Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(283)

Side by Side Diff: sandbox/win/src/policy_target_test.cc

Issue 2130753002: Made setting lowbox token a warning. (Closed) Base URL: https://chromium.googlesource.com/chromium/src.git@master
Patch Set: Created 4 years, 5 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
OLDNEW
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be 2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file. 3 // found in the LICENSE file.
4 4
5 #include "base/memory/shared_memory.h" 5 #include "base/memory/shared_memory.h"
6 #include "base/strings/string_number_conversions.h" 6 #include "base/strings/string_number_conversions.h"
7 #include "base/strings/string_piece.h" 7 #include "base/strings/string_piece.h"
8 #include "base/win/scoped_process_information.h" 8 #include "base/win/scoped_process_information.h"
9 #include "base/win/windows_version.h" 9 #include "base/win/windows_version.h"
10 #include "sandbox/win/src/sandbox.h" 10 #include "sandbox/win/src/sandbox.h"
(...skipping 220 matching lines...) Expand 10 before | Expand all | Expand 10 after
231 // Get the path to the sandboxed app. 231 // Get the path to the sandboxed app.
232 wchar_t prog_name[MAX_PATH]; 232 wchar_t prog_name[MAX_PATH];
233 GetModuleFileNameW(NULL, prog_name, MAX_PATH); 233 GetModuleFileNameW(NULL, prog_name, MAX_PATH);
234 234
235 base::string16 arguments(L"\""); 235 base::string16 arguments(L"\"");
236 arguments += prog_name; 236 arguments += prog_name;
237 arguments += L"\" -child 0 wait"; // Don't care about the "state" argument. 237 arguments += L"\" -child 0 wait"; // Don't care about the "state" argument.
238 238
239 // Launch the app. 239 // Launch the app.
240 ResultCode result = SBOX_ALL_OK; 240 ResultCode result = SBOX_ALL_OK;
241 ResultCode warning_result = SBOX_ALL_OK;
241 base::win::ScopedProcessInformation target; 242 base::win::ScopedProcessInformation target;
242 243
243 TargetPolicy* policy = broker->CreatePolicy(); 244 TargetPolicy* policy = broker->CreatePolicy();
244 policy->SetAlternateDesktop(false); 245 policy->SetAlternateDesktop(false);
245 policy->SetTokenLevel(USER_INTERACTIVE, USER_LOCKDOWN); 246 policy->SetTokenLevel(USER_INTERACTIVE, USER_LOCKDOWN);
246 PROCESS_INFORMATION temp_process_info = {}; 247 PROCESS_INFORMATION temp_process_info = {};
247 result = broker->SpawnTarget(prog_name, arguments.c_str(), policy, 248 result = broker->SpawnTarget(prog_name, arguments.c_str(), policy,
248 &temp_process_info); 249 &warning_result, &temp_process_info);
249 base::string16 desktop_name = policy->GetAlternateDesktop(); 250 base::string16 desktop_name = policy->GetAlternateDesktop();
250 policy->Release(); 251 policy->Release();
251 252
252 EXPECT_EQ(SBOX_ALL_OK, result); 253 EXPECT_EQ(SBOX_ALL_OK, result);
253 if (result == SBOX_ALL_OK) 254 if (result == SBOX_ALL_OK)
254 target.Set(temp_process_info); 255 target.Set(temp_process_info);
255 256
256 EXPECT_EQ(1u, ::ResumeThread(target.thread_handle())); 257 EXPECT_EQ(1u, ::ResumeThread(target.thread_handle()));
257 258
258 EXPECT_EQ(static_cast<DWORD>(WAIT_TIMEOUT), 259 EXPECT_EQ(static_cast<DWORD>(WAIT_TIMEOUT),
(...skipping 36 matching lines...) Expand 10 before | Expand all | Expand 10 after
295 // Get the path to the sandboxed app. 296 // Get the path to the sandboxed app.
296 wchar_t prog_name[MAX_PATH]; 297 wchar_t prog_name[MAX_PATH];
297 GetModuleFileNameW(NULL, prog_name, MAX_PATH); 298 GetModuleFileNameW(NULL, prog_name, MAX_PATH);
298 299
299 base::string16 arguments(L"\""); 300 base::string16 arguments(L"\"");
300 arguments += prog_name; 301 arguments += prog_name;
301 arguments += L"\" -child 0 wait"; // Don't care about the "state" argument. 302 arguments += L"\" -child 0 wait"; // Don't care about the "state" argument.
302 303
303 // Launch the app. 304 // Launch the app.
304 ResultCode result = SBOX_ALL_OK; 305 ResultCode result = SBOX_ALL_OK;
306 ResultCode warning_result = SBOX_ALL_OK;
305 base::win::ScopedProcessInformation target; 307 base::win::ScopedProcessInformation target;
306 308
307 TargetPolicy* policy = broker->CreatePolicy(); 309 TargetPolicy* policy = broker->CreatePolicy();
308 policy->SetAlternateDesktop(true); 310 policy->SetAlternateDesktop(true);
309 policy->SetTokenLevel(USER_INTERACTIVE, USER_LOCKDOWN); 311 policy->SetTokenLevel(USER_INTERACTIVE, USER_LOCKDOWN);
310 PROCESS_INFORMATION temp_process_info = {}; 312 PROCESS_INFORMATION temp_process_info = {};
311 result = broker->SpawnTarget(prog_name, arguments.c_str(), policy, 313 result = broker->SpawnTarget(prog_name, arguments.c_str(), policy,
312 &temp_process_info); 314 &warning_result, &temp_process_info);
313 base::string16 desktop_name = policy->GetAlternateDesktop(); 315 base::string16 desktop_name = policy->GetAlternateDesktop();
314 policy->Release(); 316 policy->Release();
315 317
316 EXPECT_EQ(SBOX_ALL_OK, result); 318 EXPECT_EQ(SBOX_ALL_OK, result);
317 if (result == SBOX_ALL_OK) 319 if (result == SBOX_ALL_OK)
318 target.Set(temp_process_info); 320 target.Set(temp_process_info);
319 321
320 EXPECT_EQ(1u, ::ResumeThread(target.thread_handle())); 322 EXPECT_EQ(1u, ::ResumeThread(target.thread_handle()));
321 323
322 EXPECT_EQ(static_cast<DWORD>(WAIT_TIMEOUT), 324 EXPECT_EQ(static_cast<DWORD>(WAIT_TIMEOUT),
(...skipping 52 matching lines...) Expand 10 before | Expand all | Expand 10 after
375 policy->AddHandleToShare(read_only_view.handle().GetHandle()); 377 policy->AddHandleToShare(read_only_view.handle().GetHandle());
376 378
377 base::string16 arguments(L"\""); 379 base::string16 arguments(L"\"");
378 arguments += prog_name; 380 arguments += prog_name;
379 arguments += L"\" -child 0 shared_memory_handle "; 381 arguments += L"\" -child 0 shared_memory_handle ";
380 arguments += base::UintToString16( 382 arguments += base::UintToString16(
381 base::win::HandleToUint32(read_only_view.handle().GetHandle())); 383 base::win::HandleToUint32(read_only_view.handle().GetHandle()));
382 384
383 // Launch the app. 385 // Launch the app.
384 ResultCode result = SBOX_ALL_OK; 386 ResultCode result = SBOX_ALL_OK;
387 ResultCode warning_result = SBOX_ALL_OK;
385 base::win::ScopedProcessInformation target; 388 base::win::ScopedProcessInformation target;
386 389
387 policy->SetTokenLevel(USER_INTERACTIVE, USER_LOCKDOWN); 390 policy->SetTokenLevel(USER_INTERACTIVE, USER_LOCKDOWN);
388 PROCESS_INFORMATION temp_process_info = {}; 391 PROCESS_INFORMATION temp_process_info = {};
389 result = broker->SpawnTarget(prog_name, arguments.c_str(), policy, 392 result = broker->SpawnTarget(prog_name, arguments.c_str(), policy,
390 &temp_process_info); 393 &warning_result, &temp_process_info);
391 policy->Release(); 394 policy->Release();
392 395
393 EXPECT_EQ(SBOX_ALL_OK, result); 396 EXPECT_EQ(SBOX_ALL_OK, result);
394 if (result == SBOX_ALL_OK) 397 if (result == SBOX_ALL_OK)
395 target.Set(temp_process_info); 398 target.Set(temp_process_info);
396 399
397 EXPECT_EQ(1u, ::ResumeThread(target.thread_handle())); 400 EXPECT_EQ(1u, ::ResumeThread(target.thread_handle()));
398 401
399 EXPECT_EQ(static_cast<DWORD>(WAIT_TIMEOUT), 402 EXPECT_EQ(static_cast<DWORD>(WAIT_TIMEOUT),
400 ::WaitForSingleObject(target.process_handle(), 2000)); 403 ::WaitForSingleObject(target.process_handle(), 2000));
401 404
402 EXPECT_TRUE(::TerminateProcess(target.process_handle(), 0)); 405 EXPECT_TRUE(::TerminateProcess(target.process_handle(), 0));
403 406
404 ::WaitForSingleObject(target.process_handle(), INFINITE); 407 ::WaitForSingleObject(target.process_handle(), INFINITE);
405 } 408 }
406 409
407 } // namespace sandbox 410 } // namespace sandbox
OLDNEW

Powered by Google App Engine
This is Rietveld 408576698