| OLD | NEW |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "sandbox/win/src/sandbox_policy_base.h" | 5 #include "sandbox/win/src/sandbox_policy_base.h" |
| 6 | 6 |
| 7 #include <sddl.h> | 7 #include <sddl.h> |
| 8 #include <stddef.h> | 8 #include <stddef.h> |
| 9 #include <stdint.h> | 9 #include <stdint.h> |
| 10 | 10 |
| (...skipping 457 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 468 PRIMARY, lockdown); | 468 PRIMARY, lockdown); |
| 469 if (ERROR_SUCCESS != result) | 469 if (ERROR_SUCCESS != result) |
| 470 return SBOX_ERROR_GENERIC; | 470 return SBOX_ERROR_GENERIC; |
| 471 | 471 |
| 472 // If we're launching on the alternate desktop we need to make sure the | 472 // If we're launching on the alternate desktop we need to make sure the |
| 473 // integrity label on the object is no higher than the sandboxed process's | 473 // integrity label on the object is no higher than the sandboxed process's |
| 474 // integrity level. So, we lower the label on the desktop process if it's | 474 // integrity level. So, we lower the label on the desktop process if it's |
| 475 // not already low enough for our process. | 475 // not already low enough for our process. |
| 476 if (alternate_desktop_handle_ && use_alternate_desktop_ && | 476 if (alternate_desktop_handle_ && use_alternate_desktop_ && |
| 477 integrity_level_ != INTEGRITY_LEVEL_LAST && | 477 integrity_level_ != INTEGRITY_LEVEL_LAST && |
| 478 alternate_desktop_integrity_level_label_ < integrity_level_ && | 478 alternate_desktop_integrity_level_label_ < integrity_level_) { |
| 479 base::win::OSInfo::GetInstance()->version() >= base::win::VERSION_VISTA) { | |
| 480 // Integrity label enum is reversed (higher level is a lower value). | 479 // Integrity label enum is reversed (higher level is a lower value). |
| 481 static_assert(INTEGRITY_LEVEL_SYSTEM < INTEGRITY_LEVEL_UNTRUSTED, | 480 static_assert(INTEGRITY_LEVEL_SYSTEM < INTEGRITY_LEVEL_UNTRUSTED, |
| 482 "Integrity level ordering reversed."); | 481 "Integrity level ordering reversed."); |
| 483 result = SetObjectIntegrityLabel(alternate_desktop_handle_, | 482 result = SetObjectIntegrityLabel(alternate_desktop_handle_, |
| 484 SE_WINDOW_OBJECT, | 483 SE_WINDOW_OBJECT, |
| 485 L"", | 484 L"", |
| 486 GetIntegrityLevelString(integrity_level_)); | 485 GetIntegrityLevelString(integrity_level_)); |
| 487 if (ERROR_SUCCESS != result) | 486 if (ERROR_SUCCESS != result) |
| 488 return SBOX_ERROR_GENERIC; | 487 return SBOX_ERROR_GENERIC; |
| 489 | 488 |
| (...skipping 272 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 762 break; | 761 break; |
| 763 } | 762 } |
| 764 | 763 |
| 765 default: { return SBOX_ERROR_UNSUPPORTED; } | 764 default: { return SBOX_ERROR_UNSUPPORTED; } |
| 766 } | 765 } |
| 767 | 766 |
| 768 return SBOX_ALL_OK; | 767 return SBOX_ALL_OK; |
| 769 } | 768 } |
| 770 | 769 |
| 771 } // namespace sandbox | 770 } // namespace sandbox |
| OLD | NEW |