Mojo EDK: Add safe process connection API

remoting/host/win/unprivileged_process_delegate.cc

 
 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 //
 // This file implements the Windows service controlling Me2Me host processes
 // running within user sessions.
 
 #include "remoting/host/win/unprivileged_process_delegate.h"
 
 #include <sddl.h>
 
 #include <utility>
 
 #include "base/command_line.h"
 #include "base/files/file.h"
 #include "base/logging.h"
 #include "base/rand_util.h"
 #include "base/single_thread_task_runner.h"
 #include "base/strings/string16.h"
 #include "base/strings/stringprintf.h"
 #include "base/strings/utf_string_conversions.h"
 #include "base/synchronization/lock.h"
 #include "base/win/scoped_handle.h"
 #include "ipc/ipc_channel.h"
 #include "ipc/ipc_channel_proxy.h"
 #include "ipc/ipc_message.h"
 #include "mojo/edk/embedder/embedder.h"
+#include "mojo/edk/embedder/pending_process_connection.h"
 #include "mojo/edk/embedder/platform_channel_pair.h"
 #include "remoting/base/typed_buffer.h"
 #include "remoting/host/switches.h"
 #include "remoting/host/win/launch_process_with_token.h"
 #include "remoting/host/win/security_descriptor.h"
 #include "remoting/host/win/window_station_and_desktop.h"
 #include "sandbox/win/src/restricted_token.h"
 
 using base::win::ScopedHandle;
 
@@ skipping 237 matching lines @@
   thread_attributes.bInheritHandle = FALSE;
 
   // Create our own window station and desktop accessible by |logon_sid|.
   WindowStationAndDesktop handles;
   if (!CreateWindowStationAndDesktop(std::move(logon_sid), &handles)) {
     PLOG(ERROR) << "Failed to create a window station and desktop";
     ReportFatalError();
     return;
   }
 
-  const std::string mojo_child_token = mojo::edk::GenerateRandomToken();
-  const std::string mojo_message_pipe_token = mojo::edk::GenerateRandomToken();
-
+  mojo::edk::PendingProcessConnection process;
+  std::string mojo_message_pipe_token;
   std::unique_ptr<IPC::ChannelProxy> server = IPC::ChannelProxy::Create(
-      mojo::edk::CreateParentMessagePipe(mojo_message_pipe_token,
-                                         mojo_child_token)
-          .release(),
+      process.CreateMessagePipe(&mojo_message_pipe_token).release(),
       IPC::Channel::MODE_SERVER, this, io_task_runner_);
   base::CommandLine command_line(target_command_->argv());
   command_line.AppendSwitchASCII(kMojoPipeToken, mojo_message_pipe_token);
 
   base::HandlesToInheritVector handles_to_inherit = {
       handles.desktop(), handles.window_station(),
   };
   mojo::edk::PlatformChannelPair mojo_channel;
   mojo_channel.PrepareToPassClientHandleToChildProcess(&command_line,
                                                        &handles_to_inherit);
 
   // Try to launch the worker process. The launched process inherits
   // the window station, desktop and pipe handles, created above.
   ScopedHandle worker_process;
   ScopedHandle worker_thread;
   if (!LaunchProcessWithToken(
           command_line.GetProgram(), command_line.GetCommandLineString(),
           token.Get(), &process_attributes, &thread_attributes,
           handles_to_inherit, /* creation_flags= */ 0,
           /* thread_attributes= */ nullptr, &worker_process, &worker_thread)) {
-    mojo::edk::ChildProcessLaunchFailed(mojo_child_token);
     ReportFatalError();
     return;
   }
-  mojo::edk::ChildProcessLaunched(
-      worker_process.Get(), mojo_channel.PassServerHandle(), mojo_child_token);
+  process.Connect(worker_process.Get(), mojo_channel.PassServerHandle());
 
   channel_ = std::move(server);
 
   ReportProcessLaunched(std::move(worker_process));
 }
 
 void UnprivilegedProcessDelegate::Send(IPC::Message* message) {
   DCHECK(CalledOnValidThread());
 
   if (channel_) {
@@ skipping 76 matching lines @@
     PLOG(ERROR) << "Failed to duplicate a handle";
     ReportFatalError();
     return;
   }
   ScopedHandle limited_handle(temp_handle);
 
   event_handler_->OnProcessLaunched(std::move(limited_handle));
 }
 
 }  // namespace remoting