| OLD | NEW |
|---|
| (Empty) |
| 1 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved. | |
| 2 // Use of this source code is governed by a BSD-style license that can be | |
| 3 // found in the LICENSE file. | |
| 4 | |
| 5 #include "sandbox/win/src/policy_target.h" | |
| 6 | |
| 7 #include <stddef.h> | |
| 8 | |
| 9 #include "sandbox/win/src/crosscall_client.h" | |
| 10 #include "sandbox/win/src/ipc_tags.h" | |
| 11 #include "sandbox/win/src/policy_engine_processor.h" | |
| 12 #include "sandbox/win/src/policy_low_level.h" | |
| 13 #include "sandbox/win/src/policy_params.h" | |
| 14 #include "sandbox/win/src/sandbox_factory.h" | |
| 15 #include "sandbox/win/src/sandbox_nt_util.h" | |
| 16 #include "sandbox/win/src/sharedmem_ipc_client.h" | |
| 17 #include "sandbox/win/src/target_services.h" | |
| 18 | |
| 19 namespace sandbox { | |
| 20 | |
| 21 // Handle for our private heap. | |
| 22 extern void* g_heap; | |
| 23 | |
| 24 // This is the list of all imported symbols from ntdll.dll. | |
| 25 SANDBOX_INTERCEPT NtExports g_nt; | |
| 26 | |
| 27 // Policy data. | |
| 28 extern void* volatile g_shared_policy_memory; | |
| 29 SANDBOX_INTERCEPT size_t g_shared_policy_size; | |
| 30 | |
| 31 bool QueryBroker(int ipc_id, CountedParameterSetBase* params) { | |
| 32 DCHECK_NT(static_cast<size_t>(ipc_id) < kMaxServiceCount); | |
| 33 DCHECK_NT(g_shared_policy_memory); | |
| 34 DCHECK_NT(g_shared_policy_size > 0); | |
| 35 | |
| 36 if (static_cast<size_t>(ipc_id) >= kMaxServiceCount) | |
| 37 return false; | |
| 38 | |
| 39 PolicyGlobal* global_policy = | |
| 40 reinterpret_cast<PolicyGlobal*>(g_shared_policy_memory); | |
| 41 | |
| 42 if (!global_policy->entry[ipc_id]) | |
| 43 return false; | |
| 44 | |
| 45 PolicyBuffer* policy = reinterpret_cast<PolicyBuffer*>( | |
| 46 reinterpret_cast<char*>(g_shared_policy_memory) + | |
| 47 reinterpret_cast<size_t>(global_policy->entry[ipc_id])); | |
| 48 | |
| 49 if ((reinterpret_cast<size_t>(global_policy->entry[ipc_id]) > | |
| 50 global_policy->data_size) || | |
| 51 (g_shared_policy_size < global_policy->data_size)) { | |
| 52 NOTREACHED_NT(); | |
| 53 return false; | |
| 54 } | |
| 55 | |
| 56 for (int i = 0; i < params->count; i++) { | |
| 57 if (!params->parameters[i].IsValid()) { | |
| 58 NOTREACHED_NT(); | |
| 59 return false; | |
| 60 } | |
| 61 } | |
| 62 | |
| 63 PolicyProcessor processor(policy); | |
| 64 PolicyResult result = processor.Evaluate(kShortEval, params->parameters, | |
| 65 params->count); | |
| 66 DCHECK_NT(POLICY_ERROR != result); | |
| 67 | |
| 68 return POLICY_MATCH == result && ASK_BROKER == processor.GetAction(); | |
| 69 } | |
| 70 | |
| 71 // ----------------------------------------------------------------------- | |
| 72 | |
| 73 // Hooks NtSetInformationThread to block RevertToSelf from being | |
| 74 // called before the actual call to LowerToken. | |
| 75 NTSTATUS WINAPI TargetNtSetInformationThread( | |
| 76 NtSetInformationThreadFunction orig_SetInformationThread, HANDLE thread, | |
| 77 NT_THREAD_INFORMATION_CLASS thread_info_class, PVOID thread_information, | |
| 78 ULONG thread_information_bytes) { | |
| 79 do { | |
| 80 if (SandboxFactory::GetTargetServices()->GetState()->RevertedToSelf()) | |
| 81 break; | |
| 82 if (ThreadImpersonationToken != thread_info_class) | |
| 83 break; | |
| 84 // This is a revert to self. | |
| 85 return STATUS_SUCCESS; | |
| 86 } while (false); | |
| 87 | |
| 88 return orig_SetInformationThread(thread, thread_info_class, | |
| 89 thread_information, | |
| 90 thread_information_bytes); | |
| 91 } | |
| 92 | |
| 93 // Hooks NtOpenThreadToken to force the open_as_self parameter to be set to | |
| 94 // FALSE if we are still running with the impersonation token. open_as_self set | |
| 95 // to TRUE means that the token will be open using the process token instead of | |
| 96 // the impersonation token. This is bad because the process token does not have | |
| 97 // access to open the thread token. | |
| 98 NTSTATUS WINAPI TargetNtOpenThreadToken( | |
| 99 NtOpenThreadTokenFunction orig_OpenThreadToken, HANDLE thread, | |
| 100 ACCESS_MASK desired_access, BOOLEAN open_as_self, PHANDLE token) { | |
| 101 if (!SandboxFactory::GetTargetServices()->GetState()->RevertedToSelf()) | |
| 102 open_as_self = FALSE; | |
| 103 | |
| 104 return orig_OpenThreadToken(thread, desired_access, open_as_self, token); | |
| 105 } | |
| 106 | |
| 107 // See comment for TargetNtOpenThreadToken | |
| 108 NTSTATUS WINAPI TargetNtOpenThreadTokenEx( | |
| 109 NtOpenThreadTokenExFunction orig_OpenThreadTokenEx, HANDLE thread, | |
| 110 ACCESS_MASK desired_access, BOOLEAN open_as_self, ULONG handle_attributes, | |
| 111 PHANDLE token) { | |
| 112 if (!SandboxFactory::GetTargetServices()->GetState()->RevertedToSelf()) | |
| 113 open_as_self = FALSE; | |
| 114 | |
| 115 return orig_OpenThreadTokenEx(thread, desired_access, open_as_self, | |
| 116 handle_attributes, token); | |
| 117 } | |
| 118 | |
| 119 } // namespace sandbox | |
| OLD | NEW |
|---|
Chromium Code Reviews
Issue 1851213002:
Remove sandbox on Windows. (Closed)
Base URL: https://chromium.googlesource.com/chromium/src.git@master