess",
-                           &set_information_process);
-      if (!set_information_process)
-        return false;
-      ULONG dep = MEM_EXECUTE_OPTION_DISABLE | MEM_EXECUTE_OPTION_PERMANENT;
-      if (!(dep_flags & PROCESS_DEP_DISABLE_ATL_THUNK_EMULATION))
-        dep |= MEM_EXECUTE_OPTION_ATL7_THUNK_EMULATION;
-      if (!SUCCEEDED(set_information_process(GetCurrentProcess(),
-                                             ProcessExecuteFlags,
-                                             &dep, sizeof(dep))) &&
-          ERROR_ACCESS_DENIED != ::GetLastError() && return_on_fail) {
+          ERROR_ACCESS_DENIED != ::GetLastError()) {
         return false;

[Will Harris, 2016/03/17 23:05:59]

I think this needs more return false for more failure cases

[kylix_rd, 2016/03/21 19:09:09]

Done.

       }
     }
   }
 #endif
 
   // This is all we can do in Win7 and below.
   if (version < base::win::VERSION_WIN8)
     return true;
 
   SetProcessMitigationPolicyFunction set_process_mitigation_policy =
@@ skipping 102 matching lines @@
 #elif defined(_M_IX86)
   // A 64-bit flags attribute is illegal on 32-bit Win 7 and below.
   if (version < base::win::VERSION_WIN8)
     *size = sizeof(DWORD);
   else
     *size = sizeof(*policy_flags);
 #else
 #error This platform is not supported.
 #endif
 
-  // Nothing for Win XP or Vista.
-  if (version <= base::win::VERSION_VISTA)
-    return;
-
   // DEP and SEHOP are not valid for 64-bit Windows
 #if !defined(_WIN64)
   if (flags & MITIGATION_DEP) {
     *policy_flags |= PROCESS_CREATION_MITIGATION_POLICY_DEP_ENABLE;
     if (!(flags & MITIGATION_DEP_NO_ATL_THUNK))
       *policy_flags |= PROCESS_CREATION_MITIGATION_POLICY_DEP_ATL_THUNK_ENABLE;
   }
 
   if (flags & MITIGATION_SEHOP)
     *policy_flags |= PROCESS_CREATION_MITIGATION_POLICY_SEHOP_ENABLE;
@@ skipping 59 matching lines @@
 
   if (flags & MITIGATION_IMAGE_LOAD_NO_LOW_LABEL) {
     *policy_flags |=
         PROCESS_CREATION_MITIGATION_POLICY_IMAGE_LOAD_NO_LOW_LABEL_ALWAYS_ON;
   }
 }
 
 MitigationFlags FilterPostStartupProcessMitigations(MitigationFlags flags) {
   base::win::Version version = base::win::GetVersion();
 
-  // Windows XP SP2+.
-  if (version < base::win::VERSION_VISTA) {
-    return flags & (MITIGATION_DEP |
-                    MITIGATION_DEP_NO_ATL_THUNK);
-  }
-
-  // Windows Vista
-  if (version < base::win::VERSION_WIN7) {
-    return flags & (MITIGATION_BOTTOM_UP_ASLR |
-                    MITIGATION_DLL_SEARCH_ORDER |
-                    MITIGATION_HEAP_TERMINATE);
-  }
-
   // Windows 7.
   if (version < base::win::VERSION_WIN8) {
     return flags & (MITIGATION_BOTTOM_UP_ASLR |
                     MITIGATION_DLL_SEARCH_ORDER |
                     MITIGATION_HEAP_TERMINATE);
   }
 
   // Windows 8 and above.
   return flags & (MITIGATION_BOTTOM_UP_ASLR |
                   MITIGATION_DLL_SEARCH_ORDER);
@@ skipping 47 matching lines @@
 }
 
 bool CanSetProcessMitigationsPreStartup(MitigationFlags flags) {
   // These mitigations cannot be enabled prior to startup.
   return !(flags & (MITIGATION_STRICT_HANDLE_CHECKS |
                     MITIGATION_DLL_SEARCH_ORDER));
 }
 
 }  // namespace sandbox