CSRSS lockdown: destroy CSRSS heap

sandbox/win/src/target_services.cc

Index: sandbox/win/src/target_services.cc
diff --git a/sandbox/win/src/target_services.cc b/sandbox/win/src/target_services.cc
index ec2fa7134c8b46663a809ff09c38dc9b517bf2e4..1a8228c4f8d79d359cc2487cde8b2f79a2bb9fd3 100644
--- a/sandbox/win/src/target_services.cc
+++ b/sandbox/win/src/target_services.cc
@@ -12,6 +12,7 @@
 #include "base/win/windows_version.h"
 #include "sandbox/win/src/crosscall_client.h"
 #include "sandbox/win/src/handle_closer_agent.h"
+#include "sandbox/win/src/heap_helper.h"
 #include "sandbox/win/src/ipc_tags.h"
 #include "sandbox/win/src/process_mitigations.h"
 #include "sandbox/win/src/restricted_token_utils.h"
@@ -45,16 +46,34 @@ bool FlushCachedRegHandles() {
           FlushRegKey(HKEY_USERS));
 }
 
+// Cleans up this process if CSRSS will be disconnected, as this disconnection
+// is not supported Windows behavior.
+// Currently, this step requires closing a heap that this shared with csrss.exe.
+// Closing the ALPC Port handle to csrss.exe leaves this heap in an invalid
+// state. This causes problems if anyone enumerates the heap.
+bool CsrssDisconnectCleanup() {
+  PVOID csr_port_heap = sandbox::FindCsrPortHeap();

[Will Harris, 2017/03/22 19:21:49]

are we not already in sandbox namespace. hmm? strange

[Will Harris, 2017/03/22 19:21:49]

implicit cast from HANDLE to PVOID - is this what you intend?

[liamjm (20p), 2017/04/14 17:27:20]

No. 
changed to HANDLE.

Thanks.

[liamjm (20p), 2017/04/14 17:27:20]

Yeah... 
Just in an unnamed namespace at this point.

We could move a couple of functions into the namespace, if desired.

[Will Harris, 2017/05/01 18:33:15]

yes it seems to make sense to move all these functions to the sandbox anonymous
namespace, and then remove the sandbox:: parts below

+  if (nullptr == csr_port_heap) {

[Will Harris, 2017/03/22 19:21:49]

!csr_port_heap

[liamjm (20p), 2017/04/14 17:27:20]

Done.

+    LOG(ERROR) << "Failed to find CSR Port heap handle" return false;

[Will Harris, 2017/03/22 19:21:49]

win\src\target_services.cc(57): error C2143: syntax error: missing ';' before
'return'

[liamjm (20p), 2017/04/14 17:27:20]

Done.

+  }
+  HeapDestroy(csr_port_heap);
+  return true;
+}
+
 // Checks if we have handle entries pending and runs the closer.
 // Updates is_csrss_connected based on which handle types are closed.
 bool CloseOpenHandles(bool* is_csrss_connected) {
   if (sandbox::HandleCloserAgent::NeedsHandlesClosed()) {
     sandbox::HandleCloserAgent handle_closer;
     handle_closer.InitializeHandlesToClose(is_csrss_connected);
+    if (!*is_csrss_connected) {
+      if (!CsrssDisconnectCleanup()) {
+        return false;
+      }
+    }
     if (!handle_closer.CloseHandles())
       return false;
   }
-
   return true;
 }