Add header comments documenting extra constraints for some sandbox mitigations: MITIGATION_RELOCATE…

sandbox/win/src/process_mitigations_test.cc

 // Copyright 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sandbox/win/src/process_mitigations.h"
 
 #include <d3d9.h>
 #include <initguid.h>
 #include <opmapi.h>
 #include <psapi.h>
@@ skipping 52 matching lines @@
 bool CheckWin8DepPolicy() {
   PROCESS_MITIGATION_DEP_POLICY policy = {};
   if (!get_process_mitigation_policy(::GetCurrentProcess(), ProcessDEPPolicy,
                                      &policy, sizeof(policy))) {
     return false;
   }
   return policy.Enable && policy.Permanent;
 }
 #endif  // !defined(_WIN64)
 
-#if defined(NDEBUG)
 bool CheckWin8AslrPolicy() {
   PROCESS_MITIGATION_ASLR_POLICY policy = {};
   if (!get_process_mitigation_policy(::GetCurrentProcess(), ProcessASLRPolicy,
                                      &policy, sizeof(policy))) {
     return false;
   }
   return policy.EnableForceRelocateImages && policy.DisallowStrippedImages;
 }
-#endif  // defined(NDEBUG)
 
 bool CheckWin8StrictHandlePolicy() {
   PROCESS_MITIGATION_STRICT_HANDLE_CHECK_POLICY policy = {};
   if (!get_process_mitigation_policy(::GetCurrentProcess(),
                                      ProcessStrictHandleCheckPolicy, &policy,
                                      sizeof(policy))) {
     return false;
   }
   return policy.RaiseExceptionOnInvalidHandleReference &&
          policy.HandleExceptionsPermanentlyEnabled;
@@ skipping 743 matching lines @@
     setup_proc.Terminate(desired_exit_code, false);
     return SBOX_TEST_SUCCEEDED;
   }
   // Note: GetLastError from CreateProcess returns 5, "ERROR_ACCESS_DENIED".
   return SBOX_TEST_FAILED;
 }
 
 //------------------------------------------------------------------------------
 // Win8 Checks:
 // MITIGATION_DEP(_NO_ATL_THUNK)
-// MITIGATION_RELOCATE_IMAGE(_REQUIRED) - ASLR, release only
+// MITIGATION_RELOCATE_IMAGE(_REQUIRED) - ASLR
 // MITIGATION_STRICT_HANDLE_CHECKS
 // >= Win8
 //------------------------------------------------------------------------------
 
 SBOX_TESTS_COMMAND int CheckWin8(int argc, wchar_t** argv) {
   get_process_mitigation_policy =
       reinterpret_cast<GetProcessMitigationPolicyFunction>(::GetProcAddress(
           ::GetModuleHandleW(L"kernel32.dll"), "GetProcessMitigationPolicy"));
   if (!get_process_mitigation_policy)
     return SBOX_TEST_NOT_FOUND;
 
 #if !defined(_WIN64)  // DEP is always enabled on 64-bit.
   if (!CheckWin8DepPolicy())
     return SBOX_TEST_FIRST_ERROR;
 #endif
 
-#if defined(NDEBUG)  // ASLR cannot be forced in debug builds.
   if (!CheckWin8AslrPolicy())
     return SBOX_TEST_SECOND_ERROR;
-#endif
 
   if (!CheckWin8StrictHandlePolicy())
     return SBOX_TEST_THIRD_ERROR;
 
   return SBOX_TEST_SUCCEEDED;
 }
 
 TEST(ProcessMitigationsTest, CheckWin8) {
   if (base::win::GetVersion() < base::win::VERSION_WIN8)
     return;
 
   TestRunner runner;
   sandbox::TargetPolicy* policy = runner.GetPolicy();
 
+  // ASLR cannot be forced on start in debug builds.
+  constexpr sandbox::MitigationFlags kDebugDelayedMitigations =
+      MITIGATION_RELOCATE_IMAGE | MITIGATION_RELOCATE_IMAGE_REQUIRED;
+
   sandbox::MitigationFlags mitigations =
       MITIGATION_DEP | MITIGATION_DEP_NO_ATL_THUNK;
-#if defined(NDEBUG)  // ASLR cannot be forced in debug builds.
-  mitigations |= MITIGATION_RELOCATE_IMAGE | MITIGATION_RELOCATE_IMAGE_REQUIRED;
+#if defined(NDEBUG)
+  mitigations |= kDebugDelayedMitigations;
 #endif
 
   EXPECT_EQ(policy->SetProcessMitigations(mitigations), SBOX_ALL_OK);
 
   mitigations |= MITIGATION_STRICT_HANDLE_CHECKS;
 
+#if !defined(NDEBUG)
+  mitigations |= kDebugDelayedMitigations;

[Will Harris, 2016/09/26 18:31:38]

do you really mean to add these mitigations twice, once on L884 and again here?

[Joe Mason, 2016/09/26 19:39:57]

That's NDEBUG, this is !NDEBUG. "DebugDelayedMitigations" are only delayed in
debug builds.

+#endif
+
   EXPECT_EQ(policy->SetDelayedProcessMitigations(mitigations), SBOX_ALL_OK);
 
   EXPECT_EQ(SBOX_TEST_SUCCEEDED, runner.RunTest(L"CheckWin8"));
 }
 
 //------------------------------------------------------------------------------
 // DEP (MITIGATION_DEP)
 // < Win8 x86
 //------------------------------------------------------------------------------
 
@@ skipping 898 matching lines @@
   cmd = cmd.Append(L"calc.exe");
 
   std::wstring test_command(base::StringPrintf(L"TestChildProcess %ls 0x%08X",
                                                cmd.value().c_str(),
                                                STATUS_ACCESS_VIOLATION));
 
   EXPECT_EQ(SBOX_TEST_SUCCEEDED, runner.RunTest(test_command.c_str()));
 }
 
 }  // namespace sandbox