CSRSS lockdown: destroy CSRSS heap

sandbox/win/src/target_services.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sandbox/win/src/target_services.h"
 
 #include <new>
 
 #include <process.h>
 #include <stdint.h>
 
 #include "base/win/windows_version.h"
 #include "sandbox/win/src/crosscall_client.h"
 #include "sandbox/win/src/handle_closer_agent.h"
+#include "sandbox/win/src/heap_helper.h"
 #include "sandbox/win/src/ipc_tags.h"
 #include "sandbox/win/src/process_mitigations.h"
 #include "sandbox/win/src/restricted_token_utils.h"
 #include "sandbox/win/src/sandbox.h"
 #include "sandbox/win/src/sandbox_nt_util.h"
 #include "sandbox/win/src/sandbox_types.h"
 #include "sandbox/win/src/sharedmem_ipc_client.h"
 
+namespace sandbox {
 namespace {
 
 // Flushing a cached key is triggered by just opening the key and closing the
 // resulting handle. RegDisablePredefinedCache() is the documented way to flush
 // HKCU so do not use it with this function.
 bool FlushRegKey(HKEY root) {
   HKEY key;
   if (ERROR_SUCCESS == ::RegOpenKeyExW(root, NULL, 0, MAXIMUM_ALLOWED, &key)) {
     if (ERROR_SUCCESS != ::RegCloseKey(key))
       return false;
   }
   return true;
 }
 
 // This function forces advapi32.dll to release some internally cached handles
 // that were made during calls to RegOpenkey and RegOpenKeyEx if it is called
 // with a more restrictive token. Returns true if the flushing is succesful
 // although this behavior is undocumented and there is no guarantee that in
 // fact this will happen in future versions of windows.
 bool FlushCachedRegHandles() {
   return (FlushRegKey(HKEY_LOCAL_MACHINE) &&
           FlushRegKey(HKEY_CLASSES_ROOT) &&
           FlushRegKey(HKEY_USERS));
 }
 
+// Cleans up this process if CSRSS will be disconnected, as this disconnection
+// is not supported Windows behavior.
+// Currently, this step requires closing a heap that this shared with csrss.exe.
+// Closing the ALPC Port handle to csrss.exe leaves this heap in an invalid
+// state. This causes problems if anyone enumerates the heap.
+bool CsrssDisconnectCleanup() {
+  HANDLE csr_port_heap = FindCsrPortHeap();
+  if (!csr_port_heap) {
+    LOG(ERROR) << "Failed to find CSR Port heap handle";
+    return false;
+  }
+  HeapDestroy(csr_port_heap);
+  return true;
+}
+
 // Checks if we have handle entries pending and runs the closer.
 // Updates is_csrss_connected based on which handle types are closed.
 bool CloseOpenHandles(bool* is_csrss_connected) {
-  if (sandbox::HandleCloserAgent::NeedsHandlesClosed()) {
-    sandbox::HandleCloserAgent handle_closer;
+  if (HandleCloserAgent::NeedsHandlesClosed()) {
+    HandleCloserAgent handle_closer;
     handle_closer.InitializeHandlesToClose(is_csrss_connected);
+    if (!*is_csrss_connected) {
+      if (!CsrssDisconnectCleanup()) {
+        return false;
+      }
+    }
     if (!handle_closer.CloseHandles())
       return false;
   }
-
   return true;
 }
 
 // GetUserDefaultLocaleName is not available on WIN XP.  So we'll
 // load it on-the-fly.
 const wchar_t kKernel32DllName[] = L"kernel32.dll";
 typedef decltype(GetUserDefaultLocaleName)* GetUserDefaultLocaleNameFunction;
 
 // Warm up language subsystems before the sandbox is turned on.
 // Tested on Win8.1 x64:
@@ skipping 23 matching lines @@
   }
   wchar_t localeName[LOCALE_NAME_MAX_LENGTH] = {0};
   return (0 != GetUserDefaultLocaleName_func(
                     localeName, LOCALE_NAME_MAX_LENGTH * sizeof(wchar_t)));
 }
 
 // Used as storage for g_target_services, because other allocation facilities
 // are not available early. We can't use a regular function static because on
 // VS2015, because the CRT tries to acquire a lock to guard initialization, but
 // this code runs before the CRT is initialized.
-char g_target_services_memory[sizeof(sandbox::TargetServicesBase)];
-sandbox::TargetServicesBase* g_target_services = nullptr;
+char g_target_services_memory[sizeof(TargetServicesBase)];
+TargetServicesBase* g_target_services = nullptr;
 
 }  // namespace
 
-namespace sandbox {
 
 SANDBOX_INTERCEPT IntegrityLevel g_shared_delayed_integrity_level =
     INTEGRITY_LEVEL_LAST;
 SANDBOX_INTERCEPT MitigationFlags g_shared_delayed_mitigations = 0;
 
 TargetServicesBase::TargetServicesBase() {
 }
 
 ResultCode TargetServicesBase::Init() {
   process_state_.SetInitCalled();
@@ skipping 121 matching lines @@
 void ProcessState::SetRevertedToSelf() {
   if (process_state_ < 3)
     process_state_ = 3;
 }
 
 void ProcessState::SetCsrssConnected(bool csrss_connected) {
   csrss_connected_ = csrss_connected;
 }
 
 }  // namespace sandbox