EDK: Add handle rights checking to the various entrypoints.

mojo/edk/system/core.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "mojo/edk/system/core.h"
 
 #include <memory>
 #include <utility>
 #include <vector>
 
@@ skipping 72 matching lines @@
 //      to take another |Dispatcher| lock. (This has consequences on the
 //      concurrency semantics of |MojoWriteMessage()| when passing handles.)
 //      Doing so would lead to deadlock.
 //    - Locks at the "INF" level may not have any locks taken while they are
 //      held.
 
 Core::Core(embedder::PlatformSupport* platform_support)
     : platform_support_(platform_support),
       handle_table_(GetConfiguration().max_handle_table_size) {}
 
-Core::~Core() {
-}
+Core::~Core() {}
 
 MojoHandle Core::AddHandle(Handle&& handle) {
   MutexLocker locker(&handle_table_mutex_);
   return handle_table_.AddHandle(std::move(handle));
 }
 
-MojoResult Core::GetDispatcher(MojoHandle handle,
-                               RefPtr<Dispatcher>* dispatcher) {
+MojoResult Core::GetHandle(MojoHandle handle, Handle* h) {
   if (handle == MOJO_HANDLE_INVALID)
     return MOJO_RESULT_INVALID_ARGUMENT;
 
   MutexLocker locker(&handle_table_mutex_);
+  return handle_table_.GetHandle(handle, h);
+}
+
+MojoResult Core::GetDispatcher(MojoHandle handle,
+                               RefPtr<Dispatcher>* dispatcher) {
   Handle h;
-  MojoResult rv = handle_table_.GetHandle(handle, &h);
-  if (rv == MOJO_RESULT_OK)
+  MojoResult result = GetHandle(handle, &h);
+  if (result == MOJO_RESULT_OK)
     *dispatcher = std::move(h.dispatcher);
-  return rv;
+  return result;
 }
 
 MojoResult Core::GetAndRemoveDispatcher(MojoHandle handle,
                                         RefPtr<Dispatcher>* dispatcher) {
   if (handle == MOJO_HANDLE_INVALID)
     return MOJO_RESULT_INVALID_ARGUMENT;
 
   MutexLocker locker(&handle_table_mutex_);
   Handle h;
-  MojoResult rv = handle_table_.GetAndRemoveHandle(handle, &h);
-  if (rv == MOJO_RESULT_OK)
+  MojoResult result = handle_table_.GetAndRemoveHandle(handle, &h);
+  if (result == MOJO_RESULT_OK)
     *dispatcher = std::move(h.dispatcher);
-  return rv;
+  return result;
+}
+
+MojoResult Core::GetDispatcherAndCheckRights(
+    MojoHandle handle,
+    MojoHandleRights required_handle_rights,
+    EntrypointClass entrypoint_class,
+    util::RefPtr<Dispatcher>* dispatcher) {
+  if (handle == MOJO_HANDLE_INVALID)
+    return MOJO_RESULT_INVALID_ARGUMENT;
+
+  Handle h;
+  MojoResult result = GetHandle(handle, &h);
+  if (result != MOJO_RESULT_OK)
+    return result;
+
+  if ((h.rights & required_handle_rights) != required_handle_rights) {
+    return h.dispatcher->SupportsEntrypointClass(entrypoint_class)
+               ? MOJO_RESULT_PERMISSION_DENIED
+               : MOJO_RESULT_INVALID_ARGUMENT;
+  }
+
+  *dispatcher = std::move(h.dispatcher);
+  return MOJO_RESULT_OK;
 }
 
 MojoResult Core::AsyncWait(MojoHandle handle,
                            MojoHandleSignals signals,
                            const std::function<void(MojoResult)>& callback) {
   RefPtr<Dispatcher> dispatcher;
-  MojoResult result = GetDispatcher(handle, &dispatcher);
+  MojoResult result = GetDispatcherAndCheckRights(
+      handle, MOJO_HANDLE_RIGHT_NONE, EntrypointClass::NONE, &dispatcher);
   if (result != MOJO_RESULT_OK)
     return result;
 
   std::unique_ptr<AsyncWaiter> waiter(new AsyncWaiter(callback));
   result = dispatcher->AddAwakable(waiter.get(), signals, 0, nullptr);
   if (result == MOJO_RESULT_OK)
     ignore_result(waiter.release());
   return result;
 }
 
@@ skipping 116 matching lines @@
 // isn't done, in the in-process case, calls on the old handle may complete
 // after the the message has been received and a new handle created (and
 // possibly even after calls have been made on the new handle).
 MojoResult Core::WriteMessage(MojoHandle message_pipe_handle,
                               UserPointer<const void> bytes,
                               uint32_t num_bytes,
                               UserPointer<const MojoHandle> handles,
                               uint32_t num_handles,
                               MojoWriteMessageFlags flags) {
   RefPtr<Dispatcher> dispatcher;
-  MojoResult result = GetDispatcher(message_pipe_handle, &dispatcher);
+  MojoResult result =
+      GetDispatcherAndCheckRights(message_pipe_handle, MOJO_HANDLE_RIGHT_WRITE,
+                                  EntrypointClass::MESSAGE_PIPE, &dispatcher);
   if (result != MOJO_RESULT_OK)
     return result;
 
   // Easy case: not sending any handles.
   if (num_handles == 0)
     return dispatcher->WriteMessage(bytes, num_bytes, nullptr, flags);
 
   // We have to handle |handles| here, since we have to mark them busy in the
   // global handle table. We can't delegate this to the dispatcher, since the
   // handle table lock must be acquired before the dispatcher lock.
@@ skipping 46 matching lines @@
   return result;
 }
 
 MojoResult Core::ReadMessage(MojoHandle message_pipe_handle,
                              UserPointer<void> bytes,
                              UserPointer<uint32_t> num_bytes,
                              UserPointer<MojoHandle> handles,
                              UserPointer<uint32_t> num_handles,
                              MojoReadMessageFlags flags) {
   RefPtr<Dispatcher> dispatcher;
-  MojoResult result = GetDispatcher(message_pipe_handle, &dispatcher);
+  MojoResult result =
+      GetDispatcherAndCheckRights(message_pipe_handle, MOJO_HANDLE_RIGHT_READ,
+                                  EntrypointClass::MESSAGE_PIPE, &dispatcher);
   if (result != MOJO_RESULT_OK)
     return result;
 
   uint32_t num_handles_value = num_handles.IsNull() ? 0 : num_handles.Get();
 
   if (num_handles_value == 0) {
     // Easy case: won't receive any handles.
     result = dispatcher->ReadMessage(bytes, num_bytes, nullptr,
                                      &num_handles_value, flags);
   } else {
@@ skipping 70 matching lines @@
 
   data_pipe_producer_handle.Put(handle_pair.first);
   data_pipe_consumer_handle.Put(handle_pair.second);
   return MOJO_RESULT_OK;
 }
 
 MojoResult Core::SetDataPipeProducerOptions(
     MojoHandle data_pipe_producer_handle,
     UserPointer<const MojoDataPipeProducerOptions> options) {
   RefPtr<Dispatcher> dispatcher;
-  MojoResult result = GetDispatcher(data_pipe_producer_handle, &dispatcher);
+  MojoResult result = GetDispatcherAndCheckRights(
+      data_pipe_producer_handle, MOJO_HANDLE_RIGHT_WRITE,
+      EntrypointClass::DATA_PIPE_PRODUCER, &dispatcher);
   if (result != MOJO_RESULT_OK)
     return result;
 
   return dispatcher->SetDataPipeProducerOptions(options);
 }
 
 MojoResult Core::GetDataPipeProducerOptions(
     MojoHandle data_pipe_producer_handle,
     UserPointer<MojoDataPipeProducerOptions> options,
     uint32_t options_num_bytes) {
   RefPtr<Dispatcher> dispatcher;
-  MojoResult result = GetDispatcher(data_pipe_producer_handle, &dispatcher);
+  MojoResult result = GetDispatcherAndCheckRights(
+      data_pipe_producer_handle, MOJO_HANDLE_RIGHT_READ,
+      EntrypointClass::DATA_PIPE_PRODUCER, &dispatcher);
   if (result != MOJO_RESULT_OK)
     return result;
 
   return dispatcher->GetDataPipeProducerOptions(options, options_num_bytes);
 }
 
 MojoResult Core::WriteData(MojoHandle data_pipe_producer_handle,
                            UserPointer<const void> elements,
                            UserPointer<uint32_t> num_bytes,
                            MojoWriteDataFlags flags) {
   RefPtr<Dispatcher> dispatcher;
-  MojoResult result = GetDispatcher(data_pipe_producer_handle, &dispatcher);
+  MojoResult result = GetDispatcherAndCheckRights(
+      data_pipe_producer_handle, MOJO_HANDLE_RIGHT_WRITE,
+      EntrypointClass::DATA_PIPE_PRODUCER, &dispatcher);
   if (result != MOJO_RESULT_OK)
     return result;
 
   return dispatcher->WriteData(elements, num_bytes, flags);
 }
 
 MojoResult Core::BeginWriteData(MojoHandle data_pipe_producer_handle,
                                 UserPointer<void*> buffer,
                                 UserPointer<uint32_t> buffer_num_bytes,
                                 MojoWriteDataFlags flags) {
   RefPtr<Dispatcher> dispatcher;
-  MojoResult result = GetDispatcher(data_pipe_producer_handle, &dispatcher);
+  MojoResult result = GetDispatcherAndCheckRights(
+      data_pipe_producer_handle, MOJO_HANDLE_RIGHT_WRITE,
+      EntrypointClass::DATA_PIPE_PRODUCER, &dispatcher);
   if (result != MOJO_RESULT_OK)
     return result;
 
   return dispatcher->BeginWriteData(buffer, buffer_num_bytes, flags);
 }
 
 MojoResult Core::EndWriteData(MojoHandle data_pipe_producer_handle,
                               uint32_t num_bytes_written) {
   RefPtr<Dispatcher> dispatcher;
-  MojoResult result = GetDispatcher(data_pipe_producer_handle, &dispatcher);
+  MojoResult result = GetDispatcherAndCheckRights(
+      data_pipe_producer_handle, MOJO_HANDLE_RIGHT_WRITE,
+      EntrypointClass::DATA_PIPE_PRODUCER, &dispatcher);
   if (result != MOJO_RESULT_OK)
     return result;
 
   return dispatcher->EndWriteData(num_bytes_written);
 }
 
 MojoResult Core::SetDataPipeConsumerOptions(
     MojoHandle data_pipe_consumer_handle,
     UserPointer<const MojoDataPipeConsumerOptions> options) {
   RefPtr<Dispatcher> dispatcher;
-  MojoResult result = GetDispatcher(data_pipe_consumer_handle, &dispatcher);
+  MojoResult result = GetDispatcherAndCheckRights(
+      data_pipe_consumer_handle, MOJO_HANDLE_RIGHT_WRITE,
+      EntrypointClass::DATA_PIPE_CONSUMER, &dispatcher);
   if (result != MOJO_RESULT_OK)
     return result;
 
   return dispatcher->SetDataPipeConsumerOptions(options);
 }
 
 MojoResult Core::GetDataPipeConsumerOptions(
     MojoHandle data_pipe_consumer_handle,
     UserPointer<MojoDataPipeConsumerOptions> options,
     uint32_t options_num_bytes) {
   RefPtr<Dispatcher> dispatcher;
-  MojoResult result = GetDispatcher(data_pipe_consumer_handle, &dispatcher);
+  MojoResult result = GetDispatcherAndCheckRights(
+      data_pipe_consumer_handle, MOJO_HANDLE_RIGHT_READ,
+      EntrypointClass::DATA_PIPE_CONSUMER, &dispatcher);
   if (result != MOJO_RESULT_OK)
     return result;
 
   return dispatcher->GetDataPipeConsumerOptions(options, options_num_bytes);
 }
 
 MojoResult Core::ReadData(MojoHandle data_pipe_consumer_handle,
                           UserPointer<void> elements,
                           UserPointer<uint32_t> num_bytes,
                           MojoReadDataFlags flags) {
   RefPtr<Dispatcher> dispatcher;
-  MojoResult result = GetDispatcher(data_pipe_consumer_handle, &dispatcher);
+  MojoResult result = GetDispatcherAndCheckRights(
+      data_pipe_consumer_handle, MOJO_HANDLE_RIGHT_READ,
+      EntrypointClass::DATA_PIPE_CONSUMER, &dispatcher);
   if (result != MOJO_RESULT_OK)
     return result;
 
   return dispatcher->ReadData(elements, num_bytes, flags);
 }
 
 MojoResult Core::BeginReadData(MojoHandle data_pipe_consumer_handle,
                                UserPointer<const void*> buffer,
                                UserPointer<uint32_t> buffer_num_bytes,
                                MojoReadDataFlags flags) {
   RefPtr<Dispatcher> dispatcher;
-  MojoResult result = GetDispatcher(data_pipe_consumer_handle, &dispatcher);
+  MojoResult result = GetDispatcherAndCheckRights(
+      data_pipe_consumer_handle, MOJO_HANDLE_RIGHT_READ,
+      EntrypointClass::DATA_PIPE_CONSUMER, &dispatcher);
   if (result != MOJO_RESULT_OK)
     return result;
 
   return dispatcher->BeginReadData(buffer, buffer_num_bytes, flags);
 }
 
 MojoResult Core::EndReadData(MojoHandle data_pipe_consumer_handle,
                              uint32_t num_bytes_read) {
   RefPtr<Dispatcher> dispatcher;
-  MojoResult result = GetDispatcher(data_pipe_consumer_handle, &dispatcher);
+  MojoResult result = GetDispatcherAndCheckRights(
+      data_pipe_consumer_handle, MOJO_HANDLE_RIGHT_READ,
+      EntrypointClass::DATA_PIPE_CONSUMER, &dispatcher);
   if (result != MOJO_RESULT_OK)
     return result;
 
   return dispatcher->EndReadData(num_bytes_read);
 }
 
 MojoResult Core::CreateSharedBuffer(
     UserPointer<const MojoCreateSharedBufferOptions> options,
     uint64_t num_bytes,
     UserPointer<MojoHandle> shared_buffer_handle) {
@@ skipping 19 matching lines @@
   }
 
   shared_buffer_handle.Put(h);
   return MOJO_RESULT_OK;
 }
 
 MojoResult Core::DuplicateBufferHandle(
     MojoHandle buffer_handle,
     UserPointer<const MojoDuplicateBufferHandleOptions> options,
     UserPointer<MojoHandle> new_buffer_handle) {
-  RefPtr<Dispatcher> dispatcher;
-  MojoResult result = GetDispatcher(buffer_handle, &dispatcher);
+  // TODO(vtl): This is a big ugly and duplicates some code, but the plan is to
+  // remove this method anyway.
+  Handle h;
+  MojoResult result = GetHandle(buffer_handle, &h);
   if (result != MOJO_RESULT_OK)
     return result;
 
+  if (!(h.rights & MOJO_HANDLE_RIGHT_DUPLICATE)) {
+    return h.dispatcher->SupportsEntrypointClass(EntrypointClass::BUFFER)
+               ? MOJO_RESULT_PERMISSION_DENIED
+               : MOJO_RESULT_INVALID_ARGUMENT;
+  }
+
   // Don't verify |options| here; that's the dispatcher's job.
   RefPtr<Dispatcher> new_dispatcher;
-  result = dispatcher->DuplicateBufferHandle(options, &new_dispatcher);
+  result = h.dispatcher->DuplicateBufferHandle(options, &new_dispatcher);
   if (result != MOJO_RESULT_OK)
     return result;
 
-  // TODO(vtl): This should be done with the original handle's rights.
-  MojoHandle new_handle = AddHandle(Handle(
-      new_dispatcher.Clone(), SharedBufferDispatcher::kDefaultHandleRights));
+  MojoHandle new_handle = AddHandle(Handle(new_dispatcher.Clone(), h.rights));
   if (new_handle == MOJO_HANDLE_INVALID) {
     LOG(ERROR) << "Handle table full";
     new_dispatcher->Close();
     return MOJO_RESULT_RESOURCE_EXHAUSTED;
   }
 
   new_buffer_handle.Put(new_handle);
   return MOJO_RESULT_OK;
 }
 
 MojoResult Core::GetBufferInformation(MojoHandle buffer_handle,
                                       UserPointer<MojoBufferInformation> info,
                                       uint32_t info_num_bytes) {
   RefPtr<Dispatcher> dispatcher;
-  MojoResult result = GetDispatcher(buffer_handle, &dispatcher);
+  MojoResult result =
+      GetDispatcherAndCheckRights(buffer_handle, MOJO_HANDLE_RIGHT_READ,
+                                  EntrypointClass::BUFFER, &dispatcher);
   if (result != MOJO_RESULT_OK)
     return result;
 
   return dispatcher->GetBufferInformation(info, info_num_bytes);
 }
 
 MojoResult Core::MapBuffer(MojoHandle buffer_handle,
                            uint64_t offset,
                            uint64_t num_bytes,
                            UserPointer<void*> buffer,
                            MojoMapBufferFlags flags) {
   RefPtr<Dispatcher> dispatcher;
-  MojoResult result = GetDispatcher(buffer_handle, &dispatcher);
+  // TODO(vtl): Is this right? Or should there be a "map" right? Probably I need
+  // to rethink rights for buffers.
+  MojoResult result =
+      GetDispatcherAndCheckRights(buffer_handle, MOJO_HANDLE_RIGHT_WRITE,
+                                  EntrypointClass::BUFFER, &dispatcher);
   if (result != MOJO_RESULT_OK)
     return result;
 
   std::unique_ptr<PlatformSharedBufferMapping> mapping;
   result = dispatcher->MapBuffer(offset, num_bytes, flags, &mapping);
   if (result != MOJO_RESULT_OK)
     return result;
 
   DCHECK(mapping);
   void* address = mapping->GetBase();
@@ skipping 78 matching lines @@
   if (signals_states) {
     for (; i < num_handles; i++)
       signals_states[i] = dispatchers[i]->GetHandleSignalsState();
   }
 
   return result;
 }
 
 }  // namespace system
 }  // namespace mojo